@frontmcp/auth 1.8.2 → 1.8.4

package/esm/index.mjs

@@ -619,6 +619,12 @@ var TRANSPARENT_JWT_ALGS = [
 ];
 var MAX_JWKS_FETCH_BYTES = 1048576;
 var MAX_JWKS_FETCH_HOPS = 3;
+var MISSING_EXP_ERROR = 'missing required "exp" claim';
+function isMissingExpError(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const { code, claim, reason } = error;
+  return code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && claim === "exp" && reason === "missing";
+}
 var WEAK_KEY_WARNING = `
 \u26A0\uFE0F  SECURITY WARNING: OAuth provider is using an RSA key smaller than 2048 bits.
     This is considered insecure and should be updated.
@@ -688,6 +694,7 @@ var JwksService = class {
       kid = typeof header?.kid === "string" ? header.kid : void 0;
     } catch {
     }
+    let missingExp = false;
     for (const p of candidates) {
       let jwks;
       try {
@@ -699,7 +706,9 @@ var JwksService = class {
           // Pin to asymmetric algorithms so a symmetric key in the provider JWKS
           // can't be used to accept an HMAC-signed token, and `none` is refused.
           algorithms: [...TRANSPARENT_JWT_ALGS],
-          ...issuerConstraint ? { issuer: issuerConstraint } : {}
+          ...issuerConstraint ? { issuer: issuerConstraint } : {},
+          // A bearer token without `exp` would be valid forever (#272).
+          requiredClaims: ["exp"]
         });
         return {
           ok: true,
@@ -717,11 +726,14 @@ var JwksService = class {
             if (fallbackResult.ok) {
               return fallbackResult;
             }
+            if (fallbackResult.error === "missing_exp") missingExp = true;
           }
         }
+        if (isMissingExpError(e)) missingExp = true;
         this.logger.debug("[JwksService] Failed to verify token for provider: %s", p.id, e);
       }
     }
+    if (missingExp) return { ok: false, error: MISSING_EXP_ERROR };
     return { ok: false, error: `no_provider_verified${kid ? ` (kid=${kid})` : ""}` };
   }
   /**
@@ -802,7 +814,10 @@ var JwksService = class {
         }
       }
       const nowSec = Math.floor(Date.now() / 1e3);
-      if (payload.exp !== void 0 && (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp < nowSec)) {
+      if (payload.exp === void 0) {
+        return { ok: false, error: "missing_exp" };
+      }
+      if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp <= nowSec) {
         return { ok: false, error: "token_expired" };
       }
       if (payload.nbf !== void 0 && (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf > nowSec)) {
@@ -851,7 +866,10 @@ var JwksService = class {
    *   1) inline jwks (if provided) → cache & return
    *   2) cached & fresh (TTL)      → return
    *   3) explicit jwksUri          → fetch, cache, return
-   *   4) discover jwks_uri via AS  → fetch AS metadata, then jwks_uri, cache, return
+   *   4) discover jwks_uri         → the issuer's OAuth authorization server
+   *      metadata (RFC 8414), else its OpenID configuration (OpenID Connect
+   *      Discovery 1.0 §4, where Google, Okta, Auth0 and Entra publish it),
+   *      then fetch jwks_uri, cache, return
    */
   async getJwksForProvider(ref) {
     if (ref.jwks?.keys?.length) {
@@ -867,11 +885,13 @@ var JwksService = class {
       if (fromUri?.keys?.length) return fromUri;
     }
     const issuer = trimSlash(ref.issuerUrl);
-    const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/oauth-authorization-server`);
-    const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
-    if (uri) {
-      const fromMeta = await this.tryFetchJwks(ref.id, uri);
-      if (fromMeta?.keys?.length) return fromMeta;
+    for (const document of ["oauth-authorization-server", "openid-configuration"]) {
+      const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/${document}`);
+      const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
+      if (uri) {
+        const fromMeta = await this.tryFetchJwks(ref.id, uri);
+        if (fromMeta?.keys?.length) return fromMeta;
+      }
     }
     const maxStaleMs = Math.max(this.opts.providerJwksTtlMs * 4, 6e4);
     if (cached && Date.now() - cached.fetchedAt < maxStaleMs) {
@@ -1058,6 +1078,26 @@ var CDN = {
     stylesheet: "https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap"
   }
 };
+var BUILT_IN_AUTH_PAGE_CSP = [
+  "default-src 'self'",
+  "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net",
+  "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+  "font-src 'self' https://fonts.gstatic.com",
+  "img-src 'self' data: https:",
+  "connect-src 'self'",
+  "object-src 'none'",
+  "base-uri 'none'",
+  "frame-ancestors 'none'"
+].join("; ");
+function builtInAuthPageHeaders(options = {}) {
+  return {
+    ...options.csp === false ? {} : { "Content-Security-Policy": BUILT_IN_AUTH_PAGE_CSP },
+    "X-Frame-Options": "DENY",
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "same-origin",
+    "Cache-Control": "no-store"
+  };
+}
 var DEFAULT_THEME = {
   colors: {
     primary: "#3b82f6",
@@ -1295,7 +1335,7 @@ function buildIncrementalAuthPage(params) {
         </div>
       </div>
 
-      <form method="GET" action="${escapeHtml3(callbackPath)}" class="flex gap-3 pt-4 border-t border-gray-100">
+      <form method="POST" action="${escapeHtml3(callbackPath)}" class="flex gap-3 pt-4 border-t border-gray-100">
         <input type="hidden" name="pending_auth_id" value="${escapeHtml3(sessionHint)}">
         <button type="button" onclick="window.close()"
           class="flex-1 px-4 py-2.5 text-gray-600 hover:text-gray-900 hover:bg-gray-100 font-medium rounded-lg transition-colors">
@@ -1341,7 +1381,7 @@ function buildFederatedLoginPage(params) {
       ${escapeHtml3(clientName)} uses multiple authentication providers. Select which ones you want to authorize.
     </p>
 
-    <form method="GET" action="${escapeHtml3(callbackPath)}" id="federated-form">
+    <form method="POST" action="${escapeHtml3(callbackPath)}" id="federated-form">
       <input type="hidden" name="pending_auth_id" value="${escapeHtml3(pendingAuthId)}">
       <input type="hidden" name="federated" value="true">
 
@@ -1486,7 +1526,7 @@ function buildToolConsentPage(params) {
     ${errorBanner}
     ${userInfo}
 
-    <form method="GET" action="${escapeHtml3(callbackPath)}" id="consent-form">
+    <form method="POST" action="${escapeHtml3(callbackPath)}" id="consent-form">
       <input type="hidden" name="csrf" value="${escapeHtml3(csrfToken)}">
       <input type="hidden" name="pending_auth_id" value="${escapeHtml3(pendingAuthId)}">
       <input type="hidden" name="consent_submitted" value="1">
@@ -1584,7 +1624,7 @@ function buildLoginPage(params) {
 
       ${scopesHtml}
 
-      <form method="GET" action="${escapeHtml3(callbackPath)}">
+      <form method="POST" action="${escapeHtml3(callbackPath)}">
         <input type="hidden" name="pending_auth_id" value="${escapeHtml3(pendingAuthId)}">
 ${fieldsHtml}
 
@@ -1681,7 +1721,17 @@ function toLoginExtraFields(fields, values) {
     value: values?.[name]
   }));
 }
-function renderLocalLoginPage(login, ctx, values) {
+function withoutSecretFieldValues(values, fields) {
+  if (!values) return void 0;
+  const kept = {};
+  for (const [name, value] of Object.entries(values)) {
+    if (fields?.[name]?.type === "password") continue;
+    kept[name] = value;
+  }
+  return kept;
+}
+function renderLocalLoginPage(login, ctx, submitted) {
+  const values = withoutSecretFieldValues(submitted, login?.fields);
   if (login?.render) {
     return login.render({ ...ctx, values });
   }
@@ -1788,7 +1838,8 @@ function buildPendingRecord(params) {
     priorAuthorizedAppIds: params.priorAuthorizedAppIds,
     federatedLogin: params.federatedLogin,
     consent: params.consent,
-    authUiCsrf: params.authUiCsrf
+    authUiCsrf: params.authUiCsrf,
+    signinBinding: params.signinBinding
   };
 }
 function buildRefreshTokenRecord(params) {
@@ -2018,6 +2069,63 @@ var RedisAuthorizationStore = class {
   }
 };
 
+// libs/auth/src/session/pending-login.ts
+import {
+  base64urlDecode,
+  base64urlEncode,
+  decryptAesGcm,
+  encryptAesGcm,
+  hkdfSha256,
+  randomBytes as randomBytes2
+} from "@frontmcp/utils";
+var SALT = new TextEncoder().encode("frontmcp-pending-login");
+function keyFor(secret, pendingAuthId) {
+  return hkdfSha256(secret, SALT, new TextEncoder().encode(`pending-login:${pendingAuthId}`), 32);
+}
+function sealPendingLogin(secret, pendingAuthId, state) {
+  const iv = randomBytes2(12);
+  const { ciphertext, tag } = encryptAesGcm(
+    keyFor(secret, pendingAuthId),
+    new TextEncoder().encode(JSON.stringify(state)),
+    iv
+  );
+  return [iv, tag, ciphertext].map((part) => base64urlEncode(part)).join(".");
+}
+function openPendingLogin(secret, pendingAuthId, sealed) {
+  try {
+    const [iv, tag, ciphertext] = sealed.split(".").map((part) => base64urlDecode(part));
+    if (!iv || !tag || !ciphertext) return void 0;
+    const plaintext = decryptAesGcm(keyFor(secret, pendingAuthId), ciphertext, iv, tag);
+    const state = JSON.parse(new TextDecoder().decode(plaintext));
+    return typeof state?.sub === "string" && state.sub.length > 0 ? state : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// libs/auth/src/session/signin-binding.ts
+import { base64urlEncode as base64urlEncode2, getCookie, randomBytes as randomBytes3, sha256Hex, timingSafeEqual } from "@frontmcp/utils";
+var SIGNIN_BINDING_COOKIE_PREFIX = "frontmcp_signin_";
+var SIGNIN_BINDING_SECURE_COOKIE_PREFIX = `__Host-${SIGNIN_BINDING_COOKIE_PREFIX}`;
+var SIGNIN_BINDING_MAX_AGE_SECONDS = 30 * 60;
+function signinBindingCookieName(pendingAuthId, options = {}) {
+  const prefix = options.secure ? SIGNIN_BINDING_SECURE_COOKIE_PREFIX : SIGNIN_BINDING_COOKIE_PREFIX;
+  return `${prefix}${sha256Hex(`signin:${pendingAuthId}`).slice(0, 16)}`;
+}
+function createSigninBinding(pendingAuthId, options = {}) {
+  const value = base64urlEncode2(randomBytes3(32));
+  return { cookieName: signinBindingCookieName(pendingAuthId, options), value, hash: sha256Hex(value) };
+}
+function signinBindingMatches(cookieHeader, pendingAuthId, expectedHash, options = {}) {
+  if (!expectedHash) return false;
+  const value = getCookie(cookieHeader, signinBindingCookieName(pendingAuthId, options));
+  if (!value) return false;
+  const encoder = new TextEncoder();
+  const actual = encoder.encode(sha256Hex(value));
+  const expected = encoder.encode(expectedHash);
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+
 // libs/auth/src/session/storage-authorization.store.ts
 import { TypedStorage } from "@frontmcp/utils";
 var StorageAuthorizationStore = class {
@@ -2410,12 +2518,12 @@ import { getEnv, randomUUID as randomUUID2 } from "@frontmcp/utils";
 // libs/auth/src/session/vault-encryption.ts
 import { z as z3 } from "@frontmcp/lazy-zod";
 import {
-  base64urlDecode,
-  base64urlEncode,
-  decryptAesGcm,
-  encryptAesGcm,
-  hkdfSha256,
-  randomBytes as randomBytes2
+  base64urlDecode as base64urlDecode2,
+  base64urlEncode as base64urlEncode3,
+  decryptAesGcm as decryptAesGcm2,
+  encryptAesGcm as encryptAesGcm2,
+  hkdfSha256 as hkdfSha2562,
+  randomBytes as randomBytes4
 } from "@frontmcp/utils";
 var encryptedDataSchema = z3.object({
   /** Version for future algorithm changes */
@@ -2456,7 +2564,7 @@ var VaultEncryption = class {
     ];
     const ikm = new TextEncoder().encode(ikmParts.join(""));
     const infoBytes = new TextEncoder().encode(this.hkdfInfo);
-    const key = await hkdfSha256(ikm, new Uint8Array(0), infoBytes, 32);
+    const key = await hkdfSha2562(ikm, new Uint8Array(0), infoBytes, 32);
     return key;
   }
   /**
@@ -2483,7 +2591,7 @@ var VaultEncryption = class {
     ];
     const ikm = new TextEncoder().encode(ikmParts.join(""));
     const infoBytes = new TextEncoder().encode(this.hkdfInfo);
-    const key = await hkdfSha256(ikm, new Uint8Array(0), infoBytes, 32);
+    const key = await hkdfSha2562(ikm, new Uint8Array(0), infoBytes, 32);
     return key;
   }
   /**
@@ -2497,14 +2605,14 @@ var VaultEncryption = class {
     if (key.length !== 32) {
       throw new Error("Encryption key must be 32 bytes");
     }
-    const iv = randomBytes2(12);
-    const { ciphertext, tag } = await encryptAesGcm(key, new TextEncoder().encode(plaintext), iv);
+    const iv = randomBytes4(12);
+    const { ciphertext, tag } = await encryptAesGcm2(key, new TextEncoder().encode(plaintext), iv);
     return {
       v: 1,
       alg: "aes-256-gcm",
-      iv: base64urlEncode(iv),
-      ct: base64urlEncode(ciphertext),
-      tag: base64urlEncode(tag)
+      iv: base64urlEncode3(iv),
+      ct: base64urlEncode3(ciphertext),
+      tag: base64urlEncode3(tag)
     };
   }
   /**
@@ -2524,11 +2632,11 @@ var VaultEncryption = class {
       throw new Error("Invalid encrypted data format");
     }
     const { iv, ct, tag } = parsed.data;
-    const ivBuffer = base64urlDecode(iv);
-    const ciphertext = base64urlDecode(ct);
-    const tagBuffer = base64urlDecode(tag);
+    const ivBuffer = base64urlDecode2(iv);
+    const ciphertext = base64urlDecode2(ct);
+    const tagBuffer = base64urlDecode2(tag);
     try {
-      const plaintext = await decryptAesGcm(key, ciphertext, ivBuffer, tagBuffer);
+      const plaintext = await decryptAesGcm2(key, ciphertext, ivBuffer, tagBuffer);
       return new TextDecoder().decode(plaintext);
     } catch (_error) {
       throw new Error("Decryption failed: invalid key or corrupted data");
@@ -3124,7 +3232,7 @@ function errMsg2(err) {
 var SECURE_STORE_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:SECURE_STORE_ACCESSOR");
 
 // libs/auth/src/session/secure-store-accessor.impl.ts
-import { sha256Hex } from "@frontmcp/utils";
+import { sha256Hex as sha256Hex2 } from "@frontmcp/utils";
 var GLOBAL_NAMESPACE = "global";
 var SecureStoreAccessorImpl = class {
   backend;
@@ -3153,12 +3261,12 @@ var SecureStoreAccessorImpl = class {
         return GLOBAL_NAMESPACE;
       case "session": {
         const sid = this.resolveSessionId();
-        return sid ? `s:${sha256Hex(sid).slice(0, 32)}` : void 0;
+        return sid ? `s:${sha256Hex2(sid).slice(0, 32)}` : void 0;
       }
       case "user":
       default: {
         const sub = this.resolveSub();
-        return sub ? `u:${sha256Hex(sub).slice(0, 32)}` : void 0;
+        return sub ? `u:${sha256Hex2(sub).slice(0, 32)}` : void 0;
       }
     }
   }
@@ -3262,7 +3370,7 @@ async function createSecureStore(options) {
 }
 
 // libs/auth/src/session/token.vault.ts
-import { encryptAesGcm as encryptAesGcm2, decryptAesGcm as decryptAesGcm2, randomBytes as randomBytes3, base64urlEncode as base64urlEncode2, base64urlDecode as base64urlDecode2 } from "@frontmcp/utils";
+import { encryptAesGcm as encryptAesGcm3, decryptAesGcm as decryptAesGcm3, randomBytes as randomBytes5, base64urlEncode as base64urlEncode4, base64urlDecode as base64urlDecode3 } from "@frontmcp/utils";
 var TokenVault = class {
   /** Active key used for new encryptions */
   active;
@@ -3291,14 +3399,14 @@ var TokenVault = class {
     this.keys.set(k.kid, k.key);
   }
   async encrypt(plaintext, opts) {
-    const iv = randomBytes3(12);
-    const { ciphertext, tag } = await encryptAesGcm2(this.active.key, new TextEncoder().encode(plaintext), iv);
+    const iv = randomBytes5(12);
+    const { ciphertext, tag } = await encryptAesGcm3(this.active.key, new TextEncoder().encode(plaintext), iv);
     return {
       alg: "A256GCM",
       kid: this.active.kid,
-      iv: base64urlEncode2(iv),
-      tag: base64urlEncode2(tag),
-      data: base64urlEncode2(ciphertext),
+      iv: base64urlEncode4(iv),
+      tag: base64urlEncode4(tag),
+      data: base64urlEncode4(ciphertext),
       exp: opts?.exp,
       meta: opts?.meta
     };
@@ -3312,21 +3420,21 @@ var TokenVault = class {
     }
     const key = this.keys.get(blob.kid);
     if (!key) throw new Error(`vault_unknown_kid:${blob.kid}`);
-    const iv = base64urlDecode2(blob.iv);
-    const tag = base64urlDecode2(blob.tag);
-    const data = base64urlDecode2(blob.data);
-    const plaintext = await decryptAesGcm2(key, data, iv, tag);
+    const iv = base64urlDecode3(blob.iv);
+    const tag = base64urlDecode3(blob.tag);
+    const data = base64urlDecode3(blob.data);
+    const plaintext = await decryptAesGcm3(key, data, iv, tag);
     return new TextDecoder().decode(plaintext);
   }
 };
 
 // libs/auth/src/session/index.ts
 import {
-  hkdfSha256 as hkdfSha2564,
+  hkdfSha256 as hkdfSha2565,
   encryptValue as encryptValue2,
   decryptValue as decryptValue2,
-  encryptAesGcm as encryptAesGcm5,
-  decryptAesGcm as decryptAesGcm5
+  encryptAesGcm as encryptAesGcm6,
+  decryptAesGcm as decryptAesGcm6
 } from "@frontmcp/utils";
 
 // libs/auth/src/session/transport-session.types.ts
@@ -3433,7 +3541,7 @@ import {
 } from "@frontmcp/utils";
 
 // libs/auth/src/errors/auth-internal.error.ts
-import { randomBytes as randomBytes4, bytesToHex as bytesToHex2 } from "@frontmcp/utils";
+import { randomBytes as randomBytes6, bytesToHex as bytesToHex2 } from "@frontmcp/utils";
 var AuthInternalError = class extends Error {
   /**
    * Unique error ID for tracking in logs.
@@ -3455,7 +3563,7 @@ var AuthInternalError = class extends Error {
     super(message);
     this.name = this.constructor.name;
     this.code = code;
-    this.errorId = `err_${bytesToHex2(randomBytes4(8))}`;
+    this.errorId = `err_${bytesToHex2(randomBytes6(8))}`;
     Error.captureStackTrace(this, this.constructor);
   }
   /**
@@ -4761,7 +4869,7 @@ var VercelKvSessionStore = class {
 };
 
 // libs/auth/src/session/orchestrated-token.store.ts
-import { encryptAesGcm as encryptAesGcm3, decryptAesGcm as decryptAesGcm3, randomBytes as randomBytes5, hkdfSha256 as hkdfSha2562 } from "@frontmcp/utils";
+import { encryptAesGcm as encryptAesGcm4, decryptAesGcm as decryptAesGcm4, randomBytes as randomBytes7, hkdfSha256 as hkdfSha2563 } from "@frontmcp/utils";
 var InMemoryOrchestratedTokenStore = class {
   /** Token storage: Map<compositeKey, ProviderTokenRecord> */
   tokens = /* @__PURE__ */ new Map();
@@ -4803,7 +4911,7 @@ var InMemoryOrchestratedTokenStore = class {
     }
     const info = new TextEncoder().encode(`orchestrated-token:${compositeKey}`);
     const salt = new TextEncoder().encode("frontmcp-token-store");
-    const derivedKey = hkdfSha2562(this.encryptionKey, salt, info, 32);
+    const derivedKey = hkdfSha2563(this.encryptionKey, salt, info, 32);
     this.derivedKeys.set(compositeKey, derivedKey);
     return derivedKey;
   }
@@ -4813,8 +4921,8 @@ var InMemoryOrchestratedTokenStore = class {
   async encryptRecord(compositeKey, record) {
     const key = await this.deriveKeyForRecord(compositeKey);
     const plaintext = JSON.stringify(record);
-    const iv = randomBytes5(12);
-    const { ciphertext, tag } = encryptAesGcm3(key, new TextEncoder().encode(plaintext), iv);
+    const iv = randomBytes7(12);
+    const { ciphertext, tag } = encryptAesGcm4(key, new TextEncoder().encode(plaintext), iv);
     return JSON.stringify({
       iv: Buffer.from(iv).toString("base64url"),
       tag: Buffer.from(tag).toString("base64url"),
@@ -4830,7 +4938,7 @@ var InMemoryOrchestratedTokenStore = class {
     const ivBytes = Buffer.from(iv, "base64url");
     const tagBytes = Buffer.from(tag, "base64url");
     const ciphertextBytes = Buffer.from(data, "base64url");
-    const plaintext = decryptAesGcm3(key, ciphertextBytes, ivBytes, tagBytes);
+    const plaintext = decryptAesGcm4(key, ciphertextBytes, ivBytes, tagBytes);
     return JSON.parse(new TextDecoder().decode(plaintext));
   }
   /**
@@ -5032,7 +5140,7 @@ var InMemoryOrchestratedTokenStore = class {
 };
 
 // libs/auth/src/session/orchestrated-token.crypto.ts
-import { decryptAesGcm as decryptAesGcm4, encryptAesGcm as encryptAesGcm4, hkdfSha256 as hkdfSha2563, randomBytes as randomBytes6 } from "@frontmcp/utils";
+import { decryptAesGcm as decryptAesGcm5, encryptAesGcm as encryptAesGcm5, hkdfSha256 as hkdfSha2564, randomBytes as randomBytes8 } from "@frontmcp/utils";
 var HKDF_SALT = new TextEncoder().encode("frontmcp-token-store");
 function deriveKeyForRecord(masterKey, compositeKey, cache) {
   const cached = cache.get(compositeKey);
@@ -5040,14 +5148,14 @@ function deriveKeyForRecord(masterKey, compositeKey, cache) {
     return cached;
   }
   const info = new TextEncoder().encode(`orchestrated-token:${compositeKey}`);
-  const derived = hkdfSha2563(masterKey, HKDF_SALT, info, 32);
+  const derived = hkdfSha2564(masterKey, HKDF_SALT, info, 32);
   cache.set(compositeKey, derived);
   return derived;
 }
 function encryptRecord(key, record) {
   const plaintext = JSON.stringify(record);
-  const iv = randomBytes6(12);
-  const { ciphertext, tag } = encryptAesGcm4(key, new TextEncoder().encode(plaintext), iv);
+  const iv = randomBytes8(12);
+  const { ciphertext, tag } = encryptAesGcm5(key, new TextEncoder().encode(plaintext), iv);
   return JSON.stringify({
     iv: Buffer.from(iv).toString("base64url"),
     tag: Buffer.from(tag).toString("base64url"),
@@ -5059,7 +5167,7 @@ function decryptRecord(key, encrypted) {
   const ivBytes = Buffer.from(iv, "base64url");
   const tagBytes = Buffer.from(tag, "base64url");
   const ciphertextBytes = Buffer.from(data, "base64url");
-  const plaintext = decryptAesGcm4(key, ciphertextBytes, ivBytes, tagBytes);
+  const plaintext = decryptAesGcm5(key, ciphertextBytes, ivBytes, tagBytes);
   return JSON.parse(new TextDecoder().decode(plaintext));
 }
 
@@ -5325,6 +5433,7 @@ var InMemoryFederatedAuthSessionStore = class {
       providerQueue: [...params.providerIds],
       completedProviders: /* @__PURE__ */ new Map(),
       skippedProviders: [],
+      signinBinding: params.signinBinding,
       createdAt: now,
       expiresAt: now + this.sessionTtlMs
     };
@@ -5357,6 +5466,7 @@ function createFederatedAuthSession(params, ttlMs = 15 * 60 * 1e3) {
     providerQueue: [...params.providerIds],
     completedProviders: /* @__PURE__ */ new Map(),
     skippedProviders: [],
+    signinBinding: params.signinBinding,
     createdAt: now,
     expiresAt: now + ttlMs
   };
@@ -5911,7 +6021,7 @@ function createEncryptedVault(redis, config = {}) {
 }
 
 // libs/auth/src/session/token.refresh.ts
-import { base64urlDecode as base64urlDecode3 } from "@frontmcp/utils";
+import { base64urlDecode as base64urlDecode4 } from "@frontmcp/utils";
 function toEpochSeconds(exp) {
   if (exp == null) return void 0;
   if (exp instanceof Date) return Math.floor(exp.getTime() / 1e3);
@@ -5933,7 +6043,7 @@ function tryJwtExp(token) {
   const parts = token.split(".");
   if (parts.length < 2) return void 0;
   try {
-    const json = JSON.parse(new TextDecoder().decode(base64urlDecode3(parts[1])));
+    const json = JSON.parse(new TextDecoder().decode(base64urlDecode4(parts[1])));
     const e = json?.exp;
     return typeof e === "number" ? toEpochSeconds(e) : void 0;
   } catch {
@@ -5996,7 +6106,7 @@ var progressiveAuthStateSchema = z6.object({
 });
 
 // libs/auth/src/authorization/authorization.class.ts
-import { base64urlDecode as base64urlDecode4, getMachineId as getMachineId2, randomUUID as randomUUID11 } from "@frontmcp/utils";
+import { base64urlDecode as base64urlDecode5, getMachineId as getMachineId2, randomUUID as randomUUID11 } from "@frontmcp/utils";
 var AuthorizationBase = class _AuthorizationBase {
   id;
   isAnonymous;
@@ -6192,7 +6302,7 @@ var AuthorizationBase = class _AuthorizationBase {
    */
   static isJwtHeader(segment) {
     try {
-      const bytes = base64urlDecode4(segment);
+      const bytes = base64urlDecode5(segment);
       const text = new TextDecoder().decode(bytes);
       const parsed = JSON.parse(text);
       return typeof parsed === "object" && parsed !== null && typeof parsed.alg === "string";
@@ -6364,7 +6474,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
 };
 
 // libs/auth/src/authorization/transparent.authorization.ts
-import { sha256Hex as sha256Hex2 } from "@frontmcp/utils";
+import { sha256Hex as sha256Hex3 } from "@frontmcp/utils";
 var TransparentAuthorization = class _TransparentAuthorization extends AuthorizationBase {
   mode = "transparent";
   /**
@@ -6464,7 +6574,7 @@ var TransparentAuthorization = class _TransparentAuthorization extends Authoriza
   static generateAuthorizationId(token) {
     const parts = token.split(".");
     const signature = parts[2] || token;
-    return sha256Hex2(signature).substring(0, 16);
+    return sha256Hex3(signature).substring(0, 16);
   }
   /**
    * Get the issuer from the token claims
@@ -6490,11 +6600,11 @@ var TransparentAuthorization = class _TransparentAuthorization extends Authoriza
 };
 
 // libs/auth/src/utils/authorization-id.utils.ts
-import { sha256Hex as sha256Hex3 } from "@frontmcp/utils";
+import { sha256Hex as sha256Hex4 } from "@frontmcp/utils";
 function deriveAuthorizationId(token) {
   const parts = token.split(".");
   const signature = parts[2] || token;
-  return sha256Hex3(signature).substring(0, 16);
+  return sha256Hex4(signature).substring(0, 16);
 }
 
 // libs/auth/src/authorization/orchestrated.authorization.ts
@@ -6863,7 +6973,7 @@ var OrchestratedAuthAccessorAdapter = class {
 };
 
 // libs/auth/src/authorization/dcr-client.registry.ts
-import { sha256 as sha2562, timingSafeEqual } from "@frontmcp/utils";
+import { sha256 as sha2562, timingSafeEqual as timingSafeEqual2 } from "@frontmcp/utils";
 var DEFAULT_MAX_DYNAMIC_CLIENTS = 1e3;
 function globMatch(pattern, input) {
   let p = 0;
@@ -6989,7 +7099,7 @@ var DcrClientRegistry = class {
     if (!isConfidential) return "ok";
     if (!client.client_secret) return "invalid";
     if (!presentedSecret) return "invalid";
-    return timingSafeEqual(sha2562(presentedSecret), sha2562(client.client_secret)) ? "ok" : "invalid";
+    return timingSafeEqual2(sha2562(presentedSecret), sha2562(client.client_secret)) ? "ok" : "invalid";
   }
   /** Whether a client id is known to the registry. */
   has(clientId) {
@@ -7077,7 +7187,7 @@ var DcrClientRegistry = class {
     if (typeof presented !== "string" || presented.length === 0) {
       return false;
     }
-    return timingSafeEqual(sha2562(presented), sha2562(expected));
+    return timingSafeEqual2(sha2562(presented), sha2562(expected));
   }
 };
 
@@ -7894,7 +8004,16 @@ var upstreamProviderSchema = z10.object({
   /** User info endpoint (optional, used to enrich the session identity). */
   userInfoEndpoint: z10.string().url().optional(),
   /** JWKS URI for upstream id_token validation (optional). */
-  jwksUri: z10.string().url().optional()
+  jwksUri: z10.string().url().optional(),
+  /**
+   * The provider's issuer identifier (its OIDC `iss`). When set, an RFC 9207
+   * `iss` on the provider's callback and the `iss` of its `id_token` must name
+   * it (or one of {@link additionalIssuers}). Without it the provider's
+   * `id_token` is not used for identity; `userInfoEndpoint` is asked instead.
+   */
+  issuer: z10.string().url().optional(),
+  /** Other issuer values this provider legitimately uses. */
+  additionalIssuers: z10.array(z10.string().trim().min(1, "additionalIssuers entries must be non-empty")).optional()
 }).refine((p) => !!(p.authorizationEndpoint ?? p.authorizeUrl), {
   message: "authorizationEndpoint (or authorizeUrl) is required",
   path: ["authorizationEndpoint"]
@@ -8303,17 +8422,21 @@ var sharedAuthFields = {
    * Require the OAuth client to be KNOWN (registered via DCR / pre-registered,
    * or a CIMD client-id URL) before an authorization request is accepted.
    *
-   * @default false (backward compatible — unknown client ids are accepted).
+   * @default true
    *
-   * SECURITY: with the default, an unregistered client id has no trusted
-   * `redirect_uris` to validate against, so its (attacker-chosen) redirect_uri
-   * is accepted and a real authorization code can be delivered to an attacker
-   * (auth-code interception → account takeover in real-IdP modes). Set this to
-   * `true` (recommended for production) to enforce OAuth 2.1 exact redirect-uri
-   * matching for every client. Clients on a configured
-   * `dcr.allowedRedirectUris` allowlist still pass.
-   */
-  requireRegisteredClients: z14.boolean().default(false),
+   * SECURITY: an unregistered client id has no trusted `redirect_uris` to
+   * validate against, so accepting it lets anyone start a sign-in whose
+   * authorization code is delivered to a redirect_uri of their choosing
+   * (auth-code interception). `false` is for local development only; a
+   * `dcr.allowedRedirectUris` allowlist still constrains such clients.
+   */
+  requireRegisteredClients: z14.boolean().default(true),
+  /**
+   * Scopes the server may grant (exact values or `*` globs). Requested scopes
+   * outside this list are dropped from the grant. Unset → the standard OpenID
+   * scopes only (see `DEFAULT_ALLOWED_SCOPES`).
+   */
+  allowedScopes: z14.array(z14.string().trim().min(1, "allowedScopes entries must be non-empty")).optional(),
   cimd: cimdConfigSchema.optional(),
   // #469 — custom auth UI as a slot→file map + extras name→handler map (per-app
   // under splitByApp). Both optional; omitting them serves the built-in pages.
@@ -8924,6 +9047,50 @@ var AudienceValidator = class _AudienceValidator {
   }
 };
 
+// libs/auth/src/utils/scope-grant.utils.ts
+var DEFAULT_ALLOWED_SCOPES = Object.freeze([
+  "openid",
+  "profile",
+  "email",
+  "offline_access"
+]);
+function grantScopes(requested, allowed) {
+  const patterns = allowed ?? DEFAULT_ALLOWED_SCOPES;
+  const granted = [];
+  for (const scope of requested) {
+    if (!scope || granted.includes(scope)) continue;
+    if (patterns.some((pattern) => globMatch(pattern, scope))) granted.push(scope);
+  }
+  return granted;
+}
+function advertisedScopes(allowed) {
+  const scopes = [];
+  for (const scope of allowed ?? DEFAULT_ALLOWED_SCOPES) {
+    if (scope && !scope.includes("*") && !scopes.includes(scope)) scopes.push(scope);
+  }
+  return scopes;
+}
+
+// libs/auth/src/utils/redirect-uri.utils.ts
+function isLoopbackRedirectUri(uri) {
+  let url;
+  try {
+    url = new URL(uri);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  if (url.username || url.password) return false;
+  const host = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host === "::1") return true;
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (m) {
+    const octets = m.slice(1).map((n) => Number(n));
+    return octets.every((o) => o >= 0 && o <= 255) && octets[0] === 127;
+  }
+  return false;
+}
+
 // libs/auth/src/vault/auth-providers.types.ts
 import { z as z19 } from "@frontmcp/lazy-zod";
 var credentialScopeSchema = z19.enum(["global", "user", "session"]);
@@ -10489,6 +10656,211 @@ async function evaluateRebac(policy, ctx) {
   return { granted: true, evaluatedPolicies: ["relationships"] };
 }
 
+// libs/auth/src/authorities/authorities.validation.ts
+var ABAC_OPERATORS = /* @__PURE__ */ new Set([
+  "eq",
+  "neq",
+  "in",
+  "notIn",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "contains",
+  "startsWith",
+  "endsWith",
+  "exists",
+  "matches"
+]);
+var CHECK_FIELDS = [
+  "roles",
+  "permissions",
+  "attributes",
+  "relationships",
+  "custom",
+  "guards",
+  "allOf",
+  "anyOf",
+  "not"
+];
+var RULE_FIELDS = /* @__PURE__ */ new Set([...CHECK_FIELDS, "operator"]);
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function unknownFields(value, known, path) {
+  const prefix = path ? `${path} has` : "has";
+  return Object.keys(value).filter((key) => !known.has(key)).map((key) => `${prefix} an unknown field "${key}"`);
+}
+function checkStringList(value, path) {
+  if (!Array.isArray(value)) return [`${path} must be a list of names`];
+  if (value.length === 0) return [`${path} is empty`];
+  return value.every(isNonEmptyString) ? [] : [`${path} must contain only non-empty names`];
+}
+var ALL_OR_ANY = /* @__PURE__ */ new Set(["all", "any"]);
+function checkAllOrAny(value, path) {
+  if (!isPlainObject(value)) return [`${path} must be an object with "all" or "any"`];
+  const problems = unknownFields(value, ALL_OR_ANY, path);
+  if (value["all"] === void 0 && value["any"] === void 0) {
+    problems.push(`${path} needs "all" or "any"`);
+  }
+  if (value["all"] !== void 0) problems.push(...checkStringList(value["all"], `${path}.all`));
+  if (value["any"] !== void 0) problems.push(...checkStringList(value["any"], `${path}.any`));
+  return problems;
+}
+var ATTRIBUTE_FIELDS = /* @__PURE__ */ new Set(["match", "conditions"]);
+var CONDITION_FIELDS = /* @__PURE__ */ new Set(["path", "op", "value"]);
+function isValueReference(value) {
+  return isPlainObject(value) && ("fromInput" in value || "fromClaims" in value);
+}
+function checkValueReference(value, path) {
+  const ref = value["fromInput"] ?? value["fromClaims"];
+  return Object.keys(value).length === 1 && isNonEmptyString(ref) ? [] : [`${path} must be { fromInput: "<name>" } or { fromClaims: "<path>" }`];
+}
+var OPERATOR_VALUES = {
+  in: { accepts: Array.isArray, needs: "a list" },
+  notIn: { accepts: Array.isArray, needs: "a list" },
+  gt: { accepts: (value) => typeof value === "number", needs: "a number" },
+  gte: { accepts: (value) => typeof value === "number", needs: "a number" },
+  lt: { accepts: (value) => typeof value === "number", needs: "a number" },
+  lte: { accepts: (value) => typeof value === "number", needs: "a number" },
+  startsWith: { accepts: (value) => typeof value === "string", needs: "a string" },
+  endsWith: { accepts: (value) => typeof value === "string", needs: "a string" },
+  matches: { accepts: (value) => typeof value === "string", needs: "a string" }
+};
+function checkConditionValue(op, condition, path) {
+  const value = condition["value"];
+  if (value === void 0) return [`${path} is missing`];
+  if (op === "exists") {
+    return typeof value === "boolean" ? [] : [`${path} must be true or false for "exists"`];
+  }
+  if (isValueReference(value)) return checkValueReference(value, path);
+  const expected = OPERATOR_VALUES[op];
+  if (expected && !expected.accepts(value)) return [`${path} must be ${expected.needs} for "${op}"`];
+  if (Array.isArray(value) && value.length === 0 && (op === "in" || op === "notIn")) return [`${path} is empty`];
+  return [];
+}
+function checkAttributes(value, path) {
+  if (!isPlainObject(value)) return [`${path} must be an object with "match" or "conditions"`];
+  const problems = unknownFields(value, ATTRIBUTE_FIELDS, path);
+  const { match, conditions } = value;
+  if (match === void 0 && conditions === void 0) {
+    problems.push(`${path} needs "match" or "conditions"`);
+  }
+  if (match !== void 0) {
+    if (!isPlainObject(match)) problems.push(`${path}.match must be an object`);
+    else if (Object.keys(match).length === 0) problems.push(`${path}.match is empty`);
+    else {
+      for (const [attribute, expected] of Object.entries(match)) {
+        const at = `${path}.match[${JSON.stringify(attribute)}]`;
+        if (expected === void 0) problems.push(`${at} has no value`);
+        else if (isValueReference(expected)) problems.push(...checkValueReference(expected, at));
+      }
+    }
+  }
+  if (conditions !== void 0) {
+    if (!Array.isArray(conditions)) problems.push(`${path}.conditions must be a list`);
+    else if (conditions.length === 0) problems.push(`${path}.conditions is empty`);
+    else {
+      conditions.forEach((condition, index) => {
+        const at = `${path}.conditions[${index}]`;
+        if (!isPlainObject(condition)) {
+          problems.push(`${at} must be an object with "path" and "op"`);
+          return;
+        }
+        problems.push(...unknownFields(condition, CONDITION_FIELDS, at));
+        if (!isNonEmptyString(condition["path"])) problems.push(`${at}.path must be a non-empty string`);
+        const op = condition["op"];
+        if (!ABAC_OPERATORS.has(op)) {
+          problems.push(`${at}.op "${String(condition["op"])}" is not an operator`);
+        } else {
+          problems.push(...checkConditionValue(op, condition, `${at}.value`));
+        }
+      });
+    }
+  }
+  return problems;
+}
+var RELATIONSHIP_FIELDS = /* @__PURE__ */ new Set(["type", "resource", "resourceId"]);
+function checkResourceId(value, path) {
+  if (isNonEmptyString(value)) return [];
+  if (isPlainObject(value) && Object.keys(value).length === 1) {
+    const ref = value["fromInput"] ?? value["fromClaims"];
+    if (isNonEmptyString(ref)) return [];
+  }
+  return [`${path} must be a string, { fromInput } or { fromClaims }`];
+}
+function checkRelationship(value, path) {
+  if (!isPlainObject(value)) return [`${path} must be an object with "type", "resource" and "resourceId"`];
+  const problems = unknownFields(value, RELATIONSHIP_FIELDS, path);
+  if (!isNonEmptyString(value["type"])) problems.push(`${path}.type must be a non-empty string`);
+  if (!isNonEmptyString(value["resource"])) problems.push(`${path}.resource must be a non-empty string`);
+  problems.push(...checkResourceId(value["resourceId"], `${path}.resourceId`));
+  return problems;
+}
+function checkRelationships(value, path) {
+  if (!Array.isArray(value)) return checkRelationship(value, path);
+  if (value.length === 0) return [`${path} is empty`];
+  return value.flatMap((relationship, index) => checkRelationship(relationship, `${path}[${index}]`));
+}
+function checkRuleList(value, path) {
+  if (!Array.isArray(value)) return [`${path} must be a list of rules`];
+  if (value.length === 0) return [`${path} is empty`];
+  return value.flatMap((rule, index) => checkRule(rule, `${path}[${index}]`));
+}
+function checkRule(rule, path) {
+  if (!isPlainObject(rule)) {
+    return [`${path || "the rule"} must be a rule object${typeof rule === "string" ? ", not a profile name" : ""}`];
+  }
+  const problems = unknownFields(rule, RULE_FIELDS, path);
+  if (!CHECK_FIELDS.some((field) => rule[field] !== void 0)) {
+    problems.push(`${path ? `${path} ` : ""}checks nothing`);
+  }
+  if (rule["operator"] !== void 0 && rule["operator"] !== "AND" && rule["operator"] !== "OR") {
+    problems.push(`${path}.operator must be "AND" or "OR"`);
+  }
+  if (rule["roles"] !== void 0) problems.push(...checkAllOrAny(rule["roles"], `${path}.roles`));
+  if (rule["permissions"] !== void 0) problems.push(...checkAllOrAny(rule["permissions"], `${path}.permissions`));
+  if (rule["attributes"] !== void 0) problems.push(...checkAttributes(rule["attributes"], `${path}.attributes`));
+  if (rule["relationships"] !== void 0) {
+    problems.push(...checkRelationships(rule["relationships"], `${path}.relationships`));
+  }
+  if (rule["custom"] !== void 0) {
+    if (!isPlainObject(rule["custom"])) problems.push(`${path}.custom must be an object`);
+    else if (Object.keys(rule["custom"]).length === 0) problems.push(`${path}.custom is empty`);
+  }
+  if (rule["guards"] !== void 0) {
+    const guards = rule["guards"];
+    if (!Array.isArray(guards)) problems.push(`${path}.guards must be a list of functions`);
+    else if (guards.length === 0) problems.push(`${path}.guards is empty`);
+    else if (!guards.every((guard) => typeof guard === "function")) {
+      problems.push(`${path}.guards must contain only functions`);
+    }
+  }
+  if (rule["allOf"] !== void 0) problems.push(...checkRuleList(rule["allOf"], `${path}.allOf`));
+  if (rule["anyOf"] !== void 0) problems.push(...checkRuleList(rule["anyOf"], `${path}.anyOf`));
+  if (rule["not"] !== void 0) problems.push(...checkRule(rule["not"], `${path}.not`));
+  return problems;
+}
+function findAuthoritiesRuleProblems(authorities) {
+  if (typeof authorities === "string") {
+    return authorities.length > 0 ? [] : ["the profile name is empty"];
+  }
+  if (Array.isArray(authorities)) {
+    if (authorities.length === 0) return ["the list of profiles is empty"];
+    return authorities.every(isNonEmptyString) ? [] : ["a list of profiles must contain only non-empty profile names"];
+  }
+  if (!isPlainObject(authorities)) {
+    return ["must be a profile name, a list of profile names, or a rule object"];
+  }
+  return checkRule(authorities, "");
+}
+function findAuthoritiesProfileProblems(name, policy) {
+  return checkRule(policy, "").map((problem) => `profile "${name}": ${problem.replace(/^\./, "")}`);
+}
+
 // libs/auth/src/authorities/authorities.engine.ts
 function mergeResult(base, ...others) {
   const evaluatedPolicies = [...base.evaluatedPolicies];
@@ -10497,8 +10869,12 @@ function mergeResult(base, ...others) {
   }
   return { ...base, evaluatedPolicies };
 }
-function granted(policies) {
-  return { granted: true, evaluatedPolicies: policies };
+function invalidRule(problems, policies = []) {
+  return {
+    granted: false,
+    deniedBy: `invalid authorities rule: ${problems.join("; ")}`,
+    evaluatedPolicies: policies
+  };
 }
 var AuthoritiesEngine = class {
   constructor(profiles, evaluators) {
@@ -10507,10 +10883,36 @@ var AuthoritiesEngine = class {
   }
   profiles;
   evaluators;
+  /** Problems found per rule object, so a rule is validated once however often it is evaluated. */
+  ruleProblems = /* @__PURE__ */ new WeakMap();
+  /**
+   * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}),
+   * and each profile name it uses that no registered profile has. The server reports them when it
+   * starts; {@link evaluate} denies such a value (an unknown profile as `profile '…' is not registered`).
+   */
+  findRuleProblems(authorities) {
+    const problems = findAuthoritiesRuleProblems(authorities);
+    if (problems.length > 0) return problems;
+    const names = typeof authorities === "string" ? [authorities] : Array.isArray(authorities) ? authorities : [];
+    return names.filter((name) => typeof name === "string" && !this.profiles.has(name)).map((name) => `names an unknown profile "${name}"`);
+  }
+  /**
+   * Problems with every registered profile's rule (see {@link findAuthoritiesRuleProblems}).
+   * The server reports them when it starts.
+   */
+  findProfileProblems() {
+    return Object.entries(this.profiles.getAll()).flatMap(
+      ([name, policy]) => findAuthoritiesProfileProblems(name, policy)
+    );
+  }
   /**
    * Evaluate an AuthoritiesMetadata value (string, string[], or policy object).
+   *
+   * A value that is malformed or checks nothing (see {@link findAuthoritiesRuleProblems}) is denied.
    */
   async evaluate(authorities, ctx) {
+    const problems = this.problemsOf(authorities, findAuthoritiesRuleProblems);
+    if (problems.length > 0) return invalidRule(problems);
     if (typeof authorities === "string") {
       return this.evaluateProfile(authorities, ctx);
     }
@@ -10531,6 +10933,8 @@ var AuthoritiesEngine = class {
         evaluatedPolicies: [`profile:${name}`]
       };
     }
+    const problems = this.problemsOf(policy, (rule) => findAuthoritiesProfileProblems(name, rule));
+    if (problems.length > 0) return invalidRule(problems, [`profile:${name}`]);
     const result = await this.evaluatePolicy(policy, ctx);
     if (!result.granted) {
       return {
@@ -10541,6 +10945,16 @@ var AuthoritiesEngine = class {
     }
     return mergeResult(result, { granted: true, evaluatedPolicies: [`profile:${name}`] });
   }
+  /** Validate a rule, reusing the result for a rule object seen before. */
+  problemsOf(rule, find) {
+    if (typeof rule !== "object" || rule === null) return find(rule);
+    let problems = this.ruleProblems.get(rule);
+    if (!problems) {
+      problems = find(rule);
+      this.ruleProblems.set(rule, problems);
+    }
+    return problems;
+  }
   /**
    * Evaluate an array of profile names (AND semantics).
    */
@@ -10589,7 +11003,7 @@ var AuthoritiesEngine = class {
       results.push(await this.evaluateNot(policy.not, ctx));
     }
     if (results.length === 0) {
-      return granted([]);
+      return invalidRule(["checks nothing"]);
     }
     return this.combineResults(results, operator);
   }
@@ -10640,14 +11054,15 @@ var AuthoritiesEngine = class {
   }
   /**
    * Evaluate async guard functions in sequence.
-   * Each guard returns true (granted) or a string (denial message).
+   * Only `true` grants. A string is the denial message; anything else (`false`, but also
+   * `undefined` from a guard that forgot to return, `null`, `0` or an object) denies.
    */
   async evaluateGuards(guards, ctx) {
     for (let i = 0; i < guards.length; i++) {
       const guard = guards[i];
       const result = await guard(ctx);
-      if (result === false || typeof result === "string") {
-        const denialMessage = typeof result === "string" ? result : `guard[${i}] denied`;
+      if (result !== true) {
+        const denialMessage = typeof result === "string" ? result : result === false ? `guard[${i}] denied` : `guard[${i}] did not return true (returned ${result === null ? "null" : typeof result})`;
         return {
           granted: false,
           deniedBy: `guards[${i}]: ${denialMessage}`,
@@ -10705,6 +11120,13 @@ var AuthoritiesEngine = class {
       evaluatedPolicies: ["not", ...result.evaluatedPolicies]
     };
   }
+  /**
+   * The policy a profile name stands for when `evaluate()` is given that name, or `undefined`
+   * when no such profile is registered. Lets callers inspect a named rule without evaluating it.
+   */
+  resolveProfile(name) {
+    return this.profiles.resolve(name);
+  }
 };
 
 // libs/auth/src/authorities/authorities.registry.ts
@@ -10949,6 +11371,7 @@ export {
   AuthoritiesProfileRegistry,
   AuthorityDeniedError,
   AuthorizationBase,
+  BUILT_IN_AUTH_PAGE_CSP,
   CDN,
   CREDENTIALS_ACCESSOR,
   CimdClientIdMismatchError,
@@ -10963,6 +11386,7 @@ export {
   CredentialProviderAlreadyRegisteredError,
   CredentialStorageError,
   CredentialsAccessorImpl,
+  DEFAULT_ALLOWED_SCOPES,
   DEFAULT_INCREMENTAL_TICKET_TTL_MS,
   DEFAULT_RESUME_TTL_MS,
   DEFAULT_THEME,
@@ -11001,6 +11425,9 @@ export {
   RedisAuthorizationStore,
   RedisSessionStore,
   SECURE_STORE_ACCESSOR,
+  SIGNIN_BINDING_COOKIE_PREFIX,
+  SIGNIN_BINDING_MAX_AGE_SECONDS,
+  SIGNIN_BINDING_SECURE_COOKIE_PREFIX,
   ScopeDeniedError,
   SecureStoreAccessorImpl,
   SessionCredentialVault,
@@ -11028,6 +11455,7 @@ export {
   abacConditionSchema,
   abacOperatorSchema,
   abacPolicySchema,
+  advertisedScopes,
   aiPlatformTypeSchema,
   allowsPublicAccess,
   apiKeyCredentialSchema,
@@ -11076,6 +11504,7 @@ export {
   buildToolConsentPage,
   buildUnauthorizedHeader,
   buildWwwAuthenticate,
+  builtInAuthPageHeaders,
   centeredCardLayout,
   checkSsrfProtection,
   cimdCacheConfigSchema,
@@ -11095,6 +11524,7 @@ export {
   createLayout,
   createSecureStore,
   createSessionCredentialVault,
+  createSigninBinding,
   createTokenStorageAdapter,
   credentialProviderConfigSchema,
   credentialSchema,
@@ -11102,7 +11532,7 @@ export {
   credentialTypeSchema,
   customCredentialSchema,
   decodeJwtPayloadSafe,
-  decryptAesGcm5 as decryptAesGcm,
+  decryptAesGcm6 as decryptAesGcm,
   decryptSessionJson,
   decryptValue2 as decryptValue,
   defaultSessionRateLimiter,
@@ -11112,7 +11542,7 @@ export {
   deriveTypedUser,
   detectAuthProviders,
   detectedAuthProviderSchema,
-  encryptAesGcm5 as encryptAesGcm,
+  encryptAesGcm6 as encryptAesGcm,
   encryptJson,
   encryptValue2 as encryptValue,
   encryptedBlobSchema,
@@ -11127,6 +11557,8 @@ export {
   federatedLoginStateSchema,
   federatedProviderItemSchema,
   federatedSelectionSchema,
+  findAuthoritiesProfileProblems,
+  findAuthoritiesRuleProblems,
   flatRemoteProviderFields,
   fromSessionRecord,
   generateAuthorizationCode,
@@ -11138,15 +11570,17 @@ export {
   getProviderApps,
   getProviderScopes,
   getTokenSignatureFingerprint,
+  grantScopes,
   hasOnlyLocalhostRedirectUris,
   headerApplier,
-  hkdfSha2564 as hkdfSha256,
+  hkdfSha2565 as hkdfSha256,
   incrementalAuthConfigSchema,
   isAnonymousSubject,
   isCimdClientId,
   isFrontMcpCredentials,
   isJwt,
   isLocalMode,
+  isLoopbackRedirectUri,
   isOrchestratedLocal,
   isOrchestratedMode,
   isOrchestratedRemote,
@@ -11176,6 +11610,7 @@ export {
   noopLogger,
   normalizeIssuer,
   oauthCredentialSchema,
+  openPendingLogin,
   orchestratedLocalSchema,
   orchestratedRemoteSchema,
   parseAuthOptions,
@@ -11203,6 +11638,7 @@ export {
   resolveRequiredScopes,
   resourceIdRefSchema,
   safeDecrypt,
+  sealPendingLogin,
   secureStoreConfigSchema,
   secureStoreCustomBackendSchema,
   secureStoreEncryptionSchema,
@@ -11213,6 +11649,8 @@ export {
   signCredentialResumeToken,
   signIncrementalAuthTicket,
   signSession,
+  signinBindingCookieName,
+  signinBindingMatches,
   skippedAppBehaviorSchema,
   sseTransportStateSchema,
   sshKeyCredentialSchema,
@@ -11245,5 +11683,6 @@ export {
   verifyOrParseSession,
   verifyPkce,
   verifySession,
-  wideLayout
+  wideLayout,
+  withoutSecretFieldValues
 };