@frontmcp/auth 1.7.2 → 1.8.1

package/index.js

@@ -269,9 +269,9 @@ __export(index_exports, {
   EagerCredentialLoader: () => EagerCredentialLoader,
   ElicitationSecretRequiredError: () => ElicitationSecretRequiredError,
   EncryptedRedisVault: () => EncryptedRedisVault,
-  EncryptedStorageError: () => import_utils23.EncryptedStorageError,
+  EncryptedStorageError: () => import_utils24.EncryptedStorageError,
   EncryptedStorageSecureStoreBackend: () => EncryptedStorageSecureStoreBackend,
-  EncryptedTypedStorage: () => import_utils23.EncryptedTypedStorage,
+  EncryptedTypedStorage: () => import_utils24.EncryptedTypedStorage,
   EncryptionContextNotSetError: () => EncryptionContextNotSetError,
   EncryptionKeyNotConfiguredError: () => EncryptionKeyNotConfiguredError,
   FetchCredentialMiddleware: () => FetchCredentialMiddleware,
@@ -285,6 +285,8 @@ __export(index_exports, {
   InMemoryStoreRequiredError: () => InMemoryStoreRequiredError,
   InvalidClientIdUrlError: () => InvalidClientIdUrlError,
   JwksService: () => JwksService,
+  JwtSecretRequiredError: () => JwtSecretRequiredError,
+  JwtSecretWeakError: () => JwtSecretWeakError,
   LazyCredentialLoader: () => LazyCredentialLoader,
   NoProviderIdError: () => NoProviderIdError,
   NullOrchestratedAuthAccessor: () => NullOrchestratedAuthAccessor,
@@ -317,7 +319,7 @@ __export(index_exports, {
   TokenVault: () => TokenVault,
   TransparentAuthorization: () => TransparentAuthorization,
   TransportIdGenerator: () => TransportIdGenerator,
-  TypedStorage: () => import_utils22.TypedStorage,
+  TypedStorage: () => import_utils23.TypedStorage,
   VaultEncryption: () => VaultEncryption,
   VaultLoadError: () => VaultLoadError,
   VaultNotFoundError: () => VaultNotFoundError,
@@ -399,9 +401,9 @@ __export(index_exports, {
   credentialTypeSchema: () => credentialTypeSchema,
   customCredentialSchema: () => customCredentialSchema,
   decodeJwtPayloadSafe: () => decodeJwtPayloadSafe,
-  decryptAesGcm: () => import_utils33.decryptAesGcm,
+  decryptAesGcm: () => import_utils34.decryptAesGcm,
   decryptSessionJson: () => decryptSessionJson,
-  decryptValue: () => import_utils33.decryptValue,
+  decryptValue: () => import_utils34.decryptValue,
   defaultSessionRateLimiter: () => defaultSessionRateLimiter,
   deriveAuthorizationId: () => deriveAuthorizationId,
   deriveExpectedAudience: () => deriveExpectedAudience,
@@ -409,13 +411,13 @@ __export(index_exports, {
   deriveTypedUser: () => deriveTypedUser,
   detectAuthProviders: () => detectAuthProviders,
   detectedAuthProviderSchema: () => detectedAuthProviderSchema,
-  encryptAesGcm: () => import_utils33.encryptAesGcm,
+  encryptAesGcm: () => import_utils34.encryptAesGcm,
   encryptJson: () => encryptJson,
-  encryptValue: () => import_utils33.encryptValue,
+  encryptValue: () => import_utils34.encryptValue,
   encryptedBlobSchema: () => encryptedBlobSchema,
   encryptedDataSchema: () => encryptedDataSchema,
   encryptedVaultEntrySchema: () => encryptedVaultEntrySchema,
-  escapeHtml: () => import_utils3.escapeHtml,
+  escapeHtml: () => import_utils4.escapeHtml,
   extraWideLayout: () => extraWideLayout,
   extractBearerToken: () => extractBearerToken,
   extractCacheHeaders: () => extractCacheHeaders,
@@ -437,8 +439,9 @@ __export(index_exports, {
   getTokenSignatureFingerprint: () => getTokenSignatureFingerprint,
   hasOnlyLocalhostRedirectUris: () => hasOnlyLocalhostRedirectUris,
   headerApplier: () => headerApplier,
-  hkdfSha256: () => import_utils33.hkdfSha256,
+  hkdfSha256: () => import_utils34.hkdfSha256,
   incrementalAuthConfigSchema: () => incrementalAuthConfigSchema,
+  isAnonymousSubject: () => isAnonymousSubject,
   isCimdClientId: () => isCimdClientId,
   isFrontMcpCredentials: () => isFrontMcpCredentials,
   isJwt: () => isJwt,
@@ -451,10 +454,11 @@ __export(index_exports, {
   isRedisTokenStorage: () => isRedisTokenStorage,
   isRemoteMode: () => isRemoteMode,
   isSessionComplete: () => isSessionComplete,
-  isSignedSession: () => import_utils15.isSignedData,
+  isSignedSession: () => import_utils16.isSignedData,
   isSoonExpiring: () => isSoonExpiring,
   isSoonExpiringProvider: () => isSoonExpiringProvider,
   isSqliteTokenStorage: () => isSqliteTokenStorage,
+  isStaticMode: () => isStaticMode,
   isTransparentMode: () => isTransparentMode,
   jsonWebKeySetSchema: () => jsonWebKeySetSchema,
   jwkParametersSchema: () => jwkParametersSchema,
@@ -514,6 +518,7 @@ __export(index_exports, {
   startNextProvider: () => startNextProvider,
   statefulHttpTransportStateSchema: () => statefulHttpTransportStateSchema,
   statelessHttpTransportStateSchema: () => statelessHttpTransportStateSchema,
+  staticAuthOptionsSchema: () => staticAuthOptionsSchema,
   storedSessionSchema: () => storedSessionSchema,
   streamableHttpTransportStateSchema: () => streamableHttpTransportStateSchema,
   toEpochSeconds: () => toEpochSeconds,
@@ -545,6 +550,9 @@ module.exports = __toCommonJS(index_exports);
 
 // libs/auth/src/jwks/jwks.service.ts
 var import_jose = require("jose");
+var import_utils2 = require("@frontmcp/utils");
+
+// libs/auth/src/cimd/cimd.validator.ts
 var import_utils = require("@frontmcp/utils");
 
 // libs/auth/src/cimd/cimd.errors.ts
@@ -810,70 +818,38 @@ function isIpAddress(hostname) {
   }
   return false;
 }
+var BLOCKED_RANGE_REASONS = /* @__PURE__ */ new Map([
+  ["0.0.0.0/8", "Current network addresses (0.x.x.x) are not allowed"],
+  ["10.0.0.0/8", "Private IP addresses (10.x.x.x) are not allowed"],
+  ["100.64.0.0/10", "Carrier-grade NAT addresses (100.64-127.x.x) are not allowed"],
+  ["127.0.0.0/8", "Loopback addresses (127.x.x.x) are not allowed"],
+  ["169.254.0.0/16", "Link-local addresses (169.254.x.x) are not allowed"],
+  ["172.16.0.0/12", "Private IP addresses (172.16-31.x.x) are not allowed"],
+  ["192.0.0.0/24", "IETF protocol-assignment addresses (192.0.0.0/24) are not allowed"],
+  ["192.168.0.0/16", "Private IP addresses (192.168.x.x) are not allowed"],
+  ["224.0.0.0/4", "Multicast addresses are not allowed"],
+  ["255.255.255.255/32", "Broadcast address is not allowed"],
+  ["::/128", "IPv6 unspecified address (::) is not allowed"],
+  ["::1/128", "IPv6 loopback address (::1) is not allowed"],
+  ["fc00::/7", "IPv6 unique local addresses (fc00::/7) are not allowed"],
+  ["fe80::/10", "IPv6 link-local addresses (fe80::/10) are not allowed"]
+]);
 function checkIpAddress(ip) {
-  const cleanIp = ip.replace(/^\[|\]$/g, "");
-  if (cleanIp.includes(".") && !cleanIp.includes(":")) {
-    return checkIpv4(cleanIp);
-  }
-  return checkIpv6(cleanIp);
-}
-function checkIpv4(ip) {
-  const parts = ip.split(".").map(Number);
-  if (parts.length !== 4 || parts.some((p) => isNaN(p) || p < 0 || p > 255)) {
-    return { allowed: false, reason: "Invalid IPv4 address" };
-  }
-  const [a, b, c, d] = parts;
-  if (a === 127) {
-    return { allowed: false, reason: "Loopback addresses (127.x.x.x) are not allowed" };
-  }
-  if (a === 10) {
-    return { allowed: false, reason: "Private IP addresses (10.x.x.x) are not allowed" };
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return { allowed: false, reason: "Private IP addresses (172.16-31.x.x) are not allowed" };
-  }
-  if (a === 192 && b === 168) {
-    return { allowed: false, reason: "Private IP addresses (192.168.x.x) are not allowed" };
-  }
-  if (a === 169 && b === 254) {
-    return { allowed: false, reason: "Link-local addresses (169.254.x.x) are not allowed" };
-  }
-  if (a === 100 && b >= 64 && b <= 127) {
-    return { allowed: false, reason: "Carrier-grade NAT addresses (100.64-127.x.x) are not allowed" };
-  }
-  if (a === 192 && b === 0 && c === 0) {
-    return { allowed: false, reason: "IETF protocol-assignment addresses (192.0.0.0/24) are not allowed" };
-  }
-  if (a === 0) {
-    return { allowed: false, reason: "Current network addresses (0.x.x.x) are not allowed" };
-  }
-  if (a === 255 && b === 255 && c === 255 && d === 255) {
-    return { allowed: false, reason: "Broadcast address is not allowed" };
-  }
-  if (a >= 224 && a <= 239) {
-    return { allowed: false, reason: "Multicast addresses are not allowed" };
-  }
-  return { allowed: true, reason: "" };
-}
-function checkIpv6(ip) {
-  const normalizedIp = ip.toLowerCase();
-  if (normalizedIp === "::1") {
-    return { allowed: false, reason: "IPv6 loopback address (::1) is not allowed" };
-  }
-  if (normalizedIp === "::" || normalizedIp === "0:0:0:0:0:0:0:0") {
-    return { allowed: false, reason: "IPv6 unspecified address (::) is not allowed" };
-  }
-  if (normalizedIp.startsWith("fe8") || normalizedIp.startsWith("fe9") || normalizedIp.startsWith("fea") || normalizedIp.startsWith("feb")) {
-    return { allowed: false, reason: "IPv6 link-local addresses (fe80::/10) are not allowed" };
-  }
-  if (normalizedIp.startsWith("fc") || normalizedIp.startsWith("fd")) {
-    return { allowed: false, reason: "IPv6 unique local addresses (fc00::/7) are not allowed" };
+  const classification = (0, import_utils.classifyIpAddress)(ip);
+  if (!classification) {
+    const bareIp = ip.replace(/^\[|\]$/g, "");
+    return {
+      allowed: false,
+      reason: bareIp.includes(":") ? `Malformed IPv6 address: ${bareIp}` : "Invalid IPv4 address"
+    };
   }
-  const ipv4MappedMatch = normalizedIp.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
-  if (ipv4MappedMatch) {
-    return checkIpv4(ipv4MappedMatch[1]);
+  if (classification.range === "public") {
+    return { allowed: true, reason: "" };
   }
-  return { allowed: true, reason: "" };
+  return {
+    allowed: false,
+    reason: BLOCKED_RANGE_REASONS.get(classification.cidr) ?? `Addresses in the ${classification.range} range (${classification.cidr}) are not allowed`
+  };
 }
 function isDomainInList(hostname, domainList) {
   const lowerHostname = hostname.toLowerCase();
@@ -1004,9 +980,9 @@ var JwksService = class {
    * Returns null if persistence is disabled (production).
    */
   async getKeyPersistence() {
-    if ((0, import_utils.isProduction)()) return null;
+    if ((0, import_utils2.isProduction)()) return null;
     if (!this.keyPersistence) {
-      this.keyPersistence = await (0, import_utils.createKeyPersistence)({
+      this.keyPersistence = await (0, import_utils2.createKeyPersistence)({
         baseDir: ".frontmcp/keys"
       });
     }
@@ -1125,7 +1101,7 @@ var JwksService = class {
       if (!jwtAlg) {
         return { ok: false, error: "missing_alg" };
       }
-      const isValid = await (0, import_utils.rsaVerify)(
+      const isValid = await (0, import_utils2.rsaVerify)(
         jwtAlg,
         Buffer.from(signatureInput),
         matchingKey,
@@ -1268,10 +1244,10 @@ var JwksService = class {
         const parsed = new URL(currentUrl);
         const host = parsed.hostname.toLowerCase();
         const isLocalhost = host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.endsWith(".localhost");
-        if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && (isLocalhost || !(0, import_utils.isProduction)()))) {
+        if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && (isLocalhost || !(0, import_utils2.isProduction)()))) {
           throw new Error(`insecure scheme "${parsed.protocol}"`);
         }
-        if (!(isLocalhost && !(0, import_utils.isProduction)())) {
+        if (!(isLocalhost && !(0, import_utils2.isProduction)())) {
           const ssrf = await resolveAndCheckHostname(parsed.hostname);
           if (!ssrf.allowed) throw new Error(`blocked host: ${ssrf.reason}`);
         }
@@ -1282,11 +1258,10 @@ var JwksService = class {
           // Follow redirects manually so each hop is re-validated (scheme + SSRF).
           redirect: "manual"
         });
-        if (res.status >= 300 && res.status < 400) {
+        if ((0, import_utils2.isRedirectResponse)(res)) {
           const location = res.headers.get("location");
-          if (!location || hop >= MAX_JWKS_FETCH_HOPS) {
-            throw new Error("too many redirects");
-          }
+          if (!location) throw new Error("redirect without a readable Location header");
+          if (hop >= MAX_JWKS_FETCH_HOPS) throw new Error("too many redirects");
           currentUrl = new URL(location, currentUrl).toString();
           continue;
         }
@@ -1379,13 +1354,13 @@ var JwksService = class {
     const { generateKeyPairSync } = require("node:crypto");
     if (alg === "RS256") {
       const { privateKey, publicKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
-      const kid = (0, import_utils.bytesToHex)((0, import_utils.randomBytes)(8));
+      const kid = (0, import_utils2.bytesToHex)((0, import_utils2.randomBytes)(8));
       const publicJwk = publicKey.export({ format: "jwk" });
       Object.assign(publicJwk, { kid, alg: "RS256", use: "sig", kty: "RSA" });
       return { kid, privateKey, publicJwk: { keys: [publicJwk] }, createdAt: Date.now() };
     } else {
       const { privateKey, publicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
-      const kid = (0, import_utils.bytesToHex)((0, import_utils.randomBytes)(8));
+      const kid = (0, import_utils2.bytesToHex)((0, import_utils2.randomBytes)(8));
       const publicJwk = publicKey.export({ format: "jwk" });
       Object.assign(publicJwk, { kid, alg: "ES256", use: "sig", kty: "EC" });
       return { kid, privateKey, publicJwk: { keys: [publicJwk] }, createdAt: Date.now() };
@@ -1394,8 +1369,8 @@ var JwksService = class {
 };
 
 // libs/auth/src/ui/base-layout.ts
-var import_utils2 = require("@frontmcp/utils");
 var import_utils3 = require("@frontmcp/utils");
+var import_utils4 = require("@frontmcp/utils");
 var CDN = {
   /** Tailwind CSS v4 Browser CDN - generates styles on-the-fly with @theme support */
   tailwind: "https://cdn.jsdelivr.net/npm/@tailwindcss/browser@4",
@@ -1474,13 +1449,13 @@ function baseLayout(content, options) {
     }
     ${customCss}
   </style>` : "";
-  const metaDescription = description ? `<meta name="description" content="${(0, import_utils2.escapeHtml)(description)}">` : "";
+  const metaDescription = description ? `<meta name="description" content="${(0, import_utils3.escapeHtml)(description)}">` : "";
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>${(0, import_utils2.escapeHtml)(title)} - FrontMCP</title>
+  <title>${(0, import_utils3.escapeHtml)(title)} - FrontMCP</title>
   ${metaDescription}
 
   <!-- Google Fonts CDN - Inter (modern UI font) -->
@@ -1491,7 +1466,7 @@ function baseLayout(content, options) {
   ${tailwindBlock}
   ${headExtra}
 </head>
-<body class="${(0, import_utils2.escapeHtml)(bodyClass)}">
+<body class="${(0, import_utils3.escapeHtml)(bodyClass)}">
   ${content}
 </body>
 </html>`;
@@ -1546,7 +1521,7 @@ function extraWideLayout(content, options) {
 }
 
 // libs/auth/src/ui/templates.ts
-var escapeHtml3 = import_utils3.escapeHtml;
+var escapeHtml3 = import_utils4.escapeHtml;
 function buildConsentPage(params) {
   const { apps, clientName, pendingAuthId, csrfToken, callbackPath } = params;
   const appCards = apps.map((app) => buildAppCardHtml(app, pendingAuthId, csrfToken, callbackPath)).join("\n");
@@ -2048,7 +2023,7 @@ function renderLocalLoginPage(login, ctx, values) {
 
 // libs/auth/src/session/authorization.store.ts
 var import_lazy_zod = require("@frontmcp/lazy-zod");
-var import_utils4 = require("@frontmcp/utils");
+var import_utils5 = require("@frontmcp/utils");
 var pkceChallengeSchema = import_lazy_zod.z.object({
   challenge: import_lazy_zod.z.string().min(43).max(128),
   method: import_lazy_zod.z.literal("S256")
@@ -2083,10 +2058,10 @@ var AUTH_CODE_TTL_MS = 60 * 1e3;
 var PENDING_AUTH_TTL_MS = 10 * 60 * 1e3;
 var REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 function generateAuthorizationCode() {
-  return (0, import_utils4.randomUUID)().replace(/-/g, "") + (0, import_utils4.randomUUID)().replace(/-/g, "");
+  return (0, import_utils5.randomUUID)().replace(/-/g, "") + (0, import_utils5.randomUUID)().replace(/-/g, "");
 }
 function generateRefreshTokenValue() {
-  return (0, import_utils4.randomUUID)() + "-" + (0, import_utils4.randomUUID)();
+  return (0, import_utils5.randomUUID)() + "-" + (0, import_utils5.randomUUID)();
 }
 function buildCodeRecord(params) {
   const now = Date.now();
@@ -2117,7 +2092,7 @@ function buildCodeRecord(params) {
 function buildPendingRecord(params) {
   const now = Date.now();
   return {
-    id: (0, import_utils4.randomUUID)(),
+    id: (0, import_utils5.randomUUID)(),
     clientId: params.clientId,
     redirectUri: params.redirectUri,
     scopes: params.scopes,
@@ -2166,11 +2141,11 @@ function verifyPkce(codeVerifier, challenge) {
   if (challenge.method !== "S256") {
     return false;
   }
-  const hash = (0, import_utils4.sha256Base64url)(codeVerifier);
+  const hash = (0, import_utils5.sha256Base64url)(codeVerifier);
   return hash === challenge.challenge;
 }
 function generatePkceChallenge(codeVerifier) {
-  const challenge = (0, import_utils4.sha256Base64url)(codeVerifier);
+  const challenge = (0, import_utils5.sha256Base64url)(codeVerifier);
   return { challenge, method: "S256" };
 }
 var InMemoryAuthorizationStore = class {
@@ -2366,7 +2341,7 @@ var RedisAuthorizationStore = class {
 };
 
 // libs/auth/src/session/storage-authorization.store.ts
-var import_utils5 = require("@frontmcp/utils");
+var import_utils6 = require("@frontmcp/utils");
 var StorageAuthorizationStore = class {
   codeStore;
   pendingStore;
@@ -2377,9 +2352,9 @@ var StorageAuthorizationStore = class {
     this.namespace = options.namespace ?? "oauth";
     this.storageIsNamespaced = this.isNamespacedStorage(storage);
     const base = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
-    this.codeStore = new import_utils5.TypedStorage(base);
-    this.pendingStore = new import_utils5.TypedStorage(base);
-    this.refreshStore = new import_utils5.TypedStorage(base);
+    this.codeStore = new import_utils6.TypedStorage(base);
+    this.pendingStore = new import_utils6.TypedStorage(base);
+    this.refreshStore = new import_utils6.TypedStorage(base);
   }
   // ============================================
   // Record builders (pure; shared with in-memory store)
@@ -2752,11 +2727,11 @@ var authorizationVaultEntrySchema = import_lazy_zod2.z.object({
 });
 
 // libs/auth/src/session/session-credential-vault.ts
-var import_utils7 = require("@frontmcp/utils");
+var import_utils8 = require("@frontmcp/utils");
 
 // libs/auth/src/session/vault-encryption.ts
 var import_lazy_zod3 = require("@frontmcp/lazy-zod");
-var import_utils6 = require("@frontmcp/utils");
+var import_utils7 = require("@frontmcp/utils");
 var encryptedDataSchema = import_lazy_zod3.z.object({
   /** Version for future algorithm changes */
   v: import_lazy_zod3.z.literal(1),
@@ -2796,7 +2771,7 @@ var VaultEncryption = class {
     ];
     const ikm = new TextEncoder().encode(ikmParts.join(""));
     const infoBytes = new TextEncoder().encode(this.hkdfInfo);
-    const key = await (0, import_utils6.hkdfSha256)(ikm, new Uint8Array(0), infoBytes, 32);
+    const key = await (0, import_utils7.hkdfSha256)(ikm, new Uint8Array(0), infoBytes, 32);
     return key;
   }
   /**
@@ -2823,7 +2798,7 @@ var VaultEncryption = class {
     ];
     const ikm = new TextEncoder().encode(ikmParts.join(""));
     const infoBytes = new TextEncoder().encode(this.hkdfInfo);
-    const key = await (0, import_utils6.hkdfSha256)(ikm, new Uint8Array(0), infoBytes, 32);
+    const key = await (0, import_utils7.hkdfSha256)(ikm, new Uint8Array(0), infoBytes, 32);
     return key;
   }
   /**
@@ -2837,14 +2812,14 @@ var VaultEncryption = class {
     if (key.length !== 32) {
       throw new Error("Encryption key must be 32 bytes");
     }
-    const iv = (0, import_utils6.randomBytes)(12);
-    const { ciphertext, tag } = await (0, import_utils6.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
+    const iv = (0, import_utils7.randomBytes)(12);
+    const { ciphertext, tag } = await (0, import_utils7.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
     return {
       v: 1,
       alg: "aes-256-gcm",
-      iv: (0, import_utils6.base64urlEncode)(iv),
-      ct: (0, import_utils6.base64urlEncode)(ciphertext),
-      tag: (0, import_utils6.base64urlEncode)(tag)
+      iv: (0, import_utils7.base64urlEncode)(iv),
+      ct: (0, import_utils7.base64urlEncode)(ciphertext),
+      tag: (0, import_utils7.base64urlEncode)(tag)
     };
   }
   /**
@@ -2864,11 +2839,11 @@ var VaultEncryption = class {
       throw new Error("Invalid encrypted data format");
     }
     const { iv, ct, tag } = parsed.data;
-    const ivBuffer = (0, import_utils6.base64urlDecode)(iv);
-    const ciphertext = (0, import_utils6.base64urlDecode)(ct);
-    const tagBuffer = (0, import_utils6.base64urlDecode)(tag);
+    const ivBuffer = (0, import_utils7.base64urlDecode)(iv);
+    const ciphertext = (0, import_utils7.base64urlDecode)(ct);
+    const tagBuffer = (0, import_utils7.base64urlDecode)(tag);
     try {
-      const plaintext = await (0, import_utils6.decryptAesGcm)(key, ciphertext, ivBuffer, tagBuffer);
+      const plaintext = await (0, import_utils7.decryptAesGcm)(key, ciphertext, ivBuffer, tagBuffer);
       return new TextDecoder().decode(plaintext);
     } catch (_error) {
       throw new Error("Decryption failed: invalid key or corrupted data");
@@ -3008,7 +2983,7 @@ var SessionCredentialVault = class {
    * it expires via TTL when configured.
    */
   async rotateVault(sub) {
-    const vaultId = (0, import_utils7.randomUUID)();
+    const vaultId = (0, import_utils8.randomUUID)();
     await this.storage.set(this.indexKey(sub), vaultId, this.credentialSetOpts);
     return vaultId;
   }
@@ -3157,19 +3132,19 @@ var SessionCredentialVault = class {
   }
 };
 function resolveVaultPepper(logger) {
-  const fromEnv = (0, import_utils7.getEnv)("VAULT_SECRET") ?? (0, import_utils7.getEnv)("JWT_SECRET");
+  const fromEnv = (0, import_utils8.getEnv)("VAULT_SECRET") ?? (0, import_utils8.getEnv)("JWT_SECRET");
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv;
   logger.warn(
     "SessionCredentialVault: neither VAULT_SECRET nor JWT_SECRET is set; using a random per-process pepper. Stored credentials will NOT survive a restart and cannot be shared across instances. Set VAULT_SECRET (or JWT_SECRET) for persistent, multi-instance credential storage."
   );
-  return (0, import_utils7.randomUUID)() + (0, import_utils7.randomUUID)();
+  return (0, import_utils8.randomUUID)() + (0, import_utils8.randomUUID)();
 }
 function errMsg(err) {
   return err instanceof Error ? err.message : String(err);
 }
 
 // libs/auth/src/session/token-storage.factory.ts
-var import_utils8 = require("@frontmcp/utils");
+var import_utils9 = require("@frontmcp/utils");
 function isRedisTokenStorage(config) {
   return typeof config === "object" && config !== null && "redis" in config && !!config.redis;
 }
@@ -3181,7 +3156,7 @@ function isPersistentTokenStorage(config) {
 }
 async function createTokenStorageAdapter(config) {
   if (config === void 0 || config === "memory") {
-    const adapter = new import_utils8.MemoryStorageAdapter();
+    const adapter = new import_utils9.MemoryStorageAdapter();
     await adapter.connect();
     return adapter;
   }
@@ -3198,14 +3173,14 @@ async function createTokenStorageAdapter(config) {
   }
   if (isRedisTokenStorage(config)) {
     const { host, port, password, db, tls, keyPrefix } = config.redis;
-    const adapter = new import_utils8.RedisStorageAdapter({
+    const adapter = new import_utils9.RedisStorageAdapter({
       config: { host, port, password, db, tls },
       keyPrefix: keyPrefix ?? ""
     });
     await adapter.connect();
     return adapter;
   }
-  const fallback = new import_utils8.MemoryStorageAdapter();
+  const fallback = new import_utils9.MemoryStorageAdapter();
   await fallback.connect();
   return fallback;
 }
@@ -3225,7 +3200,7 @@ async function createSessionCredentialVault(options) {
 }
 
 // libs/auth/src/session/credential-resume-link.ts
-var import_utils9 = require("@frontmcp/utils");
+var import_utils10 = require("@frontmcp/utils");
 var DEFAULT_RESUME_TTL_MS = 6e5;
 function signCredentialResumeToken(input, secret) {
   const payload = {
@@ -3234,7 +3209,7 @@ function signCredentialResumeToken(input, secret) {
     ...input.context !== void 0 ? { context: input.context } : {},
     exp: Date.now() + (input.ttlMs ?? DEFAULT_RESUME_TTL_MS)
   };
-  const signedJson = (0, import_utils9.signData)(payload, { secret });
+  const signedJson = (0, import_utils10.signData)(payload, { secret });
   return Buffer.from(signedJson, "utf8").toString("base64url");
 }
 function verifyCredentialResumeToken(token, secret, now = Date.now()) {
@@ -3244,7 +3219,7 @@ function verifyCredentialResumeToken(token, secret, now = Date.now()) {
   } catch {
     return null;
   }
-  const payload = (0, import_utils9.verifyData)(signedJson, { secret });
+  const payload = (0, import_utils10.verifyData)(signedJson, { secret });
   if (!payload) return null;
   if (typeof payload.sub !== "string" || typeof payload.key !== "string" || !Number.isFinite(payload.exp)) {
     return null;
@@ -3263,7 +3238,7 @@ function buildCredentialResumeUrl(basePath, token) {
 }
 
 // libs/auth/src/session/incremental-auth-ticket.ts
-var import_utils10 = require("@frontmcp/utils");
+var import_utils11 = require("@frontmcp/utils");
 var DEFAULT_INCREMENTAL_TICKET_TTL_MS = 3e5;
 function signIncrementalAuthTicket(input, secret) {
   const payload = {
@@ -3271,10 +3246,10 @@ function signIncrementalAuthTicket(input, secret) {
     appId: input.appId,
     ...input.toolId !== void 0 ? { toolId: input.toolId } : {},
     ...input.priorAppIds !== void 0 ? { priorAppIds: input.priorAppIds } : {},
-    jti: (0, import_utils10.randomUUID)(),
+    jti: (0, import_utils11.randomUUID)(),
     exp: Date.now() + (input.ttlMs ?? DEFAULT_INCREMENTAL_TICKET_TTL_MS)
   };
-  const signedJson = (0, import_utils10.signData)(payload, { secret });
+  const signedJson = (0, import_utils11.signData)(payload, { secret });
   return Buffer.from(signedJson, "utf8").toString("base64url");
 }
 function verifyIncrementalAuthTicket(token, secret, now = Date.now()) {
@@ -3284,7 +3259,7 @@ function verifyIncrementalAuthTicket(token, secret, now = Date.now()) {
   } catch {
     return null;
   }
-  const payload = (0, import_utils10.verifyData)(signedJson, { secret });
+  const payload = (0, import_utils11.verifyData)(signedJson, { secret });
   if (!payload) return null;
   if (typeof payload.sub !== "string" || payload.sub.length === 0) return null;
   if (typeof payload.appId !== "string" || payload.appId.length === 0) return null;
@@ -3464,7 +3439,7 @@ function errMsg2(err) {
 var SECURE_STORE_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:SECURE_STORE_ACCESSOR");
 
 // libs/auth/src/session/secure-store-accessor.impl.ts
-var import_utils11 = require("@frontmcp/utils");
+var import_utils12 = require("@frontmcp/utils");
 var GLOBAL_NAMESPACE = "global";
 var SecureStoreAccessorImpl = class {
   backend;
@@ -3493,12 +3468,12 @@ var SecureStoreAccessorImpl = class {
         return GLOBAL_NAMESPACE;
       case "session": {
         const sid = this.resolveSessionId();
-        return sid ? `s:${(0, import_utils11.sha256Hex)(sid).slice(0, 32)}` : void 0;
+        return sid ? `s:${(0, import_utils12.sha256Hex)(sid).slice(0, 32)}` : void 0;
       }
       case "user":
       default: {
         const sub = this.resolveSub();
-        return sub ? `u:${(0, import_utils11.sha256Hex)(sub).slice(0, 32)}` : void 0;
+        return sub ? `u:${(0, import_utils12.sha256Hex)(sub).slice(0, 32)}` : void 0;
       }
     }
   }
@@ -3539,7 +3514,7 @@ function errMsg3(err) {
 }
 
 // libs/auth/src/session/secure-store.factory.ts
-var import_utils12 = require("@frontmcp/utils");
+var import_utils13 = require("@frontmcp/utils");
 function isCustomBackendConfig(config) {
   return typeof config === "object" && config !== null && "backend" in config && !!config.backend;
 }
@@ -3588,7 +3563,7 @@ async function createSecureStore(options) {
   if (storage) {
     adapter = storage;
   } else if (kind === "memory") {
-    adapter = new import_utils12.MemoryStorageAdapter();
+    adapter = new import_utils13.MemoryStorageAdapter();
     await adapter.connect();
   } else {
     adapter = await createTokenStorageAdapter(toTokenStorageConfig(config));
@@ -3602,7 +3577,7 @@ async function createSecureStore(options) {
 }
 
 // libs/auth/src/session/token.vault.ts
-var import_utils13 = require("@frontmcp/utils");
+var import_utils14 = require("@frontmcp/utils");
 var TokenVault = class {
   /** Active key used for new encryptions */
   active;
@@ -3631,14 +3606,14 @@ var TokenVault = class {
     this.keys.set(k.kid, k.key);
   }
   async encrypt(plaintext, opts) {
-    const iv = (0, import_utils13.randomBytes)(12);
-    const { ciphertext, tag } = await (0, import_utils13.encryptAesGcm)(this.active.key, new TextEncoder().encode(plaintext), iv);
+    const iv = (0, import_utils14.randomBytes)(12);
+    const { ciphertext, tag } = await (0, import_utils14.encryptAesGcm)(this.active.key, new TextEncoder().encode(plaintext), iv);
     return {
       alg: "A256GCM",
       kid: this.active.kid,
-      iv: (0, import_utils13.base64urlEncode)(iv),
-      tag: (0, import_utils13.base64urlEncode)(tag),
-      data: (0, import_utils13.base64urlEncode)(ciphertext),
+      iv: (0, import_utils14.base64urlEncode)(iv),
+      tag: (0, import_utils14.base64urlEncode)(tag),
+      data: (0, import_utils14.base64urlEncode)(ciphertext),
       exp: opts?.exp,
       meta: opts?.meta
     };
@@ -3652,16 +3627,16 @@ var TokenVault = class {
     }
     const key = this.keys.get(blob.kid);
     if (!key) throw new Error(`vault_unknown_kid:${blob.kid}`);
-    const iv = (0, import_utils13.base64urlDecode)(blob.iv);
-    const tag = (0, import_utils13.base64urlDecode)(blob.tag);
-    const data = (0, import_utils13.base64urlDecode)(blob.data);
-    const plaintext = await (0, import_utils13.decryptAesGcm)(key, data, iv, tag);
+    const iv = (0, import_utils14.base64urlDecode)(blob.iv);
+    const tag = (0, import_utils14.base64urlDecode)(blob.tag);
+    const data = (0, import_utils14.base64urlDecode)(blob.data);
+    const plaintext = await (0, import_utils14.decryptAesGcm)(key, data, iv, tag);
     return new TextDecoder().decode(plaintext);
   }
 };
 
 // libs/auth/src/session/index.ts
-var import_utils33 = require("@frontmcp/utils");
+var import_utils34 = require("@frontmcp/utils");
 
 // libs/auth/src/session/transport-session.types.ts
 var import_lazy_zod4 = require("@frontmcp/lazy-zod");
@@ -3757,10 +3732,10 @@ var redisConfigSchema = import_lazy_zod4.z.object({
 });
 
 // libs/auth/src/session/session-crypto.ts
-var import_utils15 = require("@frontmcp/utils");
+var import_utils16 = require("@frontmcp/utils");
 
 // libs/auth/src/errors/auth-internal.error.ts
-var import_utils14 = require("@frontmcp/utils");
+var import_utils15 = require("@frontmcp/utils");
 var AuthInternalError = class extends Error {
   /**
    * Unique error ID for tracking in logs.
@@ -3782,7 +3757,7 @@ var AuthInternalError = class extends Error {
     super(message);
     this.name = this.constructor.name;
     this.code = code;
-    this.errorId = `err_${(0, import_utils14.bytesToHex)((0, import_utils14.randomBytes)(8))}`;
+    this.errorId = `err_${(0, import_utils15.bytesToHex)((0, import_utils15.randomBytes)(8))}`;
     Error.captureStackTrace(this, this.constructor);
   }
   /**
@@ -3842,6 +3817,22 @@ var SessionSecretRequiredError = class extends AuthInternalError {
     super(`Session secret is required for ${component}`, "SESSION_SECRET_REQUIRED");
   }
 };
+var JwtSecretRequiredError = class extends AuthInternalError {
+  constructor(mode) {
+    super(
+      `JWT_SECRET is required in production for auth.mode "${mode}". Without it the server signs tokens with a random per-process secret, so every restart invalidates outstanding tokens and any second instance or isolate rejects tokens the first one minted.`,
+      "JWT_SECRET_REQUIRED"
+    );
+  }
+};
+var JwtSecretWeakError = class extends AuthInternalError {
+  constructor(byteLength) {
+    super(
+      `JWT_SECRET is ${byteLength} bytes; HS256 requires at least 32 (RFC 7518 \xA73.2). A shorter secret is guessable, and whoever guesses it can forge tokens for this server. Generate one with \`openssl rand -hex 32\`.`,
+      "JWT_SECRET_INVALID"
+    );
+  }
+};
 var CredentialProviderAlreadyRegisteredError = class extends AuthInternalError {
   constructor(name) {
     super(`Credential provider "${name}" is already registered`, "CREDENTIAL_PROVIDER_ALREADY_REGISTERED");
@@ -3905,9 +3896,9 @@ var AuthFlowError = class extends AuthInternalError {
 
 // libs/auth/src/session/session-crypto.ts
 function getSigningSecret(config) {
-  const secret = config?.secret || (0, import_utils15.getEnv)("MCP_SESSION_SECRET");
+  const secret = config?.secret || (0, import_utils16.getEnv)("MCP_SESSION_SECRET");
   if (!secret) {
-    if ((0, import_utils15.isProduction)()) {
+    if ((0, import_utils16.isProduction)()) {
       throw new SessionSecretRequiredError("session signing");
     }
     console.warn("[SessionCrypto] MCP_SESSION_SECRET not set. Using insecure default for development only.");
@@ -3919,13 +3910,13 @@ function resolveConfig(config) {
   return { secret: getSigningSecret(config) };
 }
 function signSession(session, config) {
-  return (0, import_utils15.signData)(session, resolveConfig(config));
+  return (0, import_utils16.signData)(session, resolveConfig(config));
 }
 function verifySession(signedData, config) {
-  return (0, import_utils15.verifyData)(signedData, resolveConfig(config));
+  return (0, import_utils16.verifyData)(signedData, resolveConfig(config));
 }
 function verifyOrParseSession(data, config) {
-  return (0, import_utils15.verifyOrParseData)(data, resolveConfig(config));
+  return (0, import_utils16.verifyOrParseData)(data, resolveConfig(config));
 }
 
 // libs/auth/src/session/session-rate-limiter.ts
@@ -4052,7 +4043,7 @@ var SessionRateLimiter = class {
 var defaultSessionRateLimiter = new SessionRateLimiter();
 
 // libs/auth/src/session/session.transport.ts
-var import_utils16 = require("@frontmcp/utils");
+var import_utils17 = require("@frontmcp/utils");
 var TransportIdGenerator = class {
   /**
    * Create a transport session ID.
@@ -4061,7 +4052,7 @@ var TransportIdGenerator = class {
    * @returns A transport session ID (UUID without dashes)
    */
   static createId() {
-    return (0, import_utils16.randomUUID)().replace(/-/g, "");
+    return (0, import_utils17.randomUUID)().replace(/-/g, "");
   }
 };
 
@@ -4110,7 +4101,7 @@ var TinyTtlCache = class {
 };
 
 // libs/auth/src/session/utils/auth-token.utils.ts
-var import_utils17 = require("@frontmcp/utils");
+var import_utils18 = require("@frontmcp/utils");
 function isJwt(token) {
   if (!token) return false;
   return token.split(".").length === 3;
@@ -4120,7 +4111,7 @@ function getTokenSignatureFingerprint(token) {
     const sig = token.split(".")[2];
     if (sig) return sig;
   }
-  return (0, import_utils17.sha256Base64url)(token);
+  return (0, import_utils18.sha256Base64url)(token);
 }
 function extractClaimValue(claims, key, validator) {
   const value = claims[key];
@@ -4152,26 +4143,26 @@ function extractBearerToken(header) {
 }
 
 // libs/auth/src/session/utils/session-crypto.utils.ts
-var import_utils18 = require("@frontmcp/utils");
+var import_utils19 = require("@frontmcp/utils");
 var cachedKey = null;
 function getKey() {
   if (cachedKey) return cachedKey;
-  const secret = (0, import_utils18.getEnv)("MCP_SESSION_SECRET");
+  const secret = (0, import_utils19.getEnv)("MCP_SESSION_SECRET");
   if (!secret) {
-    if ((0, import_utils18.isProduction)()) {
+    if ((0, import_utils19.isProduction)()) {
       throw new SessionSecretRequiredError("session ID encryption");
     }
     console.warn(
       "[SessionIdUtils] Using machine ID as session encryption secret - NOT SECURE FOR PRODUCTION. Set MCP_SESSION_SECRET environment variable for secure session encryption."
     );
   }
-  const base = secret || (0, import_utils18.getMachineId)();
-  cachedKey = (0, import_utils18.sha256)(new TextEncoder().encode(base));
+  const base = secret || (0, import_utils19.getMachineId)();
+  cachedKey = (0, import_utils19.sha256)(new TextEncoder().encode(base));
   return cachedKey;
 }
 function encryptJson(obj) {
   const key = getKey();
-  const encrypted = (0, import_utils18.encryptValue)(obj, key);
+  const encrypted = (0, import_utils19.encryptValue)(obj, key);
   return `${encrypted.iv}.${encrypted.tag}.${encrypted.data}`;
 }
 function decryptSessionJson(sessionId) {
@@ -4180,7 +4171,7 @@ function decryptSessionJson(sessionId) {
   const [ivB64, tagB64, ctB64] = parts;
   if (!ivB64 || !tagB64 || !ctB64) return null;
   const key = getKey();
-  return (0, import_utils18.decryptValue)({ alg: "A256GCM", iv: ivB64, tag: tagB64, data: ctB64 }, key);
+  return (0, import_utils19.decryptValue)({ alg: "A256GCM", iv: ivB64, tag: tagB64, data: ctB64 }, key);
 }
 function safeDecrypt(sessionId) {
   try {
@@ -4194,11 +4185,11 @@ function resetCachedKey() {
 }
 
 // libs/auth/src/session/storage/index.ts
-var import_utils22 = require("@frontmcp/utils");
 var import_utils23 = require("@frontmcp/utils");
+var import_utils24 = require("@frontmcp/utils");
 
 // libs/auth/src/session/storage/storage-token-store.ts
-var import_utils19 = require("@frontmcp/utils");
+var import_utils20 = require("@frontmcp/utils");
 var StorageTokenStore = class {
   storage;
   namespace;
@@ -4210,13 +4201,13 @@ var StorageTokenStore = class {
     this.defaultTtlSeconds = options.defaultTtlSeconds;
     this.storageIsNamespaced = "namespace" in storage && typeof storage.namespace === "function";
     const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
-    this.storage = new import_utils19.TypedStorage(namespacedStorage);
+    this.storage = new import_utils20.TypedStorage(namespacedStorage);
   }
   /**
    * Allocate a new unique ID for a token record.
    */
   allocId() {
-    return (0, import_utils19.randomUUID)();
+    return (0, import_utils20.randomUUID)();
   }
   /**
    * Store an encrypted token blob.
@@ -4279,7 +4270,7 @@ var StorageTokenStore = class {
 };
 
 // libs/auth/src/session/storage/storage-authorization-vault.ts
-var import_utils20 = require("@frontmcp/utils");
+var import_utils21 = require("@frontmcp/utils");
 var StorageAuthorizationVault = class {
   storage;
   namespace;
@@ -4288,7 +4279,7 @@ var StorageAuthorizationVault = class {
     this.namespace = options.namespace ?? "vault";
     this.pendingAuthTtlMs = options.pendingAuthTtlMs ?? 10 * 60 * 1e3;
     const namespacedStorage = this.isNamespacedStorage(storage) ? storage.namespace(this.namespace) : storage;
-    this.storage = new import_utils20.TypedStorage(namespacedStorage, {
+    this.storage = new import_utils21.TypedStorage(namespacedStorage, {
       schema: options.validateOnRead ? authorizationVaultEntrySchema : void 0,
       throwOnInvalid: false
     });
@@ -4299,7 +4290,7 @@ var StorageAuthorizationVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: (0, import_utils20.randomUUID)(),
+      id: (0, import_utils21.randomUUID)(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -4373,7 +4364,7 @@ var StorageAuthorizationVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: (0, import_utils20.randomUUID)(),
+      id: (0, import_utils21.randomUUID)(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -4577,11 +4568,11 @@ var StorageAuthorizationVault = class {
 };
 
 // libs/auth/src/session/storage/in-memory-authorization-vault.ts
-var import_utils21 = require("@frontmcp/utils");
+var import_utils22 = require("@frontmcp/utils");
 var InMemoryAuthorizationVault = class extends StorageAuthorizationVault {
   memoryAdapter;
   constructor(options = {}) {
-    const memoryAdapter = new import_utils21.MemoryStorageAdapter();
+    const memoryAdapter = new import_utils22.MemoryStorageAdapter();
     super(memoryAdapter, {
       namespace: options.namespace ?? "vault",
       pendingAuthTtlMs: options.pendingAuthTtlMs
@@ -4602,7 +4593,7 @@ var InMemoryAuthorizationVault = class extends StorageAuthorizationVault {
 };
 
 // libs/auth/src/session/redis-session.store.ts
-var import_utils24 = require("@frontmcp/utils");
+var import_utils25 = require("@frontmcp/utils");
 var RedisSessionStore = class {
   storage;
   keyPrefix;
@@ -4624,14 +4615,14 @@ var RedisSessionStore = class {
       });
     }
     if ("redis" in config && config.redis) {
-      this.storage = new import_utils24.RedisStorageAdapter({
+      this.storage = new import_utils25.RedisStorageAdapter({
         client: config.redis,
         keyPrefix: this.keyPrefix
       });
       this.externalInstance = true;
     } else {
       const redisConfig = config;
-      this.storage = new import_utils24.RedisStorageAdapter({
+      this.storage = new import_utils25.RedisStorageAdapter({
         config: {
           host: redisConfig.host,
           port: redisConfig.port ?? 6379,
@@ -4813,7 +4804,7 @@ var RedisSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return (0, import_utils24.randomUUID)();
+    return (0, import_utils25.randomUUID)();
   }
   /**
    * Disconnect from Redis (only if we created the connection)
@@ -4849,7 +4840,7 @@ var RedisSessionStore = class {
 };
 
 // libs/auth/src/session/vercel-kv-session.store.ts
-var import_utils25 = require("@frontmcp/utils");
+var import_utils26 = require("@frontmcp/utils");
 var VercelKvSessionStore = class {
   storage;
   keyPrefix;
@@ -4869,7 +4860,7 @@ var VercelKvSessionStore = class {
         maxRequests: this.security.rateLimiting?.maxRequests
       });
     }
-    this.storage = new import_utils25.VercelKvStorageAdapter({
+    this.storage = new import_utils26.VercelKvStorageAdapter({
       url: config.url,
       token: config.token,
       keyPrefix: this.keyPrefix
@@ -5043,7 +5034,7 @@ var VercelKvSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return (0, import_utils25.randomUUID)();
+    return (0, import_utils26.randomUUID)();
   }
   /**
    * Disconnect from Vercel KV
@@ -5072,7 +5063,7 @@ var VercelKvSessionStore = class {
 };
 
 // libs/auth/src/session/orchestrated-token.store.ts
-var import_utils26 = require("@frontmcp/utils");
+var import_utils27 = require("@frontmcp/utils");
 var InMemoryOrchestratedTokenStore = class {
   /** Token storage: Map<compositeKey, ProviderTokenRecord> */
   tokens = /* @__PURE__ */ new Map();
@@ -5114,7 +5105,7 @@ var InMemoryOrchestratedTokenStore = class {
     }
     const info = new TextEncoder().encode(`orchestrated-token:${compositeKey}`);
     const salt = new TextEncoder().encode("frontmcp-token-store");
-    const derivedKey = (0, import_utils26.hkdfSha256)(this.encryptionKey, salt, info, 32);
+    const derivedKey = (0, import_utils27.hkdfSha256)(this.encryptionKey, salt, info, 32);
     this.derivedKeys.set(compositeKey, derivedKey);
     return derivedKey;
   }
@@ -5124,8 +5115,8 @@ var InMemoryOrchestratedTokenStore = class {
   async encryptRecord(compositeKey, record) {
     const key = await this.deriveKeyForRecord(compositeKey);
     const plaintext = JSON.stringify(record);
-    const iv = (0, import_utils26.randomBytes)(12);
-    const { ciphertext, tag } = (0, import_utils26.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
+    const iv = (0, import_utils27.randomBytes)(12);
+    const { ciphertext, tag } = (0, import_utils27.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
     return JSON.stringify({
       iv: Buffer.from(iv).toString("base64url"),
       tag: Buffer.from(tag).toString("base64url"),
@@ -5141,7 +5132,7 @@ var InMemoryOrchestratedTokenStore = class {
     const ivBytes = Buffer.from(iv, "base64url");
     const tagBytes = Buffer.from(tag, "base64url");
     const ciphertextBytes = Buffer.from(data, "base64url");
-    const plaintext = (0, import_utils26.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
+    const plaintext = (0, import_utils27.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
     return JSON.parse(new TextDecoder().decode(plaintext));
   }
   /**
@@ -5343,7 +5334,7 @@ var InMemoryOrchestratedTokenStore = class {
 };
 
 // libs/auth/src/session/orchestrated-token.crypto.ts
-var import_utils27 = require("@frontmcp/utils");
+var import_utils28 = require("@frontmcp/utils");
 var HKDF_SALT = new TextEncoder().encode("frontmcp-token-store");
 function deriveKeyForRecord(masterKey, compositeKey, cache) {
   const cached = cache.get(compositeKey);
@@ -5351,14 +5342,14 @@ function deriveKeyForRecord(masterKey, compositeKey, cache) {
     return cached;
   }
   const info = new TextEncoder().encode(`orchestrated-token:${compositeKey}`);
-  const derived = (0, import_utils27.hkdfSha256)(masterKey, HKDF_SALT, info, 32);
+  const derived = (0, import_utils28.hkdfSha256)(masterKey, HKDF_SALT, info, 32);
   cache.set(compositeKey, derived);
   return derived;
 }
 function encryptRecord(key, record) {
   const plaintext = JSON.stringify(record);
-  const iv = (0, import_utils27.randomBytes)(12);
-  const { ciphertext, tag } = (0, import_utils27.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
+  const iv = (0, import_utils28.randomBytes)(12);
+  const { ciphertext, tag } = (0, import_utils28.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
   return JSON.stringify({
     iv: Buffer.from(iv).toString("base64url"),
     tag: Buffer.from(tag).toString("base64url"),
@@ -5370,7 +5361,7 @@ function decryptRecord(key, encrypted) {
   const ivBytes = Buffer.from(iv, "base64url");
   const tagBytes = Buffer.from(tag, "base64url");
   const ciphertextBytes = Buffer.from(data, "base64url");
-  const plaintext = (0, import_utils27.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
+  const plaintext = (0, import_utils28.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
   return JSON.parse(new TextDecoder().decode(plaintext));
 }
 
@@ -5549,7 +5540,7 @@ var StorageOrchestratedTokenStore = class {
 };
 
 // libs/auth/src/session/federated-auth.session.ts
-var import_utils28 = require("@frontmcp/utils");
+var import_utils29 = require("@frontmcp/utils");
 function toSessionRecord(session) {
   return {
     ...session,
@@ -5624,7 +5615,7 @@ var InMemoryFederatedAuthSessionStore = class {
   createSession(params) {
     const now = Date.now();
     return {
-      id: (0, import_utils28.randomUUID)(),
+      id: (0, import_utils29.randomUUID)(),
       pendingAuthId: params.pendingAuthId,
       clientId: params.clientId,
       redirectUri: params.redirectUri,
@@ -5656,7 +5647,7 @@ var InMemoryFederatedAuthSessionStore = class {
 function createFederatedAuthSession(params, ttlMs = 15 * 60 * 1e3) {
   const now = Date.now();
   return {
-    id: (0, import_utils28.randomUUID)(),
+    id: (0, import_utils29.randomUUID)(),
     pendingAuthId: params.pendingAuthId,
     clientId: params.clientId,
     redirectUri: params.redirectUri,
@@ -5713,7 +5704,7 @@ function startNextProvider(session, pkce, state) {
 }
 
 // libs/auth/src/session/storage-federated-auth.session.ts
-var import_utils29 = require("@frontmcp/utils");
+var import_utils30 = require("@frontmcp/utils");
 var StorageFederatedAuthSessionStore = class {
   storage;
   namespace;
@@ -5722,7 +5713,7 @@ var StorageFederatedAuthSessionStore = class {
     this.namespace = options.namespace ?? "fed";
     this.storageIsNamespaced = this.isNamespacedStorage(storage);
     const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
-    this.storage = new import_utils29.TypedStorage(namespacedStorage);
+    this.storage = new import_utils30.TypedStorage(namespacedStorage);
   }
   async store(session) {
     await this.put(session);
@@ -5793,7 +5784,7 @@ var InMemoryConsentStore = class {
 };
 
 // libs/auth/src/session/storage-consent.store.ts
-var import_utils30 = require("@frontmcp/utils");
+var import_utils31 = require("@frontmcp/utils");
 var StorageConsentStore = class {
   storage;
   namespace;
@@ -5802,7 +5793,7 @@ var StorageConsentStore = class {
     this.namespace = options.namespace ?? "remembered-consent";
     this.storageIsNamespaced = this.isNamespacedStorage(storage);
     const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
-    this.storage = new import_utils30.TypedStorage(namespacedStorage);
+    this.storage = new import_utils31.TypedStorage(namespacedStorage);
   }
   async get(userSub, clientId) {
     return this.storage.get(this.key(userSub, clientId));
@@ -5824,7 +5815,7 @@ var StorageConsentStore = class {
 
 // libs/auth/src/session/encrypted-authorization-vault.ts
 var import_lazy_zod5 = require("@frontmcp/lazy-zod");
-var import_utils31 = require("@frontmcp/utils");
+var import_utils32 = require("@frontmcp/utils");
 var redisVaultEntrySchema = import_lazy_zod5.z.object({
   /** Vault ID */
   id: import_lazy_zod5.z.string(),
@@ -5849,7 +5840,7 @@ var redisVaultEntrySchema = import_lazy_zod5.z.object({
   /** Encrypted sensitive data blob */
   encrypted: encryptedDataSchema
 });
-var encryptionContextStorage = new import_utils31.AsyncLocalStorage();
+var encryptionContextStorage = new import_utils32.AsyncLocalStorage();
 var EncryptedRedisVault = class {
   constructor(redis, encryption, namespace = "vault:") {
     this.redis = redis;
@@ -5985,7 +5976,7 @@ var EncryptedRedisVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: (0, import_utils31.randomUUID)(),
+      id: (0, import_utils32.randomUUID)(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -6044,7 +6035,7 @@ var EncryptedRedisVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: (0, import_utils31.randomUUID)(),
+      id: (0, import_utils32.randomUUID)(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -6222,7 +6213,7 @@ function createEncryptedVault(redis, config = {}) {
 }
 
 // libs/auth/src/session/token.refresh.ts
-var import_utils32 = require("@frontmcp/utils");
+var import_utils33 = require("@frontmcp/utils");
 function toEpochSeconds(exp) {
   if (exp == null) return void 0;
   if (exp instanceof Date) return Math.floor(exp.getTime() / 1e3);
@@ -6244,7 +6235,7 @@ function tryJwtExp(token) {
   const parts = token.split(".");
   if (parts.length < 2) return void 0;
   try {
-    const json = JSON.parse(new TextDecoder().decode((0, import_utils32.base64urlDecode)(parts[1])));
+    const json = JSON.parse(new TextDecoder().decode((0, import_utils33.base64urlDecode)(parts[1])));
     const e = json?.exp;
     return typeof e === "number" ? toEpochSeconds(e) : void 0;
   } catch {
@@ -6307,7 +6298,7 @@ var progressiveAuthStateSchema = import_lazy_zod6.z.object({
 });
 
 // libs/auth/src/authorization/authorization.class.ts
-var import_utils35 = require("@frontmcp/utils");
+var import_utils36 = require("@frontmcp/utils");
 var AuthorizationBase = class _AuthorizationBase {
   id;
   isAnonymous;
@@ -6355,14 +6346,14 @@ var AuthorizationBase = class _AuthorizationBase {
    * @param fingerprint - Optional client fingerprint for tracking
    */
   createTransportSession(protocol, fingerprint) {
-    const sessionId = (0, import_utils35.randomUUID)();
+    const sessionId = (0, import_utils36.randomUUID)();
     const session = {
       id: sessionId,
       authorizationId: this.id,
       protocol,
       createdAt: Date.now(),
       expiresAt: this.expiresAt,
-      nodeId: (0, import_utils35.getMachineId)(),
+      nodeId: (0, import_utils36.getMachineId)(),
       clientFingerprint: fingerprint
     };
     this.#sessions.set(session.id, session);
@@ -6503,7 +6494,7 @@ var AuthorizationBase = class _AuthorizationBase {
    */
   static isJwtHeader(segment) {
     try {
-      const bytes = (0, import_utils35.base64urlDecode)(segment);
+      const bytes = (0, import_utils36.base64urlDecode)(segment);
       const text = new TextDecoder().decode(bytes);
       const parsed = JSON.parse(text);
       return typeof parsed === "object" && parsed !== null && typeof parsed.alg === "string";
@@ -6555,7 +6546,7 @@ var AuthorizationBase = class _AuthorizationBase {
 };
 
 // libs/auth/src/authorization/public.authorization.ts
-var import_utils36 = require("@frontmcp/utils");
+var import_utils37 = require("@frontmcp/utils");
 var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
   mode = "public";
   /**
@@ -6591,7 +6582,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
       allowedTools = "all",
       allowedPrompts = "all"
     } = ctx;
-    const uuid = (0, import_utils36.randomUUID)();
+    const uuid = (0, import_utils37.randomUUID)();
     const sub = `${prefix}:${uuid}`;
     const user = {
       sub,
@@ -6675,7 +6666,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
 };
 
 // libs/auth/src/authorization/transparent.authorization.ts
-var import_utils37 = require("@frontmcp/utils");
+var import_utils38 = require("@frontmcp/utils");
 var TransparentAuthorization = class _TransparentAuthorization extends AuthorizationBase {
   mode = "transparent";
   /**
@@ -6775,7 +6766,7 @@ var TransparentAuthorization = class _TransparentAuthorization extends Authoriza
   static generateAuthorizationId(token) {
     const parts = token.split(".");
     const signature = parts[2] || token;
-    return (0, import_utils37.sha256Hex)(signature).substring(0, 16);
+    return (0, import_utils38.sha256Hex)(signature).substring(0, 16);
   }
   /**
    * Get the issuer from the token claims
@@ -6801,11 +6792,11 @@ var TransparentAuthorization = class _TransparentAuthorization extends Authoriza
 };
 
 // libs/auth/src/utils/authorization-id.utils.ts
-var import_utils38 = require("@frontmcp/utils");
+var import_utils39 = require("@frontmcp/utils");
 function deriveAuthorizationId(token) {
   const parts = token.split(".");
   const signature = parts[2] || token;
-  return (0, import_utils38.sha256Hex)(signature).substring(0, 16);
+  return (0, import_utils39.sha256Hex)(signature).substring(0, 16);
 }
 
 // libs/auth/src/authorization/orchestrated.authorization.ts
@@ -7174,7 +7165,7 @@ var OrchestratedAuthAccessorAdapter = class {
 };
 
 // libs/auth/src/authorization/dcr-client.registry.ts
-var import_utils39 = require("@frontmcp/utils");
+var import_utils40 = require("@frontmcp/utils");
 var DEFAULT_MAX_DYNAMIC_CLIENTS = 1e3;
 function globMatch(pattern, input) {
   let p = 0;
@@ -7300,7 +7291,7 @@ var DcrClientRegistry = class {
     if (!isConfidential) return "ok";
     if (!client.client_secret) return "invalid";
     if (!presentedSecret) return "invalid";
-    return (0, import_utils39.timingSafeEqual)((0, import_utils39.sha256)(presentedSecret), (0, import_utils39.sha256)(client.client_secret)) ? "ok" : "invalid";
+    return (0, import_utils40.timingSafeEqual)((0, import_utils40.sha256)(presentedSecret), (0, import_utils40.sha256)(client.client_secret)) ? "ok" : "invalid";
   }
   /** Whether a client id is known to the registry. */
   has(clientId) {
@@ -7388,7 +7379,7 @@ var DcrClientRegistry = class {
     if (typeof presented !== "string" || presented.length === 0) {
       return false;
     }
-    return (0, import_utils39.timingSafeEqual)((0, import_utils39.sha256)(presented), (0, import_utils39.sha256)(expected));
+    return (0, import_utils40.timingSafeEqual)((0, import_utils40.sha256)(presented), (0, import_utils40.sha256)(expected));
   }
 };
 
@@ -7717,6 +7708,7 @@ var cimdConfigSchema = import_lazy_zod9.z.object({
 init_cimd_cache();
 
 // libs/auth/src/cimd/cimd.service.ts
+var import_utils41 = require("@frontmcp/utils");
 init_cimd_cache();
 var CimdService = class {
   config;
@@ -7891,7 +7883,7 @@ var CimdService = class {
             httpStatus: 304
           });
         }
-        if (response.status >= 300 && response.status < 400) {
+        if ((0, import_utils41.isRedirectResponse)(response)) {
           const location = response.headers.get("location");
           if (!location) {
             throw new CimdFetchError(clientId, "Redirect response missing Location header", {
@@ -8508,10 +8500,48 @@ var publicAuthOptionsSchema = import_lazy_zod11.z.object({
   signKey: jwkSchema.or(import_lazy_zod11.z.instanceof(Uint8Array)).optional()
 });
 
-// libs/auth/src/options/transparent.schema.ts
+// libs/auth/src/options/static.schema.ts
 var import_lazy_zod12 = require("@frontmcp/lazy-zod");
-var transparentAuthOptionsSchema = import_lazy_zod12.z.object({
-  mode: import_lazy_zod12.z.literal("transparent"),
+var staticAuthOptionsSchema = import_lazy_zod12.z.object({
+  mode: import_lazy_zod12.z.literal("static"),
+  /**
+   * Accepted credentials. Compared against the presented one in constant time,
+   * over SHA-256 digests so neither the value nor its length leaks by timing.
+   *
+   * Read these from the environment — never commit them.
+   */
+  tokens: import_lazy_zod12.z.array(import_lazy_zod12.z.string().min(1)).min(1),
+  /**
+   * Request header carrying the credential.
+   * @default 'authorization'
+   */
+  header: import_lazy_zod12.z.string().min(1).default("authorization"),
+  /**
+   * Scheme prefix to strip before comparing, matched case-insensitively. Set to
+   * an empty string for headers that carry a bare token (e.g. `x-api-key`).
+   * @default 'Bearer'
+   */
+  scheme: import_lazy_zod12.z.string().default("Bearer"),
+  /**
+   * Scopes granted to a request that presents a valid token.
+   * @default ['static']
+   */
+  scopes: import_lazy_zod12.z.array(import_lazy_zod12.z.string()).default(["static"]),
+  /**
+   * Realm reported in the `WWW-Authenticate` challenge on failure.
+   * @default 'mcp'
+   */
+  realm: import_lazy_zod12.z.string().default("mcp"),
+  /**
+   * Tool/prompt access configuration, same shape the other modes accept.
+   */
+  publicAccess: publicAccessConfigSchema.optional()
+});
+
+// libs/auth/src/options/transparent.schema.ts
+var import_lazy_zod13 = require("@frontmcp/lazy-zod");
+var transparentAuthOptionsSchema = import_lazy_zod13.z.object({
+  mode: import_lazy_zod13.z.literal("transparent"),
   /**
    * Flattened remote provider fields (provider, clientId, clientSecret, scopes, providerConfig)
    */
@@ -8520,28 +8550,28 @@ var transparentAuthOptionsSchema = import_lazy_zod12.z.object({
    * Expected token audience
    * If not set, defaults to the resource URL
    */
-  expectedAudience: import_lazy_zod12.z.union([import_lazy_zod12.z.string(), import_lazy_zod12.z.array(import_lazy_zod12.z.string())]).optional(),
+  expectedAudience: import_lazy_zod13.z.union([import_lazy_zod13.z.string(), import_lazy_zod13.z.array(import_lazy_zod13.z.string())]).optional(),
   /**
    * Require an `aud` claim (reject audience-less tokens). Defaults to `false`
    * for IdP compatibility; set `true` to reject tokens with no audience.
    */
-  requireAudience: import_lazy_zod12.z.boolean().optional(),
+  requireAudience: import_lazy_zod13.z.boolean().optional(),
   /**
    * Required scopes for access
    * Empty array means any valid token is accepted
    * @default []
    */
-  requiredScopes: import_lazy_zod12.z.array(import_lazy_zod12.z.string()).default([]),
+  requiredScopes: import_lazy_zod13.z.array(import_lazy_zod13.z.string()).default([]),
   /**
    * Allow anonymous fallback when no token is provided
    * @default false
    */
-  allowAnonymous: import_lazy_zod12.z.boolean().default(false),
+  allowAnonymous: import_lazy_zod13.z.boolean().default(false),
   /**
    * Scopes granted to anonymous sessions (when allowAnonymous=true)
    * @default ['anonymous']
    */
-  anonymousScopes: import_lazy_zod12.z.array(import_lazy_zod12.z.string()).default(["anonymous"]),
+  anonymousScopes: import_lazy_zod13.z.array(import_lazy_zod13.z.string()).default(["anonymous"]),
   /**
    * Public access config for anonymous users (when allowAnonymous=true)
    */
@@ -8549,13 +8579,13 @@ var transparentAuthOptionsSchema = import_lazy_zod12.z.object({
 });
 
 // libs/auth/src/options/orchestrated.schema.ts
-var import_lazy_zod13 = require("@frontmcp/lazy-zod");
-var authSlotSchema = import_lazy_zod13.z.enum(["login", "consent", "incremental", "federated", "error"]);
-var authUiMapSchema = import_lazy_zod13.z.partialRecord(authSlotSchema, import_lazy_zod13.z.string().min(1));
-var authExtraHandlerSchema = import_lazy_zod13.z.custom((v) => typeof v === "function", {
+var import_lazy_zod14 = require("@frontmcp/lazy-zod");
+var authSlotSchema = import_lazy_zod14.z.enum(["login", "consent", "incremental", "federated", "error"]);
+var authUiMapSchema = import_lazy_zod14.z.partialRecord(authSlotSchema, import_lazy_zod14.z.string().min(1));
+var authExtraHandlerSchema = import_lazy_zod14.z.custom((v) => typeof v === "function", {
   message: "auth.extras entries must be handler functions (input, ctx) => AuthExtraResult."
 });
-var authExtrasMapSchema = import_lazy_zod13.z.record(import_lazy_zod13.z.string().min(1), authExtraHandlerSchema);
+var authExtrasMapSchema = import_lazy_zod14.z.record(import_lazy_zod14.z.string().min(1), authExtraHandlerSchema);
 var sharedAuthFields = {
   local: localSigningConfigSchema.optional(),
   tokenStorage: tokenStorageConfigSchema.default("memory"),
@@ -8563,13 +8593,13 @@ var sharedAuthFields = {
   // Optional (no default) so an unset value resolves to the in-memory encrypted
   // default at runtime; existing configs are unaffected.
   secureStore: secureStoreConfigSchema.optional(),
-  allowDefaultPublic: import_lazy_zod13.z.boolean().default(false),
-  anonymousScopes: import_lazy_zod13.z.array(import_lazy_zod13.z.string()).default(["anonymous"]),
+  allowDefaultPublic: import_lazy_zod14.z.boolean().default(false),
+  anonymousScopes: import_lazy_zod14.z.array(import_lazy_zod14.z.string()).default(["anonymous"]),
   publicAccess: publicAccessConfigSchema.optional(),
   consent: consentConfigSchema.optional(),
   federatedAuth: federatedAuthConfigSchema.optional(),
   refresh: tokenRefreshConfigSchema.optional(),
-  expectedAudience: import_lazy_zod13.z.union([import_lazy_zod13.z.string(), import_lazy_zod13.z.array(import_lazy_zod13.z.string())]).optional(),
+  expectedAudience: import_lazy_zod14.z.union([import_lazy_zod14.z.string(), import_lazy_zod14.z.array(import_lazy_zod14.z.string())]).optional(),
   incrementalAuth: incrementalAuthConfigSchema.optional(),
   /**
    * Require the OAuth client to be KNOWN (registered via DCR / pre-registered,
@@ -8585,46 +8615,46 @@ var sharedAuthFields = {
    * matching for every client. Clients on a configured
    * `dcr.allowedRedirectUris` allowlist still pass.
    */
-  requireRegisteredClients: import_lazy_zod13.z.boolean().default(false),
+  requireRegisteredClients: import_lazy_zod14.z.boolean().default(false),
   cimd: cimdConfigSchema.optional(),
   // #469 — custom auth UI as a slot→file map + extras name→handler map (per-app
   // under splitByApp). Both optional; omitting them serves the built-in pages.
   ui: authUiMapSchema.optional(),
   extras: authExtrasMapSchema.optional()
 };
-var loginFieldSchema = import_lazy_zod13.z.object({
-  type: import_lazy_zod13.z.enum(["text", "password", "email", "select", "hidden"]),
-  label: import_lazy_zod13.z.string().optional(),
-  required: import_lazy_zod13.z.boolean().optional(),
-  placeholder: import_lazy_zod13.z.string().optional(),
-  options: import_lazy_zod13.z.array(import_lazy_zod13.z.object({ value: import_lazy_zod13.z.string(), label: import_lazy_zod13.z.string() })).optional()
+var loginFieldSchema = import_lazy_zod14.z.object({
+  type: import_lazy_zod14.z.enum(["text", "password", "email", "select", "hidden"]),
+  label: import_lazy_zod14.z.string().optional(),
+  required: import_lazy_zod14.z.boolean().optional(),
+  placeholder: import_lazy_zod14.z.string().optional(),
+  options: import_lazy_zod14.z.array(import_lazy_zod14.z.object({ value: import_lazy_zod14.z.string(), label: import_lazy_zod14.z.string() })).optional()
 });
-var loginConfigSchema = import_lazy_zod13.z.object({
-  title: import_lazy_zod13.z.string().optional(),
-  subtitle: import_lazy_zod13.z.string().optional(),
-  logoUri: import_lazy_zod13.z.string().optional(),
-  fields: import_lazy_zod13.z.record(import_lazy_zod13.z.string(), loginFieldSchema).optional(),
+var loginConfigSchema = import_lazy_zod14.z.object({
+  title: import_lazy_zod14.z.string().optional(),
+  subtitle: import_lazy_zod14.z.string().optional(),
+  logoUri: import_lazy_zod14.z.string().optional(),
+  fields: import_lazy_zod14.z.record(import_lazy_zod14.z.string(), loginFieldSchema).optional(),
   // Full HTML override — a function, validated structurally like other callbacks
   // in the codebase (see http/cors handlers using z.custom<…>).
-  render: import_lazy_zod13.z.custom((v) => typeof v === "function", {
+  render: import_lazy_zod14.z.custom((v) => typeof v === "function", {
     message: "login.render must be a function"
   }).optional(),
-  subject: import_lazy_zod13.z.object({
-    fromField: import_lazy_zod13.z.string().optional(),
-    strategy: import_lazy_zod13.z.enum(["per-session", "per-account"]).optional()
+  subject: import_lazy_zod14.z.object({
+    fromField: import_lazy_zod14.z.string().optional(),
+    strategy: import_lazy_zod14.z.enum(["per-session", "per-account"]).optional()
   }).optional()
 });
-var authenticateFnSchema = import_lazy_zod13.z.custom((v) => typeof v === "function", {
+var authenticateFnSchema = import_lazy_zod14.z.custom((v) => typeof v === "function", {
   message: "authenticate must be a function"
 });
-var localAuthSchema = import_lazy_zod13.z.object({
-  mode: import_lazy_zod13.z.literal("local"),
+var localAuthSchema = import_lazy_zod14.z.object({
+  mode: import_lazy_zod14.z.literal("local"),
   ...sharedAuthFields,
   // #468 — opt-out of the email requirement at /oauth/callback for
   // single-operator local setups. Defaults preserve the historical behavior
   // (email required) so existing configs are unaffected.
-  requireEmail: import_lazy_zod13.z.boolean().default(true),
-  anonymousSubject: import_lazy_zod13.z.string().min(1).default("local-operator"),
+  requireEmail: import_lazy_zod14.z.boolean().default(true),
+  anonymousSubject: import_lazy_zod14.z.string().min(1).default("local-operator"),
   // Checkpoint 3a — declarative login customization + custom verification.
   // Both optional; omitting them preserves the default login path exactly.
   login: loginConfigSchema.optional(),
@@ -8632,7 +8662,7 @@ var localAuthSchema = import_lazy_zod13.z.object({
   // Multi-OAuth-provider orchestration — declare upstream providers (GitHub,
   // Slack, Jira, …) to federate at /oauth/authorize. Optional; omitting it
   // preserves the default single-operator local login exactly.
-  providers: import_lazy_zod13.z.array(upstreamProviderSchema).optional(),
+  providers: import_lazy_zod14.z.array(upstreamProviderSchema).optional(),
   // Local-AS Dynamic Client Registration control surface (#462) — gate
   // `POST /oauth/register`, allowlist redirect_uris/client_ids, require an
   // initial access token, and seed pre-registered trusted clients. Optional;
@@ -8640,8 +8670,8 @@ var localAuthSchema = import_lazy_zod13.z.object({
   // no allowlist; no initial access token).
   dcr: localDcrConfigSchema.optional()
 });
-var remoteAuthSchema = import_lazy_zod13.z.object({
-  mode: import_lazy_zod13.z.literal("remote"),
+var remoteAuthSchema = import_lazy_zod14.z.object({
+  mode: import_lazy_zod14.z.literal("remote"),
   ...flatRemoteProviderFields,
   ...sharedAuthFields
 });
@@ -8649,21 +8679,22 @@ var orchestratedLocalSchema = localAuthSchema;
 var orchestratedRemoteSchema = remoteAuthSchema;
 
 // libs/auth/src/options/schema.ts
-var import_lazy_zod14 = require("@frontmcp/lazy-zod");
-var authOptionsSchema = import_lazy_zod14.z.union([
+var import_lazy_zod15 = require("@frontmcp/lazy-zod");
+var authOptionsSchema = import_lazy_zod15.z.union([
   publicAuthOptionsSchema,
+  staticAuthOptionsSchema,
   transparentAuthOptionsSchema,
   localAuthSchema,
   remoteAuthSchema
 ]);
 
 // libs/auth/src/options/app-auth.schema.ts
-var import_lazy_zod15 = require("@frontmcp/lazy-zod");
+var import_lazy_zod16 = require("@frontmcp/lazy-zod");
 var standaloneOptionSchema = {
-  standalone: import_lazy_zod15.z.boolean().optional(),
-  excludeFromParent: import_lazy_zod15.z.boolean().optional()
+  standalone: import_lazy_zod16.z.boolean().optional(),
+  excludeFromParent: import_lazy_zod16.z.boolean().optional()
 };
-var appAuthOptionsSchema = import_lazy_zod15.z.union([
+var appAuthOptionsSchema = import_lazy_zod16.z.union([
   publicAuthOptionsSchema.extend(standaloneOptionSchema),
   transparentAuthOptionsSchema.extend(standaloneOptionSchema),
   localAuthSchema.extend(standaloneOptionSchema),
@@ -8677,6 +8708,9 @@ function parseAuthOptions(input) {
 function isPublicMode(options) {
   return options.mode === "public";
 }
+function isStaticMode(options) {
+  return options.mode === "static";
+}
 function isTransparentMode(options) {
   return options.mode === "transparent";
 }
@@ -8703,108 +8737,108 @@ function allowsPublicAccess(options) {
 }
 
 // libs/auth/src/consent/consent.types.ts
-var import_lazy_zod16 = require("@frontmcp/lazy-zod");
-var consentToolItemSchema = import_lazy_zod16.z.object({
+var import_lazy_zod17 = require("@frontmcp/lazy-zod");
+var consentToolItemSchema = import_lazy_zod17.z.object({
   /** Tool ID (e.g., 'slack:send_message') */
-  id: import_lazy_zod16.z.string().min(1),
+  id: import_lazy_zod17.z.string().min(1),
   /** Tool name for display */
-  name: import_lazy_zod16.z.string().min(1),
+  name: import_lazy_zod17.z.string().min(1),
   /** Tool description */
-  description: import_lazy_zod16.z.string().optional(),
+  description: import_lazy_zod17.z.string().optional(),
   /** App ID this tool belongs to */
-  appId: import_lazy_zod16.z.string().min(1),
+  appId: import_lazy_zod17.z.string().min(1),
   /** App name for display */
-  appName: import_lazy_zod16.z.string().min(1),
+  appName: import_lazy_zod17.z.string().min(1),
   /** Whether the tool is selected by default */
-  defaultSelected: import_lazy_zod16.z.boolean().default(true),
+  defaultSelected: import_lazy_zod17.z.boolean().default(true),
   /** Whether this tool requires specific scopes */
-  requiredScopes: import_lazy_zod16.z.array(import_lazy_zod16.z.string()).optional(),
+  requiredScopes: import_lazy_zod17.z.array(import_lazy_zod17.z.string()).optional(),
   /** Category for grouping (e.g., 'read', 'write', 'admin') */
-  category: import_lazy_zod16.z.string().optional()
+  category: import_lazy_zod17.z.string().optional()
 });
-var consentSelectionSchema = import_lazy_zod16.z.object({
+var consentSelectionSchema = import_lazy_zod17.z.object({
   /** Selected tool IDs */
-  selectedTools: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
+  selectedTools: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
   /** Whether all tools were selected */
-  allSelected: import_lazy_zod16.z.boolean(),
+  allSelected: import_lazy_zod17.z.boolean(),
   /** Timestamp when consent was given */
-  consentedAt: import_lazy_zod16.z.string().datetime(),
+  consentedAt: import_lazy_zod17.z.string().datetime(),
   /** Consent version for tracking changes */
-  consentVersion: import_lazy_zod16.z.string().default("1.0")
+  consentVersion: import_lazy_zod17.z.string().default("1.0")
 });
-var consentStateSchema = import_lazy_zod16.z.object({
+var consentStateSchema = import_lazy_zod17.z.object({
   /** Whether consent flow is enabled */
-  enabled: import_lazy_zod16.z.boolean(),
+  enabled: import_lazy_zod17.z.boolean(),
   /** Available tools for consent */
-  availableTools: import_lazy_zod16.z.array(consentToolItemSchema),
+  availableTools: import_lazy_zod17.z.array(consentToolItemSchema),
   /** Pre-selected tools (from previous consent or defaults) */
-  preselectedTools: import_lazy_zod16.z.array(import_lazy_zod16.z.string()).optional(),
+  preselectedTools: import_lazy_zod17.z.array(import_lazy_zod17.z.string()).optional(),
   /** Whether to show all tools or group by app */
-  groupByApp: import_lazy_zod16.z.boolean().default(true),
+  groupByApp: import_lazy_zod17.z.boolean().default(true),
   /** Custom consent message */
-  customMessage: import_lazy_zod16.z.string().optional()
+  customMessage: import_lazy_zod17.z.string().optional()
 });
-var federatedProviderItemSchema = import_lazy_zod16.z.object({
+var federatedProviderItemSchema = import_lazy_zod17.z.object({
   /** Provider ID (derived or explicit) */
-  id: import_lazy_zod16.z.string().min(1),
+  id: import_lazy_zod17.z.string().min(1),
   /** Provider display name */
-  name: import_lazy_zod16.z.string().min(1),
+  name: import_lazy_zod17.z.string().min(1),
   /** Provider description */
-  description: import_lazy_zod16.z.string().optional(),
+  description: import_lazy_zod17.z.string().optional(),
   /** Provider icon URL or emoji */
-  icon: import_lazy_zod16.z.string().optional(),
+  icon: import_lazy_zod17.z.string().optional(),
   /** Provider type */
-  type: import_lazy_zod16.z.enum(["local", "remote", "transparent"]),
+  type: import_lazy_zod17.z.enum(["local", "remote", "transparent"]),
   /** OAuth provider URL (for remote providers) */
-  providerUrl: import_lazy_zod16.z.string().url().optional(),
+  providerUrl: import_lazy_zod17.z.string().url().optional(),
   /** Apps using this provider */
-  appIds: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
+  appIds: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
   /** App names using this provider */
-  appNames: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
+  appNames: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
   /** Scopes required by this provider */
-  scopes: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
+  scopes: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
   /** Whether this is the primary/parent provider */
-  isPrimary: import_lazy_zod16.z.boolean(),
+  isPrimary: import_lazy_zod17.z.boolean(),
   /** Whether this provider is optional (can be skipped) */
-  isOptional: import_lazy_zod16.z.boolean().default(false)
+  isOptional: import_lazy_zod17.z.boolean().default(false)
 });
-var federatedLoginStateSchema = import_lazy_zod16.z.object({
+var federatedLoginStateSchema = import_lazy_zod17.z.object({
   /** All available providers */
-  providers: import_lazy_zod16.z.array(federatedProviderItemSchema),
+  providers: import_lazy_zod17.z.array(federatedProviderItemSchema),
   /** Primary provider ID (if any) */
-  primaryProviderId: import_lazy_zod16.z.string().optional(),
+  primaryProviderId: import_lazy_zod17.z.string().optional(),
   /** Whether user can skip optional providers */
-  allowSkip: import_lazy_zod16.z.boolean().default(true),
+  allowSkip: import_lazy_zod17.z.boolean().default(true),
   /** Pre-selected provider IDs (from previous session) */
-  preselectedProviders: import_lazy_zod16.z.array(import_lazy_zod16.z.string()).optional()
+  preselectedProviders: import_lazy_zod17.z.array(import_lazy_zod17.z.string()).optional()
 });
-var federatedSelectionSchema = import_lazy_zod16.z.object({
+var federatedSelectionSchema = import_lazy_zod17.z.object({
   /** Selected provider IDs */
-  selectedProviders: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
+  selectedProviders: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
   /** Skipped provider IDs */
-  skippedProviders: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
+  skippedProviders: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
   /** Provider-specific metadata */
-  providerMetadata: import_lazy_zod16.z.record(import_lazy_zod16.z.string(), import_lazy_zod16.z.unknown()).optional()
+  providerMetadata: import_lazy_zod17.z.record(import_lazy_zod17.z.string(), import_lazy_zod17.z.unknown()).optional()
 });
 
 // libs/auth/src/detection/auth-provider-detection.ts
-var import_lazy_zod17 = require("@frontmcp/lazy-zod");
-var detectedAuthProviderSchema = import_lazy_zod17.z.object({
-  id: import_lazy_zod17.z.string(),
-  providerUrl: import_lazy_zod17.z.string().optional(),
-  mode: import_lazy_zod17.z.enum(["public", "transparent", "local", "remote"]),
-  appIds: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
-  scopes: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
-  isParentProvider: import_lazy_zod17.z.boolean()
+var import_lazy_zod18 = require("@frontmcp/lazy-zod");
+var detectedAuthProviderSchema = import_lazy_zod18.z.object({
+  id: import_lazy_zod18.z.string(),
+  providerUrl: import_lazy_zod18.z.string().optional(),
+  mode: import_lazy_zod18.z.enum(["public", "static", "transparent", "local", "remote"]),
+  appIds: import_lazy_zod18.z.array(import_lazy_zod18.z.string()),
+  scopes: import_lazy_zod18.z.array(import_lazy_zod18.z.string()),
+  isParentProvider: import_lazy_zod18.z.boolean()
 });
-var authProviderDetectionResultSchema = import_lazy_zod17.z.object({
-  providers: import_lazy_zod17.z.map(import_lazy_zod17.z.string(), detectedAuthProviderSchema),
-  requiresOrchestration: import_lazy_zod17.z.boolean(),
-  parentProviderId: import_lazy_zod17.z.string().optional(),
-  childProviderIds: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
-  uniqueProviderCount: import_lazy_zod17.z.number(),
-  validationErrors: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
-  warnings: import_lazy_zod17.z.array(import_lazy_zod17.z.string())
+var authProviderDetectionResultSchema = import_lazy_zod18.z.object({
+  providers: import_lazy_zod18.z.map(import_lazy_zod18.z.string(), detectedAuthProviderSchema),
+  requiresOrchestration: import_lazy_zod18.z.boolean(),
+  parentProviderId: import_lazy_zod18.z.string().optional(),
+  childProviderIds: import_lazy_zod18.z.array(import_lazy_zod18.z.string()),
+  uniqueProviderCount: import_lazy_zod18.z.number(),
+  validationErrors: import_lazy_zod18.z.array(import_lazy_zod18.z.string()),
+  warnings: import_lazy_zod18.z.array(import_lazy_zod18.z.string())
 });
 function deriveProviderId(options) {
   if (isPublicMode(options)) {
@@ -9193,43 +9227,43 @@ var AudienceValidator = class _AudienceValidator {
 };
 
 // libs/auth/src/vault/auth-providers.types.ts
-var import_lazy_zod18 = require("@frontmcp/lazy-zod");
-var credentialScopeSchema = import_lazy_zod18.z.enum(["global", "user", "session"]);
-var loadingStrategySchema = import_lazy_zod18.z.enum(["eager", "lazy"]);
-var getCredentialOptionsSchema = import_lazy_zod18.z.object({
-  forceRefresh: import_lazy_zod18.z.boolean().optional(),
-  scopes: import_lazy_zod18.z.array(import_lazy_zod18.z.string()).optional(),
-  timeout: import_lazy_zod18.z.number().positive().optional()
+var import_lazy_zod19 = require("@frontmcp/lazy-zod");
+var credentialScopeSchema = import_lazy_zod19.z.enum(["global", "user", "session"]);
+var loadingStrategySchema = import_lazy_zod19.z.enum(["eager", "lazy"]);
+var getCredentialOptionsSchema = import_lazy_zod19.z.object({
+  forceRefresh: import_lazy_zod19.z.boolean().optional(),
+  scopes: import_lazy_zod19.z.array(import_lazy_zod19.z.string()).optional(),
+  timeout: import_lazy_zod19.z.number().positive().optional()
 }).strict();
-var credentialProviderConfigSchema = import_lazy_zod18.z.object({
-  name: import_lazy_zod18.z.string().min(1),
-  description: import_lazy_zod18.z.string().optional(),
+var credentialProviderConfigSchema = import_lazy_zod19.z.object({
+  name: import_lazy_zod19.z.string().min(1),
+  description: import_lazy_zod19.z.string().optional(),
   scope: credentialScopeSchema,
   loading: loadingStrategySchema,
-  cacheTtl: import_lazy_zod18.z.number().nonnegative().optional(),
+  cacheTtl: import_lazy_zod19.z.number().nonnegative().optional(),
   // Functions validated at runtime, not via Zod (Zod 4 compatibility)
-  factory: import_lazy_zod18.z.any(),
-  refresh: import_lazy_zod18.z.any().optional(),
-  toHeaders: import_lazy_zod18.z.any().optional(),
-  metadata: import_lazy_zod18.z.record(import_lazy_zod18.z.string(), import_lazy_zod18.z.unknown()).optional(),
-  required: import_lazy_zod18.z.boolean().optional()
+  factory: import_lazy_zod19.z.any(),
+  refresh: import_lazy_zod19.z.any().optional(),
+  toHeaders: import_lazy_zod19.z.any().optional(),
+  metadata: import_lazy_zod19.z.record(import_lazy_zod19.z.string(), import_lazy_zod19.z.unknown()).optional(),
+  required: import_lazy_zod19.z.boolean().optional()
 }).strict();
-var authProviderMappingSchema = import_lazy_zod18.z.union([
-  import_lazy_zod18.z.string(),
-  import_lazy_zod18.z.object({
-    name: import_lazy_zod18.z.string().min(1),
-    required: import_lazy_zod18.z.boolean().optional().default(true),
-    scopes: import_lazy_zod18.z.array(import_lazy_zod18.z.string()).optional(),
-    alias: import_lazy_zod18.z.string().optional()
+var authProviderMappingSchema = import_lazy_zod19.z.union([
+  import_lazy_zod19.z.string(),
+  import_lazy_zod19.z.object({
+    name: import_lazy_zod19.z.string().min(1),
+    required: import_lazy_zod19.z.boolean().optional().default(true),
+    scopes: import_lazy_zod19.z.array(import_lazy_zod19.z.string()).optional(),
+    alias: import_lazy_zod19.z.string().optional()
   }).strict()
 ]);
-var authProvidersVaultOptionsSchema = import_lazy_zod18.z.object({
-  enabled: import_lazy_zod18.z.boolean().optional(),
-  useSharedStorage: import_lazy_zod18.z.boolean().optional().default(true),
-  namespace: import_lazy_zod18.z.string().optional().default("authproviders:"),
-  defaultCacheTtl: import_lazy_zod18.z.number().nonnegative().optional().default(36e5),
-  maxCredentialsPerSession: import_lazy_zod18.z.number().positive().optional().default(100),
-  providers: import_lazy_zod18.z.array(credentialProviderConfigSchema).optional()
+var authProvidersVaultOptionsSchema = import_lazy_zod19.z.object({
+  enabled: import_lazy_zod19.z.boolean().optional(),
+  useSharedStorage: import_lazy_zod19.z.boolean().optional().default(true),
+  namespace: import_lazy_zod19.z.string().optional().default("authproviders:"),
+  defaultCacheTtl: import_lazy_zod19.z.number().nonnegative().optional().default(36e5),
+  maxCredentialsPerSession: import_lazy_zod19.z.number().positive().optional().default(100),
+  providers: import_lazy_zod19.z.array(credentialProviderConfigSchema).optional()
 }).strict();
 
 // libs/auth/src/vault/credential-helpers.ts
@@ -9434,7 +9468,7 @@ var CredentialCache = class {
 var AUTH_PROVIDERS_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:AUTH_PROVIDERS_ACCESSOR");
 
 // libs/auth/src/vault/auth-providers.accessor.impl.ts
-var import_utils42 = require("@frontmcp/utils");
+var import_utils44 = require("@frontmcp/utils");
 var AuthProvidersAccessorImpl = class {
   constructor(registry, vault, cache, loader, context, logger) {
     this.registry = registry;
@@ -9649,7 +9683,7 @@ var AuthProvidersAccessorImpl = class {
         return { [credential.headerName]: credential.key };
       case "basic": {
         const value = `${credential.username}:${credential.password}`;
-        const encoded = credential.encodedValue ?? (0, import_utils42.base64Encode)(new TextEncoder().encode(value));
+        const encoded = credential.encodedValue ?? (0, import_utils44.base64Encode)(new TextEncoder().encode(value));
         return { Authorization: `Basic ${encoded}` };
       }
       case "custom":
@@ -10237,6 +10271,18 @@ var noopRelationshipResolver = {
     return false;
   }
 };
+function resolveAuthUser(authInfo) {
+  const extraUser = authInfo?.extra?.["user"];
+  if (authInfo?.user) return authInfo.user;
+  return typeof extraUser === "object" && extraUser !== null ? extraUser : {};
+}
+function isAnonymousSubject(sub) {
+  return typeof sub !== "string" || sub === "" || sub.startsWith("anon:");
+}
+function signedInSubject(rawSub, mappedSub) {
+  if (rawSub !== void 0 && isAnonymousSubject(rawSub)) return void 0;
+  return [mappedSub, rawSub].find((candidate) => !isAnonymousSubject(candidate));
+}
 var AuthoritiesContextBuilder = class {
   claimsMapping;
   claimsResolver;
@@ -10254,7 +10300,7 @@ var AuthoritiesContextBuilder = class {
       const resolved = this.claimsResolver(authInfo);
       return {
         user: {
-          sub: authInfo?.user?.sub ?? "",
+          sub: signedInSubject(resolveAuthUser(authInfo).sub),
           roles: resolved.roles,
           permissions: resolved.permissions,
           claims: resolved.claims
@@ -10264,7 +10310,7 @@ var AuthoritiesContextBuilder = class {
         relationships: this.relationshipResolver
       };
     }
-    const user = authInfo?.user ?? {};
+    const user = resolveAuthUser(authInfo);
     const authorization = authInfo?.extra?.["authorization"];
     const authorizationClaims = authorization?.["claims"] ?? {};
     const rawClaims = {
@@ -10285,10 +10331,10 @@ var AuthoritiesContextBuilder = class {
     } else {
       permissions = toStringArray(user["permissions"] ?? []);
     }
-    const sub = this.claimsMapping?.userId ? String(resolveDotPath(rawClaims, this.claimsMapping.userId) ?? "") : user.sub ?? "";
+    const mappedSub = this.claimsMapping?.userId ? resolveDotPath(rawClaims, this.claimsMapping.userId) : void 0;
     return {
       user: {
-        sub,
+        sub: signedInSubject(user.sub, mappedSub),
         roles,
         permissions,
         claims: rawClaims
@@ -10320,15 +10366,17 @@ var FrontMcpAuthContextImpl = class {
   roles;
   permissions;
   constructor(source, claimsMapping) {
-    const rawUser = source.user ?? {};
-    const sub = claimsMapping?.userId ? String(resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) ?? rawUser.sub ?? "") : String(rawUser.sub ?? "");
+    const rawUser = resolveAuthUser(source);
+    const mappedSub = claimsMapping?.userId ? resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) : void 0;
+    const signedInSub = signedInSubject(rawUser.sub, mappedSub);
+    const sub = signedInSub ?? (typeof rawUser.sub === "string" ? rawUser.sub : "");
     this.user = Object.freeze({
       sub,
       name: rawUser.name,
       email: rawUser.email,
       picture: rawUser.picture
     });
-    this.isAnonymous = sub === "" || sub.startsWith("anon:");
+    this.isAnonymous = signedInSub === void 0;
     const extraAuth = source.extra?.["authorization"];
     this.mode = String(
       source.extra?.["authMode"] ?? extraAuth?.["mode"] ?? (source.extra?.["isPublic"] === true || rawUser["anonymous"] === true ? "public" : "authenticated")
@@ -10386,7 +10434,7 @@ var FrontMcpAuthContextImpl = class {
    * Mirrors the logic in AuthoritiesContextBuilder.build().
    */
   buildRawClaims(source) {
-    const rawUser = source.user ?? {};
+    const rawUser = resolveAuthUser(source);
     const extraAuth = source.extra?.["authorization"];
     const authorizationClaims = extraAuth?.["claims"] ?? {};
     return {
@@ -10451,20 +10499,20 @@ function resolveRequiredScopes(denial, mapping, authorities) {
 }
 
 // libs/auth/src/authorities/authorities.schema.ts
-var import_lazy_zod19 = require("@frontmcp/lazy-zod");
-var rbacRolesPolicySchema = import_lazy_zod19.z.object({
-  all: import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).optional(),
-  any: import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).optional()
+var import_lazy_zod20 = require("@frontmcp/lazy-zod");
+var rbacRolesPolicySchema = import_lazy_zod20.z.object({
+  all: import_lazy_zod20.z.array(import_lazy_zod20.z.string().min(1)).optional(),
+  any: import_lazy_zod20.z.array(import_lazy_zod20.z.string().min(1)).optional()
 }).refine((data) => data.all !== void 0 || data.any !== void 0, {
   message: 'Roles policy must have at least "all" or "any"'
 });
-var rbacPermissionsPolicySchema = import_lazy_zod19.z.object({
-  all: import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).optional(),
-  any: import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).optional()
+var rbacPermissionsPolicySchema = import_lazy_zod20.z.object({
+  all: import_lazy_zod20.z.array(import_lazy_zod20.z.string().min(1)).optional(),
+  any: import_lazy_zod20.z.array(import_lazy_zod20.z.string().min(1)).optional()
 }).refine((data) => data.all !== void 0 || data.any !== void 0, {
   message: 'Permissions policy must have at least "all" or "any"'
 });
-var abacOperatorSchema = import_lazy_zod19.z.enum([
+var abacOperatorSchema = import_lazy_zod20.z.enum([
   "eq",
   "neq",
   "in",
@@ -10479,55 +10527,55 @@ var abacOperatorSchema = import_lazy_zod19.z.enum([
   "exists",
   "matches"
 ]);
-var abacConditionSchema = import_lazy_zod19.z.object({
-  path: import_lazy_zod19.z.string().min(1),
+var abacConditionSchema = import_lazy_zod20.z.object({
+  path: import_lazy_zod20.z.string().min(1),
   op: abacOperatorSchema,
-  value: import_lazy_zod19.z.unknown()
+  value: import_lazy_zod20.z.unknown()
 });
-var abacPolicySchema = import_lazy_zod19.z.object({
-  match: import_lazy_zod19.z.record(import_lazy_zod19.z.string(), import_lazy_zod19.z.unknown()).optional(),
-  conditions: import_lazy_zod19.z.array(abacConditionSchema).optional()
+var abacPolicySchema = import_lazy_zod20.z.object({
+  match: import_lazy_zod20.z.record(import_lazy_zod20.z.string(), import_lazy_zod20.z.unknown()).optional(),
+  conditions: import_lazy_zod20.z.array(abacConditionSchema).optional()
 }).refine((data) => data.match !== void 0 || data.conditions !== void 0, {
   message: 'Attributes policy must have at least "match" or "conditions"'
 });
-var resourceIdRefSchema = import_lazy_zod19.z.union([
-  import_lazy_zod19.z.string().min(1),
-  import_lazy_zod19.z.object({ fromInput: import_lazy_zod19.z.string().min(1) }).strict(),
-  import_lazy_zod19.z.object({ fromClaims: import_lazy_zod19.z.string().min(1) }).strict()
+var resourceIdRefSchema = import_lazy_zod20.z.union([
+  import_lazy_zod20.z.string().min(1),
+  import_lazy_zod20.z.object({ fromInput: import_lazy_zod20.z.string().min(1) }).strict(),
+  import_lazy_zod20.z.object({ fromClaims: import_lazy_zod20.z.string().min(1) }).strict()
 ]);
-var rebacPolicySchema = import_lazy_zod19.z.object({
-  type: import_lazy_zod19.z.string().min(1),
-  resource: import_lazy_zod19.z.string().min(1),
+var rebacPolicySchema = import_lazy_zod20.z.object({
+  type: import_lazy_zod20.z.string().min(1),
+  resource: import_lazy_zod20.z.string().min(1),
   resourceId: resourceIdRefSchema
 });
 var basePolicyShape = {
   roles: rbacRolesPolicySchema.optional(),
   permissions: rbacPermissionsPolicySchema.optional(),
   attributes: abacPolicySchema.optional(),
-  relationships: import_lazy_zod19.z.union([rebacPolicySchema, import_lazy_zod19.z.array(rebacPolicySchema)]).optional(),
-  custom: import_lazy_zod19.z.record(import_lazy_zod19.z.string(), import_lazy_zod19.z.unknown()).optional(),
-  guards: import_lazy_zod19.z.array(import_lazy_zod19.z.instanceof(Function)).optional(),
-  operator: import_lazy_zod19.z.enum(["AND", "OR"]).optional()
+  relationships: import_lazy_zod20.z.union([rebacPolicySchema, import_lazy_zod20.z.array(rebacPolicySchema)]).optional(),
+  custom: import_lazy_zod20.z.record(import_lazy_zod20.z.string(), import_lazy_zod20.z.unknown()).optional(),
+  guards: import_lazy_zod20.z.array(import_lazy_zod20.z.instanceof(Function)).optional(),
+  operator: import_lazy_zod20.z.enum(["AND", "OR"]).optional()
 };
-var authoritiesPolicySchema = import_lazy_zod19.z.lazy(
-  () => import_lazy_zod19.z.object({
+var authoritiesPolicySchema = import_lazy_zod20.z.lazy(
+  () => import_lazy_zod20.z.object({
     ...basePolicyShape,
     not: authoritiesPolicySchema.optional(),
-    anyOf: import_lazy_zod19.z.array(authoritiesPolicySchema).optional(),
-    allOf: import_lazy_zod19.z.array(authoritiesPolicySchema).optional()
+    anyOf: import_lazy_zod20.z.array(authoritiesPolicySchema).optional(),
+    allOf: import_lazy_zod20.z.array(authoritiesPolicySchema).optional()
   })
 );
-var authoritiesMetadataSchema = import_lazy_zod19.z.union([
-  import_lazy_zod19.z.string().min(1),
-  import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).min(1),
+var authoritiesMetadataSchema = import_lazy_zod20.z.union([
+  import_lazy_zod20.z.string().min(1),
+  import_lazy_zod20.z.array(import_lazy_zod20.z.string().min(1)).min(1),
   authoritiesPolicySchema
 ]);
-var authoritiesClaimsMappingSchema = import_lazy_zod19.z.record(import_lazy_zod19.z.string(), import_lazy_zod19.z.string().optional()).refine((data) => Object.values(data).some((v) => v !== void 0), {
+var authoritiesClaimsMappingSchema = import_lazy_zod20.z.record(import_lazy_zod20.z.string(), import_lazy_zod20.z.string().optional()).refine((data) => Object.values(data).some((v) => v !== void 0), {
   message: "Claims mapping must have at least one mapping"
 });
-var authoritiesConfigSchema = import_lazy_zod19.z.object({
+var authoritiesConfigSchema = import_lazy_zod20.z.object({
   claimsMapping: authoritiesClaimsMappingSchema.optional(),
-  profiles: import_lazy_zod19.z.record(import_lazy_zod19.z.string().min(1), authoritiesPolicySchema).optional()
+  profiles: import_lazy_zod20.z.record(import_lazy_zod20.z.string().min(1), authoritiesPolicySchema).optional()
 });
 
 // libs/auth/src/authorities/authorities.evaluator.ts
@@ -10605,8 +10653,9 @@ function resolveValue(value, ctx) {
 }
 function applyOperator(actual, op, expected) {
   switch (op) {
+    // A missing expected value (e.g. an absent fromInput) never matches, even an absent actual value
     case "eq":
-      return actual === expected;
+      return expected !== void 0 && actual === expected;
     case "neq":
       return actual !== expected;
     case "in":
@@ -10655,7 +10704,7 @@ function evaluateAbac(policy, ctx) {
     for (const [path, expectedRaw] of Object.entries(policy.match)) {
       const actual = resolveDotPath(envelope, path);
       const expected = resolveValue(expectedRaw, ctx);
-      if (actual !== expected) {
+      if (expected === void 0 || actual !== expected) {
         return {
           granted: false,
           deniedBy: `attributes.match: '${path}' expected '${String(expected)}' but got '${String(actual)}'`,
@@ -10695,6 +10744,15 @@ function resolveResourceId(ref, ctx) {
   return void 0;
 }
 async function evaluateSingleRebac(policy, ctx) {
+  const userSub = ctx.user.sub;
+  if (userSub === void 0 || isAnonymousSubject(userSub)) {
+    return {
+      granted: false,
+      deniedBy: `relationships: an anonymous caller cannot be '${policy.type}' of ${policy.resource}`,
+      denial: { kind: "relationships", path: "user.sub", expected: "a signed-in caller", actual: void 0 },
+      evaluatedPolicies: ["relationships"]
+    };
+  }
   const resourceId = resolveResourceId(policy.resourceId, ctx);
   if (resourceId === void 0) {
     return {
@@ -10709,11 +10767,11 @@ async function evaluateSingleRebac(policy, ctx) {
       evaluatedPolicies: ["relationships"]
     };
   }
-  const hasRelationship = await ctx.relationships.check(policy.type, policy.resource, resourceId, ctx.user.sub, ctx);
+  const hasRelationship = await ctx.relationships.check(policy.type, policy.resource, resourceId, userSub, ctx);
   if (!hasRelationship) {
     return {
       granted: false,
-      deniedBy: `relationships: user '${ctx.user.sub}' is not '${policy.type}' of ${policy.resource}:${resourceId}`,
+      deniedBy: `relationships: user '${userSub}' is not '${policy.type}' of ${policy.resource}:${resourceId}`,
       denial: {
         kind: "relationships",
         path: "relationships",
@@ -11231,6 +11289,8 @@ var FetchCredentialMiddleware = class {
   InMemoryStoreRequiredError,
   InvalidClientIdUrlError,
   JwksService,
+  JwtSecretRequiredError,
+  JwtSecretWeakError,
   LazyCredentialLoader,
   NoProviderIdError,
   NullOrchestratedAuthAccessor,
@@ -11385,6 +11445,7 @@ var FetchCredentialMiddleware = class {
   headerApplier,
   hkdfSha256,
   incrementalAuthConfigSchema,
+  isAnonymousSubject,
   isCimdClientId,
   isFrontMcpCredentials,
   isJwt,
@@ -11401,6 +11462,7 @@ var FetchCredentialMiddleware = class {
   isSoonExpiring,
   isSoonExpiringProvider,
   isSqliteTokenStorage,
+  isStaticMode,
   isTransparentMode,
   jsonWebKeySetSchema,
   jwkParametersSchema,
@@ -11460,6 +11522,7 @@ var FetchCredentialMiddleware = class {
   startNextProvider,
   statefulHttpTransportStateSchema,
   statelessHttpTransportStateSchema,
+  staticAuthOptionsSchema,
   storedSessionSchema,
   streamableHttpTransportStateSchema,
   toEpochSeconds,