@frontmcp/sdk 1.7.0 → 1.7.2

package/esm/index.mjs

@@ -1864,14 +1864,19 @@ var init_schema3 = __esm({
       socketPath: z8.string().optional(),
       /**
        * CORS configuration.
-       * - undefined (default): permissive CORS (all origins, no credentials)
-       * - false: CORS disabled
+       * - undefined (default): NO CORS headers — same-origin only. A browser will not let another
+       *   origin read the response. Set `{ origin: true }` for the old permissive behaviour.
+       * - false: CORS disabled (same effect as the default; kept for explicitness)
        * - CorsOptions object: custom CORS config
        */
       cors: z8.union([z8.literal(false), corsOptionsSchema]).optional(),
       /**
        * Security configuration for transport hardening.
-       * Opt-in — defaults remain backwards-compatible.
+       *
+       * The defaults are the SAFE choice: the server binds loopback and sends no CORS headers. Reaching
+       * it from another host or another origin is something you opt into — `bindAddress: 'all'`, the
+       * `FRONTMCP_BIND_ADDRESS=all` env var (no rebuild; the right fit for a Dockerfile), or a
+       * distributed build — and an explicit `cors` config.
        */
       security: z8.object({
         strict: z8.boolean().optional(),
@@ -2340,7 +2345,10 @@ var init_schema7 = __esm({
     });
     eventStoreConfigSchema = z12.object({
       enabled: z12.boolean().default(false),
-      provider: z12.enum(["memory", "redis"]).optional().default("memory"),
+      // 'sqlite' is supported by createEventStore and the TS interface but was
+      // missing from this enum, so a valid `provider: 'sqlite'` config failed
+      // validation.
+      provider: z12.enum(["memory", "redis", "sqlite"]).optional().default("memory"),
       maxEvents: z12.number().int().positive().optional().default(1e4),
       ttlMs: z12.number().int().positive().optional().default(3e5),
       redis: redisOptionsSchema.optional()
@@ -4076,7 +4084,7 @@ function formatToolsForPlatform(tools, platform) {
         })
       );
     case "vercel-ai": {
-      const result = {};
+      const result = /* @__PURE__ */ Object.create(null);
       for (const tool of tools) {
         result[tool.name] = {
           description: tool.description ?? `Execute ${tool.name}`,
@@ -5631,6 +5639,32 @@ var init_sdk_errors = __esm({
   }
 });
 
+// libs/sdk/src/errors/job.errors.ts
+var JobNotAuthorizedError, DynamicJobRegistrationDisabledError;
+var init_job_errors = __esm({
+  "libs/sdk/src/errors/job.errors.ts"() {
+    "use strict";
+    init_mcp_error();
+    JobNotAuthorizedError = class extends PublicMcpError {
+      /** The requested name, for internal logs only — never surfaced publicly. */
+      requestedName;
+      constructor(requestedName) {
+        super(`Job or workflow "${requestedName}" not found or not permitted`, "JOB_NOT_AUTHORIZED", 403);
+        this.requestedName = requestedName;
+      }
+    };
+    DynamicJobRegistrationDisabledError = class extends PublicMcpError {
+      constructor(kind = "job") {
+        super(
+          `Dynamic ${kind} registration is disabled. Enable it with jobs: { allowDynamicRegistration: true }.`,
+          "DYNAMIC_REGISTRATION_DISABLED",
+          403
+        );
+      }
+    };
+  }
+});
+
 // libs/sdk/src/errors/index.ts
 var errors_exports = {};
 __export(errors_exports, {
@@ -5656,6 +5690,7 @@ __export(errors_exports, {
   DependencyNotFoundError: () => DependencyNotFoundError,
   DynamicAdapterNameError: () => DynamicAdapterNameError,
   DynamicJobDirectExecutionError: () => DynamicJobDirectExecutionError,
+  DynamicJobRegistrationDisabledError: () => DynamicJobRegistrationDisabledError,
   ElicitationDisabledError: () => ElicitationDisabledError,
   ElicitationEncryptionError: () => ElicitationEncryptionError,
   ElicitationFallbackRequired: () => ElicitationFallbackRequired,
@@ -5704,6 +5739,7 @@ __export(errors_exports, {
   InvalidUseFactoryError: () => InvalidUseFactoryError,
   InvalidUseValueError: () => InvalidUseValueError,
   InvokeStateMissingKeyError: () => InvokeStateMissingKeyError,
+  JobNotAuthorizedError: () => JobNotAuthorizedError,
   MCP_ERROR_CODES: () => MCP_ERROR_CODES,
   McpError: () => McpError,
   MethodNotImplementedError: () => MethodNotImplementedError,
@@ -5826,6 +5862,7 @@ var init_errors = __esm({
     init_workflow_errors();
     init_esm_errors();
     init_sdk_errors();
+    init_job_errors();
   }
 });
 
@@ -7153,6 +7190,10 @@ var require_dist = __commonJS({
         }
         return id;
       }
+      async getStreamIdForEventId(eventId) {
+        const row = this.prepared().getStreamId.get(eventId);
+        return row?.stream_id;
+      }
       async replayEventsAfter(lastEventId, { send }) {
         const stmts = this.prepared();
         const streamRow = stmts.getStreamId.get(lastEventId);
@@ -14068,26 +14109,44 @@ async function loadYamlConfig(basePath, configPath) {
   }
   return {};
 }
+function stripUnsafeKeys(value) {
+  if (Array.isArray(value)) return value.map(stripUnsafeKeys);
+  if (!isPlainObject(value)) return value;
+  const clean = {};
+  for (const [key, nested] of Object.entries(value)) {
+    if (UNSAFE_MERGE_KEYS.has(key)) continue;
+    clean[key] = stripUnsafeKeys(nested);
+  }
+  return clean;
+}
+function isPlainObject(value) {
+  if (!value || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
 function deepMerge(target, source) {
   const result = { ...target };
   for (const key in source) {
+    if (UNSAFE_MERGE_KEYS.has(key)) continue;
     const sourceVal = source[key];
     const targetVal = result[key];
     if (sourceVal !== void 0 && sourceVal !== null) {
       if (typeof sourceVal === "object" && !Array.isArray(sourceVal) && typeof targetVal === "object" && !Array.isArray(targetVal) && targetVal !== null) {
         result[key] = deepMerge(targetVal, sourceVal);
       } else {
-        result[key] = sourceVal;
+        result[key] = stripUnsafeKeys(sourceVal);
       }
     }
   }
   return result;
 }
+var UNSAFE_MERGE_KEYS;
 var init_config_loader = __esm({
   "libs/sdk/src/builtin/config/providers/config-loader.ts"() {
     "use strict";
     init_config_service();
     init_env_loader();
+    UNSAFE_MERGE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
   }
 });
 
@@ -20741,6 +20800,7 @@ var init_tool_credentials_gate = __esm({
 });
 
 // libs/sdk/src/tool/flows/call-tool.flow.ts
+import { signIncrementalAuthTicket } from "@frontmcp/auth";
 import { ConcurrencyLimitError, ExecutionTimeoutError, withTimeout } from "@frontmcp/guard";
 import { z as z56 } from "@frontmcp/lazy-zod";
 import { CallToolRequestSchema as CallToolRequestSchema2, CallToolResultSchema as CallToolResultSchema2 } from "@frontmcp/protocol";
@@ -21129,7 +21189,7 @@ var init_call_tool_flow = __esm({
             this.logger.verbose(`checkToolAuthorization: using anonymous for ${appId}`);
             return;
           }
-          const authUrl = this.buildProgressiveAuthUrl(appId, tool?.fullName || "");
+          const authUrl = this.buildProgressiveAuthUrl(appId, tool?.fullName || "", authInfo, claimAuthorizedApps);
           this.logger.info(`checkToolAuthorization: authorization required for app "${appId}"`);
           throw new AuthorizationRequiredError({
             appId,
@@ -21141,11 +21201,51 @@ var init_call_tool_flow = __esm({
         this.logger.verbose("checkToolAuthorization:done");
       }
       /**
-       * Build the URL for progressive/incremental authorization
+       * Build the URL for progressive/incremental authorization.
+       *
+       * This is the ONE point in the request lifecycle where the caller's identity
+       * is both known and verified, so it is where the incremental-authorization
+       * ticket is minted (GHSA-2c4g-9c8x-6m8g). The ticket is what later authorizes
+       * `/oauth/authorize` to skip the login step; `app`/`tool` are carried purely
+       * for display and are re-read from the signed payload server-side.
+       *
+       * When no verified subject or signing secret is available the URL is emitted
+       * WITHOUT a ticket — the user then completes an ordinary login, which is the
+       * correct fail-closed outcome rather than a credential-free shortcut.
        */
-      buildProgressiveAuthUrl(appId, toolId) {
+      buildProgressiveAuthUrl(appId, toolId, authInfo, priorAppIds) {
         const baseUrl = this.scope.fullPath || "";
-        return `${baseUrl}/oauth/authorize?app=${encodeURIComponent(appId)}&tool=${encodeURIComponent(toolId)}`;
+        const url = new URL(`${baseUrl}/oauth/authorize`, "http://placeholder.invalid");
+        url.searchParams.set("app", appId);
+        url.searchParams.set("tool", toolId);
+        const ticket = this.mintIncrementalTicket(appId, toolId, authInfo, priorAppIds);
+        if (ticket) {
+          url.searchParams.set("ticket", ticket);
+        } else {
+          this.logger.verbose("buildProgressiveAuthUrl: no incremental ticket minted \u2014 link requires a full login");
+        }
+        return baseUrl.startsWith("http") ? url.toString() : `${url.pathname}${url.search}`;
+      }
+      /**
+       * Mint a single-use, short-lived incremental-authorization ticket for the
+       * verified caller. Returns undefined when the scope has no local signing
+       * secret or the request has no verified subject.
+       */
+      mintIncrementalTicket(appId, toolId, authInfo, priorAppIds) {
+        const extraUser = authInfo?.extra?.user;
+        const sub = extraUser?.sub ?? authInfo?.user?.sub;
+        if (!sub) return void 0;
+        const secret = this.scope.auth?.signingSecret;
+        if (!secret) return void 0;
+        return signIncrementalAuthTicket(
+          {
+            sub,
+            appId,
+            toolId,
+            ...priorAppIds && priorAppIds.size > 0 ? { priorAppIds: [...priorAppIds] } : {}
+          },
+          secret
+        );
       }
       async checkEntryAuthorities() {
         this.logger.verbose("checkEntryAuthorities:start");
@@ -35891,7 +35991,8 @@ import {
   createFederatedAuthSession,
   escapeHtml as escapeHtml2,
   renderLocalLoginPage,
-  startNextProvider
+  startNextProvider,
+  verifyIncrementalAuthTicket
 } from "@frontmcp/auth";
 import { z as z64 } from "@frontmcp/lazy-zod";
 import { generateCodeVerifier, randomUUID as randomUUID15, sha256Base64url } from "@frontmcp/utils";
@@ -35966,6 +36067,13 @@ var init_oauth_authorize_flow = __esm({
       targetAppId: z64.string().optional().describe("Target app ID for incremental authorization"),
       targetToolId: z64.string().optional().describe("Target tool ID that triggered the incremental auth"),
       existingSessionId: z64.string().optional().describe("Existing session ID for incremental auth"),
+      /**
+       * The VERIFIED incremental-authorization ticket (GHSA-2c4g-9c8x-6m8g). Set
+       * only when `?ticket=` carried a valid, unexpired server signature. Its `sub`
+       * is the proven identity the expanded grant is minted for; `isIncrementalAuth`
+       * is derived from its presence, never from a raw query parameter.
+       */
+      incrementalTicket: z64.custom().optional(),
       /**
        * Apps the client already holds a grant for (the prior `authorized_apps`
        * claim), carried forward on an incremental authorize so the newly-minted
@@ -36018,18 +36126,21 @@ var init_oauth_authorize_flow = __esm({
         const { request } = this.rawInput;
         const rawRedirectUri = request.query["redirect_uri"];
         const rawState = request.query["state"];
-        const targetAppId = request.query["app"];
-        const targetToolId = request.query["tool"];
-        const existingSessionId = request.query["session_id"];
-        const mode = request.query["mode"];
-        const isIncrementalAuth = mode === "incremental" || !!targetAppId;
-        const appsParam = request.query["apps"];
+        const incrementalTicket = this.verifyIncrementalTicket(request.query["ticket"]);
+        const isIncrementalAuth = incrementalTicket !== void 0;
+        const targetAppId = incrementalTicket?.appId;
+        const targetToolId = incrementalTicket?.toolId;
         let priorAuthorizedAppIds;
-        if (appsParam) {
-          const raw = Array.isArray(appsParam) ? appsParam : [appsParam];
-          const ids = raw.flatMap((v) => String(v).split(",")).map((s) => s.trim()).filter(Boolean);
-          priorAuthorizedAppIds = ids.length > 0 ? Array.from(new Set(ids)) : void 0;
+        if (incrementalTicket) {
+          priorAuthorizedAppIds = incrementalTicket.priorAppIds && incrementalTicket.priorAppIds.length > 0 ? Array.from(new Set(incrementalTicket.priorAppIds)) : void 0;
+        } else {
+          const appsParam = request.query["apps"];
+          if (appsParam) {
+            const ids = (Array.isArray(appsParam) ? appsParam : [appsParam]).flatMap((v) => String(v).split(",")).map((v) => v.trim()).filter(Boolean);
+            priorAuthorizedAppIds = ids.length > 0 ? Array.from(new Set(ids)) : void 0;
+          }
         }
+        const existingSessionId = request.query["session_id"];
         const isDefaultAuthProvider = !metadata.auth;
         let requiresFederatedLogin = false;
         if (metadata.auth && isOrchestratedMode(metadata.auth)) {
@@ -36055,6 +36166,7 @@ var init_oauth_authorize_flow = __esm({
           targetToolId,
           existingSessionId,
           priorAuthorizedAppIds,
+          incrementalTicket,
           // Federated Login
           requiresFederatedLogin,
           // Consent Flow
@@ -36180,6 +36292,28 @@ var init_oauth_authorize_flow = __esm({
           }
         }
       }
+      /**
+       * Verify a client-supplied incremental-authorization ticket.
+       *
+       * Returns the verified payload, or `undefined` when the parameter is absent,
+       * malformed, expired, or not signed by this server. Verification is
+       * side-effect free — the ticket is CLAIMED (single use) later, in
+       * {@link prepareAuthorizationRequest}, so a request that fails OAuth
+       * validation does not burn the user's ticket.
+       */
+      verifyIncrementalTicket(raw) {
+        const token = typeof raw === "string" ? raw : Array.isArray(raw) ? raw[0] : void 0;
+        if (typeof token !== "string" || token.length === 0) return void 0;
+        const localAuth = this.scope.auth;
+        const secret = localAuth?.signingSecret;
+        if (!secret) return void 0;
+        const payload = verifyIncrementalAuthTicket(token, secret);
+        if (!payload) {
+          this.logger.warn("Incremental auth ticket failed verification \u2014 treating as an ordinary login");
+          return void 0;
+        }
+        return payload;
+      }
       async checkIfAuthorized() {
       }
       async prepareAuthorizationRequest() {
@@ -36191,7 +36325,8 @@ var init_oauth_authorize_flow = __esm({
           existingSessionId,
           priorAuthorizedAppIds,
           requiresFederatedLogin,
-          requiresConsent
+          requiresConsent,
+          incrementalTicket
         } = this.state;
         const { metadata } = this.scope;
         if (!validatedRequest) {
@@ -36204,6 +36339,18 @@ var init_oauth_authorize_flow = __esm({
         }
         const localAuth = auth;
         const store = localAuth.authorizationStore;
+        let effectiveIncremental = isIncrementalAuth;
+        if (incrementalTicket) {
+          const claimed = await localAuth.claimIncrementalTicket(
+            incrementalTicket.jti,
+            Math.max(0, incrementalTicket.exp - Date.now())
+          );
+          if (!claimed) {
+            this.logger.warn("Incremental auth ticket already used \u2014 falling back to an ordinary login");
+            effectiveIncremental = false;
+            this.state.set({ isIncrementalAuth: false, targetAppId: void 0, targetToolId: void 0 });
+          }
+        }
         let federatedLogin;
         if (requiresFederatedLogin) {
           const apps = this.scope.apps.getApps();
@@ -36251,10 +36398,14 @@ var init_oauth_authorize_flow = __esm({
           },
           state: validatedRequest.state,
           resource: validatedRequest.resource,
-          // Progressive/Incremental Authorization Fields
-          isIncremental: isIncrementalAuth,
-          targetAppId,
-          targetToolId,
+          // Progressive/Incremental Authorization Fields. `isIncremental` reflects a
+          // CLAIMED, server-signed ticket; `incrementalSub` is the identity that
+          // ticket proved, and is the only subject the callback may mint for when
+          // it skips the credential gate.
+          isIncremental: effectiveIncremental,
+          incrementalSub: effectiveIncremental ? incrementalTicket?.sub : void 0,
+          targetAppId: effectiveIncremental ? targetAppId : void 0,
+          targetToolId: effectiveIncremental ? targetToolId : void 0,
           existingSessionId,
           priorAuthorizedAppIds,
           // Federated Login State
@@ -36264,7 +36415,7 @@ var init_oauth_authorize_flow = __esm({
         });
         await localAuth.authorizationStore.storePendingAuthorization(pendingRecord);
         this.logger.info(
-          `Pending authorization created: ${pendingRecord.id}${isIncrementalAuth ? ` (incremental for app: ${targetAppId})` : ""}${requiresFederatedLogin ? " (federated)" : ""}${requiresConsent ? " (consent enabled)" : ""}`
+          `Pending authorization created: ${pendingRecord.id}${effectiveIncremental ? ` (incremental for app: ${targetAppId})` : ""}${requiresFederatedLogin ? " (federated)" : ""}${requiresConsent ? " (consent enabled)" : ""}`
         );
         this.state.set("pendingAuthId", pendingRecord.id);
       }
@@ -36831,8 +36982,6 @@ var init_oauth_callback_flow = __esm({
         const email = request.query["email"];
         const name42 = request.query["name"];
         const loginFields = this.collectLoginFields(request);
-        const isIncremental = request.query["incremental"] === "true";
-        const targetAppId = request.query["app_id"];
         const isFederated = request.query["federated"] === "true";
         const providersParam = request.query["providers"];
         let selectedProviders;
@@ -36851,8 +37000,6 @@ var init_oauth_callback_flow = __esm({
           pendingAuthId,
           email,
           name: name42,
-          isIncremental,
-          targetAppId,
           isFederated,
           selectedProviders,
           selectedTools,
@@ -36860,9 +37007,6 @@ var init_oauth_callback_flow = __esm({
           loginFields,
           csrf
         });
-        if (isIncremental) {
-          this.logger.info(`Incremental auth callback for app: ${targetAppId}`);
-        }
         if (isFederated) {
           this.logger.info(`Federated login callback with ${selectedProviders?.length || 0} selected providers`);
         }
@@ -36871,31 +37015,13 @@ var init_oauth_callback_flow = __esm({
         }
       }
       async validatePendingAuth() {
-        const {
-          pendingAuthId,
-          email,
-          name: name42,
-          isIncremental,
-          isFederated,
-          selectedProviders,
-          selectedTools,
-          consentSubmitted,
-          loginFields
-        } = this.state;
+        const { pendingAuthId, email, name: name42, isFederated, selectedProviders, selectedTools, consentSubmitted, loginFields } = this.state;
         if (!pendingAuthId) {
           this.logger.warn("Missing pending_auth_id in callback");
           this.respond(httpRespond.html(this.renderErrorPage("invalid_request", "Missing pending_auth_id parameter"), 400));
           return;
         }
         const localAuth = this.scope.auth;
-        const localOptions = localAuth.options;
-        const authenticateFn = typeof localOptions.authenticate === "function" ? localOptions.authenticate : void 0;
-        const requireEmail = localOptions.requireEmail ?? true;
-        if (!authenticateFn && !isIncremental && !email && requireEmail) {
-          this.logger.warn("Missing email in callback");
-          this.respond(httpRespond.html(this.renderErrorPage("invalid_request", "Email is required"), 400));
-          return;
-        }
         const pendingAuth = await localAuth.authorizationStore.getPendingAuthorization(pendingAuthId);
         if (!pendingAuth) {
           this.logger.warn(`Pending authorization not found or expired: ${pendingAuthId}`);
@@ -36907,6 +37033,20 @@ var init_oauth_callback_flow = __esm({
           );
           return;
         }
+        const isIncremental = pendingAuth.isIncremental === true && typeof pendingAuth.incrementalSub === "string";
+        const targetAppId = isIncremental ? pendingAuth.targetAppId : void 0;
+        this.state.set({ isIncremental, targetAppId });
+        if (isIncremental) {
+          this.logger.info(`Incremental auth callback for app: ${targetAppId}`);
+        }
+        const localOptions = localAuth.options;
+        const authenticateFn = typeof localOptions.authenticate === "function" ? localOptions.authenticate : void 0;
+        const requireEmail = localOptions.requireEmail ?? true;
+        if (!authenticateFn && !isIncremental && !email && requireEmail) {
+          this.logger.warn("Missing email in callback");
+          this.respond(httpRespond.html(this.renderErrorPage("invalid_request", "Email is required"), 400));
+          return;
+        }
         if (pendingAuth.authUiCsrf) {
           const submitted = this.state.csrf;
           if (!submitted || !timingSafeEqualStr3(pendingAuth.authUiCsrf, submitted)) {
@@ -36921,9 +37061,11 @@ var init_oauth_callback_flow = __esm({
           return;
         }
         let userSub;
-        if (email) {
+        if (isIncremental) {
+          userSub = pendingAuth.incrementalSub;
+        } else if (email) {
           userSub = this.generateUserSub(email);
-        } else if (!requireEmail || isIncremental) {
+        } else if (!requireEmail) {
           const anonymousSubject = localOptions.anonymousSubject ?? "local-operator";
           userSub = this.generateUserSub(anonymousSubject);
         } else {
@@ -37092,10 +37234,13 @@ var init_oauth_callback_flow = __esm({
           originalState: pendingAuth.state,
           resource: pendingAuth.resource,
           userSub,
-          // Progressive/Incremental Authorization from pending record
-          isIncremental: pendingAuth.isIncremental || isIncremental,
-          targetAppId: pendingAuth.targetAppId || this.state.targetAppId,
-          targetToolId: pendingAuth.targetToolId,
+          // Progressive/Incremental Authorization — from the pending record ONLY.
+          // `isIncremental` was derived above from the record plus its proven
+          // subject; OR-ing a client-supplied flag in here is what let a caller
+          // override the server's `false` (GHSA-2c4g-9c8x-6m8g).
+          isIncremental,
+          targetAppId,
+          targetToolId: isIncremental ? pendingAuth.targetToolId : void 0,
           existingSessionId: pendingAuth.existingSessionId,
           existingAuthorizationId: pendingAuth.existingAuthorizationId,
           priorAuthorizedAppIds: pendingAuth.priorAuthorizedAppIds,
@@ -37699,6 +37844,7 @@ var init_oauth_callback_flow = __esm({
       "pending_auth_id",
       "incremental",
       "app_id",
+      "ticket",
       "federated",
       "providers",
       "tools",
@@ -40256,7 +40402,8 @@ import {
   MemoryStorageAdapter,
   randomBytes as randomBytes6,
   randomUUID as randomUUID21,
-  sha256Hex as sha256Hex9
+  sha256Hex as sha256Hex9,
+  StorageNotSupportedError
 } from "@frontmcp/utils";
 function getDefaultNoAuthSecret() {
   if (!defaultNoAuthSecret) {
@@ -40278,6 +40425,9 @@ function validateAuthorizationIssuer(received, expected) {
   }
   return { ok: true };
 }
+function isUnsupportedOperation(error) {
+  return error instanceof StorageNotSupportedError;
+}
 var defaultNoAuthSecret, RESERVED_JWT_CLAIMS, LocalPrimaryAuth;
 var init_instance_local_primary_auth = __esm({
   "libs/sdk/src/auth/instances/instance.local-primary-auth.ts"() {
@@ -40389,6 +40539,17 @@ var init_instance_local_primary_auth = __esm({
       dcrClientRegistryImpl;
       /** Storage adapter backing the persistent stores (kept for disposal). */
       storageAdapter;
+      /**
+       * Replay guard for incremental-authorization tickets (GHSA-2c4g-9c8x-6m8g).
+       * Shares the persistent adapter when one is configured so the guard holds
+       * across a distributed deployment; falls back to a dedicated in-memory
+       * adapter, matching how the credential vault selects its backing store.
+       *
+       * Holds the in-flight PROMISE, not the resolved adapter: two concurrent
+       * claims for the same ticket must not each build their own store, or each
+       * would write and read back its own nonce and both would win.
+       */
+      ticketReplayStorage;
       /**
        * Per-session encrypted credential vault (Checkpoint 3b). Backs
        * `this.credentials` in tools and persists `authenticate()` credentials.
@@ -40556,6 +40717,81 @@ var init_instance_local_primary_auth = __esm({
        * (`this.secret`), so resume URLs are framework-signed with the same trust
        * root as the access tokens.
        */
+      /**
+       * The server HMAC signing key, as the string form the `signData`/`verifyData`
+       * helpers take. These are the exact bytes the access tokens are signed with,
+       * so framework-signed URLs share the access tokens' trust root.
+       */
+      get signingSecret() {
+        return new TextDecoder().decode(this.secret);
+      }
+      /**
+       * Claim an incremental-authorization ticket, exactly once.
+       *
+       * A signature check proves a ticket was minted by this server for a verified
+       * subject; it cannot prove the ticket has not already been used. The `auth_url`
+       * carrying the ticket travels through agent transcripts and server logs, so a
+       * leaked ticket must not stay usable for the rest of its TTL.
+       *
+       * The claim is race-free without a transaction: each attempt writes its OWN
+       * nonce under `ifNotExists` and reads the key back. Only the attempt whose
+       * nonce survives won, so concurrent replays all lose.
+       *
+       * @returns true when this caller claimed the ticket, false when it was already used.
+       */
+      async claimIncrementalTicket(jti, ttlMs) {
+        const key = `incremental-ticket:${jti}`;
+        const nonce = randomUUID21();
+        const ttlSeconds = Math.max(1, Math.ceil(ttlMs / 1e3));
+        let storage = await this.getTicketReplayStorage();
+        try {
+          await storage.set(key, nonce, { ifNotExists: true, ttlSeconds });
+        } catch (error) {
+          if (!isUnsupportedOperation(error)) {
+            this.logger.warn(`Incremental ticket replay guard unavailable: ${String(error)}`);
+            return false;
+          }
+          this.logger.warn(
+            "Incremental ticket replay guard: the configured storage has no conditional write; falling back to an in-memory guard (single use holds within this instance only)."
+          );
+          storage = await this.useInMemoryTicketReplayStorage();
+          try {
+            await storage.set(key, nonce, { ifNotExists: true, ttlSeconds });
+          } catch (fallbackError) {
+            this.logger.warn(`Incremental ticket replay guard unavailable: ${String(fallbackError)}`);
+            return false;
+          }
+        }
+        try {
+          return await storage.get(key) === nonce;
+        } catch (error) {
+          this.logger.warn(`Incremental ticket replay guard unavailable: ${String(error)}`);
+          return false;
+        }
+      }
+      getTicketReplayStorage() {
+        if (!this.ticketReplayStorage) {
+          if (this.storageAdapter) {
+            this.ticketReplayStorage = Promise.resolve(this.storageAdapter);
+          } else {
+            this.logger.debug(
+              "Incremental ticket replay guard is in-memory (no persistent tokenStorage configured); single use holds within this instance only."
+            );
+            this.ticketReplayStorage = this.useInMemoryTicketReplayStorage();
+          }
+        }
+        return this.ticketReplayStorage;
+      }
+      /** Replace the replay guard with a fresh in-memory adapter, memoized. */
+      useInMemoryTicketReplayStorage() {
+        const pending = (async () => {
+          const memory = new MemoryStorageAdapter();
+          await memory.connect();
+          return memory;
+        })();
+        this.ticketReplayStorage = pending;
+        return pending;
+      }
       async initializeCredentialVault() {
         if (isPublicMode(this.options)) {
           return;
@@ -40574,7 +40810,7 @@ var init_instance_local_primary_auth = __esm({
           pepper,
           logger: this.logger.child("SessionCredentialVault")
         });
-        const signingSecret = new TextDecoder().decode(this.secret);
+        const signingSecret = this.signingSecret;
         const basePath = this.issuer;
         await this.providers.addDynamicProviders(
           createCredentialsProviders({
@@ -44879,6 +45115,7 @@ var init_execute_workflow_tool = __esm({
   "libs/sdk/src/workflow/tools/execute-workflow.tool.ts"() {
     "use strict";
     init_common();
+    init_errors();
     ExecuteWorkflowTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -44890,12 +45127,13 @@ var init_execute_workflow_tool = __esm({
         }
         const workflow = workflowRegistry.findByName(input.name);
         if (!workflow) {
-          return this.fail(new Error(`Workflow "${input.name}" not found`));
+          return this.fail(new JobNotAuthorizedError(input.name));
         }
         const result = await executionManager.executeWorkflow(workflow, jobRegistry, {
           background: input.background,
           sessionId: this.authInfo.sessionId,
           authInfo: this.authInfo,
+          authoritiesContextBuilder: this.scope.authoritiesContextBuilder,
           workflowInput: input.input
         });
         return result;
@@ -44920,6 +45158,55 @@ var init_execute_workflow_tool = __esm({
   }
 });
 
+// libs/sdk/src/common/utils/principal.utils.ts
+function toStringArray(value) {
+  if (Array.isArray(value)) return value.filter((v) => typeof v === "string");
+  if (typeof value === "string" && value.length > 0) return value.split(" ").filter(Boolean);
+  return [];
+}
+function asRecord(value) {
+  return value && typeof value === "object" ? value : void 0;
+}
+function firstPresent(sources, convert) {
+  for (const source of sources) {
+    if (source !== void 0 && source !== null) return convert(source);
+  }
+  return [];
+}
+function resolvePrincipal2(authInfo, contextBuilder) {
+  const info = authInfo ?? {};
+  const user = asRecord(info["user"]) ?? {};
+  const extraAuthorization = asRecord(asRecord(info["extra"])?.["authorization"]);
+  const authInfoClaims = asRecord(info["claims"]) ?? {};
+  const authorizationClaims = asRecord(extraAuthorization?.["claims"]) ?? {};
+  const claims = { ...authorizationClaims, ...authInfoClaims, ...user };
+  const scopes = toStringArray(info["scopes"]).length ? toStringArray(info["scopes"]) : firstPresent([extraAuthorization?.["scopes"], claims["scope"], claims["scopes"]], toStringArray);
+  if (contextBuilder) {
+    const ctx = contextBuilder.build(info);
+    return {
+      sub: ctx.user.sub,
+      roles: ctx.user.roles,
+      permissions: ctx.user.permissions,
+      scopes,
+      claims: ctx.user.claims
+    };
+  }
+  const roles = firstPresent([user["roles"], claims["roles"], extraAuthorization?.["scopes"]], toStringArray);
+  const permissions = firstPresent([user["permissions"], claims["permissions"]], toStringArray);
+  return {
+    sub: typeof user["sub"] === "string" ? user["sub"] : "",
+    roles,
+    permissions,
+    scopes,
+    claims
+  };
+}
+var init_principal_utils = __esm({
+  "libs/sdk/src/common/utils/principal.utils.ts"() {
+    "use strict";
+  }
+});
+
 // libs/sdk/src/workflow/tools/get-workflow-status.tool.ts
 import { z as z82 } from "@frontmcp/lazy-zod";
 var GetWorkflowStatusTool;
@@ -44927,6 +45214,7 @@ var init_get_workflow_status_tool = __esm({
   "libs/sdk/src/workflow/tools/get-workflow-status.tool.ts"() {
     "use strict";
     init_common();
+    init_principal_utils();
     GetWorkflowStatusTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -44935,7 +45223,7 @@ var init_get_workflow_status_tool = __esm({
           return this.fail(new Error("Jobs system is not enabled"));
         }
         const record = await executionManager.getStatus(input.runId);
-        if (!record) {
+        if (!record || !this.ownsRun(record)) {
           return this.fail(new Error(`Run "${input.runId}" not found`));
         }
         const workflowRecord = record;
@@ -44948,6 +45236,23 @@ var init_get_workflow_status_tool = __esm({
           completedAt: record.completedAt
         };
       }
+      /**
+       * Match on the owning subject, falling back to the session for runs started
+       * before an owner was recorded (and for anonymous/public servers, where every
+       * caller has an empty subject and the session is the only identity there is).
+       *
+       * A record carrying NEITHER identity is refused. Such a run cannot be
+       * attributed to anyone, and its inputs and results are exactly what this check
+       * exists to protect — anyone holding the id would otherwise be able to read
+       * it. Internal callers that must read unattributed runs should go through the
+       * execution manager directly rather than this tool.
+       */
+      ownsRun(record) {
+        const callerSub = resolvePrincipal2(this.authInfo, this.scope.authoritiesContextBuilder).sub;
+        if (record.ownerSub) return record.ownerSub === callerSub;
+        if (record.sessionId) return record.sessionId === this.authInfo.sessionId;
+        return false;
+      }
     };
     GetWorkflowStatusTool = __decorateClass([
       FrontMcpTool({
@@ -44975,6 +45280,53 @@ var init_get_workflow_status_tool = __esm({
   }
 });
 
+// libs/sdk/src/job/job-permission.guard.ts
+var JobPermissionGuard;
+var init_job_permission_guard = __esm({
+  "libs/sdk/src/job/job-permission.guard.ts"() {
+    "use strict";
+    init_principal_utils();
+    JobPermissionGuard = class _JobPermissionGuard {
+      /**
+       * Check whether the caller may perform `action`.
+       *
+       * @param permissions - the entry's declared rules (undefined = unrestricted).
+       * @param action - the action being attempted.
+       * @param authInfo - the request's AuthInfo.
+       * @param contextBuilder - the scope's authorities context builder, when configured.
+       */
+      static async check(permissions, action, authInfo, contextBuilder) {
+        if (!permissions || permissions.length === 0) {
+          return true;
+        }
+        const relevant = permissions.filter((p) => p.action === action);
+        if (relevant.length === 0) {
+          return true;
+        }
+        const principal = resolvePrincipal2(authInfo, contextBuilder);
+        for (const perm of relevant) {
+          const passed = await _JobPermissionGuard.checkSingle(perm, principal, authInfo);
+          if (!passed) return false;
+        }
+        return true;
+      }
+      static async checkSingle(perm, principal, authInfo) {
+        if (perm.roles && perm.roles.length > 0) {
+          if (!perm.roles.some((role) => principal.roles.includes(role))) return false;
+        }
+        if (perm.scopes && perm.scopes.length > 0) {
+          if (!perm.scopes.some((scope) => principal.scopes.includes(scope))) return false;
+        }
+        if (perm.custom) {
+          const result = await perm.custom(authInfo ?? {});
+          if (!result) return false;
+        }
+        return true;
+      }
+    };
+  }
+});
+
 // libs/sdk/src/workflow/tools/list-workflows.tool.ts
 import { z as z83 } from "@frontmcp/lazy-zod";
 var ListWorkflowsTool;
@@ -44982,6 +45334,7 @@ var init_list_workflows_tool = __esm({
   "libs/sdk/src/workflow/tools/list-workflows.tool.ts"() {
     "use strict";
     init_common();
+    init_job_permission_guard();
     ListWorkflowsTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -44993,7 +45346,11 @@ var init_list_workflows_tool = __esm({
           tags: input.tags,
           labels: input.labels
         });
-        const mapped = workflows.map((w) => ({
+        const visible = [];
+        for (const workflow of workflows) {
+          if (await this.maySee(workflow)) visible.push(workflow);
+        }
+        const mapped = visible.map((w) => ({
           name: w.name,
           description: w.metadata.description,
           trigger: w.getTrigger(),
@@ -45005,6 +45362,12 @@ var init_list_workflows_tool = __esm({
           count: mapped.length
         };
       }
+      async maySee(workflow) {
+        const permissions = workflow.metadata.permissions;
+        const builder = this.scope.authoritiesContextBuilder;
+        if (!await JobPermissionGuard.check(permissions, "list", this.authInfo, builder)) return false;
+        return JobPermissionGuard.check(permissions, "execute", this.authInfo, builder);
+      }
     };
     ListWorkflowsTool = __decorateClass([
       FrontMcpTool({
@@ -45040,6 +45403,7 @@ var init_register_workflow_tool = __esm({
   "libs/sdk/src/workflow/tools/register-workflow.tool.ts"() {
     "use strict";
     init_common();
+    init_errors();
     RegisterWorkflowTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -45047,6 +45411,9 @@ var init_register_workflow_tool = __esm({
         if (!workflowRegistry) {
           return this.fail(new Error("Workflows system is not enabled"));
         }
+        if (!this.dynamicRegistrationEnabled()) {
+          return this.fail(new DynamicJobRegistrationDisabledError("workflow"));
+        }
         const existing = workflowRegistry.findByName(input.name);
         if (existing) {
           return this.fail(new Error(`Workflow "${input.name}" already exists`));
@@ -45068,6 +45435,10 @@ var init_register_workflow_tool = __esm({
         });
         return { success: true, workflowId };
       }
+      dynamicRegistrationEnabled() {
+        const jobs = this.scope.metadata?.jobs;
+        return jobs?.allowDynamicRegistration === true;
+      }
     };
     RegisterWorkflowTool = __decorateClass([
       FrontMcpTool({
@@ -45106,6 +45477,8 @@ var init_remove_workflow_tool = __esm({
   "libs/sdk/src/workflow/tools/remove-workflow.tool.ts"() {
     "use strict";
     init_common();
+    init_errors();
+    init_job_permission_guard();
     RemoveWorkflowTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -45115,7 +45488,16 @@ var init_remove_workflow_tool = __esm({
         }
         const workflow = workflowRegistry.findByName(input.name);
         if (!workflow) {
-          return this.fail(new Error(`Workflow "${input.name}" not found`));
+          return this.fail(new JobNotAuthorizedError(input.name));
+        }
+        const allowed = await JobPermissionGuard.check(
+          workflow.metadata.permissions,
+          "delete",
+          this.authInfo,
+          this.scope.authoritiesContextBuilder
+        );
+        if (!allowed) {
+          return this.fail(new JobNotAuthorizedError(input.name));
         }
         if (!workflow.isDynamic()) {
           return this.fail(new Error(`Workflow "${input.name}" is not dynamic and cannot be removed`));
@@ -45724,7 +46106,10 @@ var JobExecutionManager;
 var init_job_execution_manager = __esm({
   "libs/sdk/src/job/execution/job-execution.manager.ts"() {
     "use strict";
+    init_principal_utils();
+    init_errors();
     init_workflow_engine();
+    init_job_permission_guard();
     JobExecutionManager = class {
       stateStore;
       logger;
@@ -45738,6 +46123,7 @@ var init_job_execution_manager = __esm({
        * Execute a job inline (synchronous) or in background.
        */
       async executeJob(job, input, opts = {}) {
+        await this.assertMayExecute(job.metadata.permissions, job.name, opts);
         const runId = randomUUID23();
         const retryConfig = job.metadata.retry ?? {};
         const maxAttempts = retryConfig.maxAttempts ?? 1;
@@ -45746,6 +46132,7 @@ var init_job_execution_manager = __esm({
           jobId: job.metadata.id ?? job.name,
           jobName: job.name,
           sessionId: opts.sessionId,
+          ownerSub: resolvePrincipal2(opts.authInfo, opts.authoritiesContextBuilder).sub || void 0,
           state: "pending",
           input,
           startedAt: Date.now(),
@@ -45776,6 +46163,7 @@ var init_job_execution_manager = __esm({
        * Execute a workflow inline or in background.
        */
       async executeWorkflow(workflow, jobRegistry, opts = {}) {
+        await this.assertMayExecute(workflow.metadata.permissions, workflow.name, opts);
         const runId = randomUUID23();
         const runRecord = {
           runId,
@@ -45783,6 +46171,7 @@ var init_job_execution_manager = __esm({
           jobName: workflow.name,
           workflowName: workflow.name,
           sessionId: opts.sessionId,
+          ownerSub: resolvePrincipal2(opts.authInfo, opts.authoritiesContextBuilder).sub || void 0,
           state: "pending",
           input: opts.workflowInput,
           startedAt: Date.now(),
@@ -45810,6 +46199,25 @@ var init_job_execution_manager = __esm({
         }
         return this.executeWorkflowInline(workflow, jobRegistry, runId, opts);
       }
+      /**
+       * Throw unless the caller may execute the entry.
+       *
+       * Uses the same error for "not authorized" as the tools use for "not found",
+       * so a caller cannot enumerate which restricted jobs exist by comparing
+       * responses.
+       */
+      async assertMayExecute(permissions, name42, opts) {
+        const allowed = await JobPermissionGuard.check(
+          permissions,
+          "execute",
+          opts.authInfo,
+          opts.authoritiesContextBuilder
+        );
+        if (!allowed) {
+          this.logger.warn(`Execution of "${name42}" denied: caller does not satisfy its execute permissions`);
+          throw new JobNotAuthorizedError(name42);
+        }
+      }
       /**
        * Get execution status.
        */
@@ -46834,6 +47242,7 @@ var init_execute_job_tool = __esm({
   "libs/sdk/src/job/tools/execute-job.tool.ts"() {
     "use strict";
     init_common();
+    init_errors();
     ExecuteJobTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -46844,12 +47253,13 @@ var init_execute_job_tool = __esm({
         }
         const job = jobRegistry.findByName(input.name);
         if (!job) {
-          return this.fail(new Error(`Job "${input.name}" not found`));
+          return this.fail(new JobNotAuthorizedError(input.name));
         }
         const result = await executionManager.executeJob(job, input.input ?? {}, {
           background: input.background,
           sessionId: this.authInfo.sessionId,
-          authInfo: this.authInfo
+          authInfo: this.authInfo,
+          authoritiesContextBuilder: this.scope.authoritiesContextBuilder
         });
         return result;
       }
@@ -46881,6 +47291,7 @@ var init_get_job_status_tool = __esm({
   "libs/sdk/src/job/tools/get-job-status.tool.ts"() {
     "use strict";
     init_common();
+    init_principal_utils();
     init_errors();
     GetJobStatusTool = class extends ToolContext {
       async execute(input) {
@@ -46890,7 +47301,7 @@ var init_get_job_status_tool = __esm({
           return this.fail(new GenericServerError("Jobs system is not enabled"));
         }
         const record = await executionManager.getStatus(input.runId);
-        if (!record) {
+        if (!record || !this.ownsRun(record)) {
           return this.fail(new InvalidInputError(`Run "${input.runId}" not found`));
         }
         return {
@@ -46905,6 +47316,23 @@ var init_get_job_status_tool = __esm({
           logs: record.logs
         };
       }
+      /**
+       * Match on the owning subject, falling back to the session for runs started
+       * before an owner was recorded (and for anonymous/public servers, where every
+       * caller has an empty subject and the session is the only identity there is).
+       *
+       * A record carrying NEITHER identity is refused. Such a run cannot be
+       * attributed to anyone, and its inputs and results are exactly what this check
+       * exists to protect — anyone holding the id would otherwise be able to read
+       * it. Internal callers that must read unattributed runs should go through the
+       * execution manager directly rather than this tool.
+       */
+      ownsRun(record) {
+        const callerSub = resolvePrincipal2(this.authInfo, this.scope.authoritiesContextBuilder).sub;
+        if (record.ownerSub) return record.ownerSub === callerSub;
+        if (record.sessionId) return record.sessionId === this.authInfo.sessionId;
+        return false;
+      }
     };
     GetJobStatusTool = __decorateClass([
       FrontMcpTool({
@@ -46939,6 +47367,7 @@ var init_list_jobs_tool = __esm({
   "libs/sdk/src/job/tools/list-jobs.tool.ts"() {
     "use strict";
     init_common();
+    init_job_permission_guard();
     ListJobsTool = class extends ToolContext {
       async execute(input) {
         const jobRegistry = this.scope.jobs;
@@ -46949,7 +47378,11 @@ var init_list_jobs_tool = __esm({
           tags: input.tags,
           labels: input.labels
         });
-        const mapped = jobs.map((j) => ({
+        const visible = [];
+        for (const job of jobs) {
+          if (await this.maySee(job)) visible.push(job);
+        }
+        const mapped = visible.map((j) => ({
           name: j.name,
           description: j.metadata.description,
           tags: j.getTags(),
@@ -46961,6 +47394,17 @@ var init_list_jobs_tool = __esm({
           count: mapped.length
         };
       }
+      /**
+       * A job is listable when the caller passes its `list` rules and is not
+       * blocked from executing it. Checking `execute` too keeps the listing honest:
+       * showing a job the caller can never run is the disclosure this closes.
+       */
+      async maySee(job) {
+        const permissions = job.metadata.permissions;
+        const builder = this.scope.authoritiesContextBuilder;
+        if (!await JobPermissionGuard.check(permissions, "list", this.authInfo, builder)) return false;
+        return JobPermissionGuard.check(permissions, "execute", this.authInfo, builder);
+      }
     };
     ListJobsTool = __decorateClass([
       FrontMcpTool({
@@ -46996,6 +47440,7 @@ var init_register_job_tool = __esm({
   "libs/sdk/src/job/tools/register-job.tool.ts"() {
     "use strict";
     init_common();
+    init_errors();
     RegisterJobTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -47003,6 +47448,9 @@ var init_register_job_tool = __esm({
         if (!jobRegistry) {
           return this.fail(new Error("Jobs system is not enabled"));
         }
+        if (!this.dynamicRegistrationEnabled()) {
+          return this.fail(new DynamicJobRegistrationDisabledError("job"));
+        }
         const existing = jobRegistry.findByName(input.name);
         if (existing) {
           return this.fail(new Error(`Job "${input.name}" already exists`));
@@ -47025,6 +47473,10 @@ var init_register_job_tool = __esm({
         });
         return { success: true, jobId };
       }
+      dynamicRegistrationEnabled() {
+        const jobs = this.scope.metadata?.jobs;
+        return jobs?.allowDynamicRegistration === true;
+      }
     };
     RegisterJobTool = __decorateClass([
       FrontMcpTool({
@@ -47055,6 +47507,8 @@ var init_remove_job_tool = __esm({
   "libs/sdk/src/job/tools/remove-job.tool.ts"() {
     "use strict";
     init_common();
+    init_errors();
+    init_job_permission_guard();
     RemoveJobTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -47064,7 +47518,16 @@ var init_remove_job_tool = __esm({
         }
         const job = jobRegistry.findByName(input.name);
         if (!job) {
-          return this.fail(new Error(`Job "${input.name}" not found`));
+          return this.fail(new JobNotAuthorizedError(input.name));
+        }
+        const allowed = await JobPermissionGuard.check(
+          job.metadata.permissions,
+          "delete",
+          this.authInfo,
+          this.scope.authoritiesContextBuilder
+        );
+        if (!allowed) {
+          return this.fail(new JobNotAuthorizedError(input.name));
         }
         if (!job.isDynamic()) {
           return this.fail(new Error(`Job "${input.name}" is not a dynamic job and cannot be removed`));
@@ -47125,14 +47588,18 @@ async function registerJobCapabilities(args) {
     ListJobsTool,
     ExecuteJobTool,
     GetJobStatusTool,
-    RegisterJobTool,
     RemoveJobTool,
     ListWorkflowsTool,
     ExecuteWorkflowTool,
     GetWorkflowStatusTool,
-    RegisterWorkflowTool,
     RemoveWorkflowTool
   ];
+  if (jobsConfig.allowDynamicRegistration === true) {
+    managementTools.push(RegisterJobTool, RegisterWorkflowTool);
+    logger.warn(
+      "Dynamic job registration is ENABLED: register_job/register_workflow accept a raw script and register it as an executable job."
+    );
+  }
   logger.info(
     `Jobs initialized: ${jobRegistry.getJobs().length} jobs, ${workflowRegistry.getWorkflows().length} workflows`
   );
@@ -51963,6 +52430,7 @@ var init_utils2 = __esm({
     init_caller_dir_utils();
     init_decide_request_intent_utils();
     init_path_utils();
+    init_principal_utils();
     init_global_config_utils();
     init_primitive_filter();
     init_validate_remote_url();
@@ -52908,9 +53376,24 @@ var init_redis_event_store = __esm({
         await client.expire(streamKey, this.ttlSeconds);
         return `${streamId}:${redisId}`;
       }
+      /**
+       * Resolve the stream an event belongs to.
+       *
+       * Optional in the upstream `EventStore` contract, and the transport's
+       * 409-conflict guard (refusing a second live stream for the same id) is dead
+       * code while no store provides it (GHSA-84j6-jc92-77jm).
+       */
+      async getStreamIdForEventId(eventId) {
+        const parsed = this.parseEventId(eventId);
+        return parsed ? parsed[0] : void 0;
+      }
       async replayEventsAfter(lastEventId, { send }) {
+        const parsed = this.parseEventId(lastEventId);
+        if (!parsed) {
+          return "default-stream";
+        }
         const client = await this.getClient();
-        const [streamId, redisId] = this.parseEventId(lastEventId);
+        const [streamId, redisId] = parsed;
         const streamKey = `${this.keyPrefix}${streamId}`;
         const entries = await client.xrange(streamKey, `(${redisId}`, "+");
         for (const [id, fields] of entries) {
@@ -52929,16 +53412,32 @@ var init_redis_event_store = __esm({
        * Event IDs have format: `{streamId}:{redisStreamEntryId}`
        * Redis stream entry IDs have format: `{timestamp}-{sequence}`
        *
+       * The entry-id half is validated because it is interpolated into the `xrange`
+       * range argument (`(${redisId}`), where a malformed value is a protocol error
+       * rather than data.
+       *
+       * The stream-id half is NOT character-filtered. `xadd`/`xrange` take the key
+       * as an exact argument — Redis applies no glob matching there — and ioredis
+       * length-prefixes it, so no character is special. Filtering here would also
+       * make `storeEvent`, which accepts any `StreamId`, able to mint ids this
+       * function then refuses, silently breaking replay for that stream. Ownership
+       * is enforced by the session-scoped facade (GHSA-84j6-jc92-77jm), not by
+       * guessing at the id's characters.
+       *
+       * @returns the pair, or `undefined` when the id is malformed.
+       *
        * @example
        * 'my-stream:1234567890123-0' -> ['my-stream', '1234567890123-0']
        */
       parseEventId(eventId) {
-        const lastColonBeforeDash = eventId.lastIndexOf(":", eventId.lastIndexOf("-"));
-        if (lastColonBeforeDash === -1) {
-          const lastColon = eventId.lastIndexOf(":");
-          return [eventId.slice(0, lastColon), eventId.slice(lastColon + 1)];
-        }
-        return [eventId.slice(0, lastColonBeforeDash), eventId.slice(lastColonBeforeDash + 1)];
+        const value = String(eventId);
+        const lastDash = value.lastIndexOf("-");
+        const separator = lastDash === -1 ? value.lastIndexOf(":") : value.lastIndexOf(":", lastDash);
+        if (separator <= 0 || separator === value.length - 1) return void 0;
+        const streamId = value.slice(0, separator);
+        const redisId = value.slice(separator + 1);
+        if (!/^\d+(-\d+)?$/.test(redisId)) return void 0;
+        return [streamId, redisId];
       }
       /**
        * Close the Redis client connection.
@@ -52984,6 +53483,16 @@ var init_memory_event_store = __esm({
         }
         return id;
       }
+      /**
+       * Resolve the stream an event belongs to.
+       *
+       * Optional in the upstream `EventStore` contract, and the transport's
+       * 409-conflict guard (refusing a second live stream for the same id) is dead
+       * code while no store provides it (GHSA-84j6-jc92-77jm).
+       */
+      async getStreamIdForEventId(eventId) {
+        return this.index.get(eventId)?.streamId;
+      }
       async replayEventsAfter(lastEventId, { send }) {
         const meta = this.index.get(lastEventId);
         if (!meta) {
@@ -53135,6 +53644,50 @@ var init_event_store_factory = __esm({
   }
 });
 
+// libs/sdk/src/transport/event-stores/session-scoped.event-store.ts
+function createSessionScopedEventStore(store, sessionId) {
+  const prefix = `${sessionId}${SCOPE_SEPARATOR}`;
+  const scope = (streamId) => `${prefix}${streamId}`;
+  const unscope = (streamId) => {
+    const value = String(streamId);
+    return value.startsWith(prefix) ? value.slice(prefix.length) : value;
+  };
+  const resolveOwnedStream = async (eventId) => {
+    const lookup = store.getStreamIdForEventId;
+    if (lookup) {
+      const resolved = await lookup.call(store, eventId);
+      return resolved !== void 0 && String(resolved).startsWith(prefix) ? resolved : void 0;
+    }
+    if (!String(eventId).startsWith(prefix)) return void 0;
+    const value = String(eventId);
+    const lastColon = value.lastIndexOf(":");
+    return lastColon === -1 ? void 0 : value.slice(0, lastColon);
+  };
+  return {
+    async storeEvent(streamId, message) {
+      return store.storeEvent(scope(streamId), message);
+    },
+    async getStreamIdForEventId(eventId) {
+      const owned = await resolveOwnedStream(eventId);
+      return owned === void 0 ? void 0 : unscope(owned);
+    },
+    async replayEventsAfter(lastEventId, options) {
+      const owned = await resolveOwnedStream(lastEventId);
+      if (owned === void 0) {
+        return "default-stream";
+      }
+      return unscope(await store.replayEventsAfter(lastEventId, options));
+    }
+  };
+}
+var SCOPE_SEPARATOR;
+var init_session_scoped_event_store = __esm({
+  "libs/sdk/src/transport/event-stores/session-scoped.event-store.ts"() {
+    "use strict";
+    SCOPE_SEPARATOR = " ";
+  }
+});
+
 // libs/sdk/src/transport/event-stores/index.ts
 var init_event_stores = __esm({
   "libs/sdk/src/transport/event-stores/index.ts"() {
@@ -54804,6 +55357,61 @@ var init_transport_error = __esm({
   }
 });
 
+// libs/sdk/src/server/security/host-validation.ts
+function normalizeHost(value) {
+  const host = value.trim().toLowerCase();
+  if (host.length === 0) return host;
+  const portSeparator = host.startsWith("[") ? host.indexOf(":", host.indexOf("]")) : host.lastIndexOf(":");
+  if (portSeparator === -1) return host;
+  const name42 = host.slice(0, portSeparator);
+  const port = host.slice(portSeparator + 1);
+  if (port.length === 0 || !/^\d+$/.test(port)) return host;
+  return DEFAULT_PORTS.has(port) ? name42 : `${name42}:${port}`;
+}
+function normalizeOrigin(value) {
+  const origin = value.trim().toLowerCase();
+  try {
+    return new URL(origin).origin.toLowerCase();
+  } catch {
+    return origin;
+  }
+}
+function compileHostValidation(rules) {
+  return {
+    hosts: rules.allowedHosts ? new Set(rules.allowedHosts.map(normalizeHost)) : void 0,
+    origins: rules.allowedOrigins ? new Set(rules.allowedOrigins.map(normalizeOrigin)) : void 0
+  };
+}
+function validateHostHeaders(headers, compiled) {
+  if (compiled.hosts) {
+    const host = headers.host;
+    if (!host || !compiled.hosts.has(normalizeHost(host))) {
+      return { status: 403, error: "Forbidden", message: "Invalid Host header" };
+    }
+    const forwardedHost = headers.forwardedHost;
+    if (forwardedHost) {
+      const candidates = forwardedHost.split(",").map((h2) => h2.trim()).filter(Boolean);
+      if (candidates.some((h2) => !compiled.hosts?.has(normalizeHost(h2)))) {
+        return { status: 403, error: "Forbidden", message: "Invalid X-Forwarded-Host header" };
+      }
+    }
+  }
+  if (compiled.origins) {
+    const origin = headers.origin;
+    if (origin && !compiled.origins.has(normalizeOrigin(origin))) {
+      return { status: 403, error: "Forbidden", message: "Invalid Origin header" };
+    }
+  }
+  return void 0;
+}
+var DEFAULT_PORTS;
+var init_host_validation = __esm({
+  "libs/sdk/src/server/security/host-validation.ts"() {
+    "use strict";
+    DEFAULT_PORTS = /* @__PURE__ */ new Set(["80", "443"]);
+  }
+});
+
 // libs/sdk/src/transport/adapters/base-sse-transport.ts
 import contentType from "content-type";
 import getRawBody from "raw-body";
@@ -54816,6 +55424,7 @@ var init_base_sse_transport = __esm({
   "libs/sdk/src/transport/adapters/base-sse-transport.ts"() {
     "use strict";
     init_transport_errors();
+    init_host_validation();
     MAXIMUM_MESSAGE_SIZE = "4mb";
     SSEServerTransport = class {
       /**
@@ -54839,25 +55448,31 @@ var init_base_sse_transport = __esm({
       onmessage;
       /**
        * Validates request headers for DNS rebinding protection.
+       *
+       * Since v1.7.2 the primary defence is the adapter-level Host validation, which
+       * runs before routing and therefore already covers `/sse` and `/message`
+       * (GHSA-mc9g-v2cp-vfff). These per-transport options remain for a host that
+       * constructs the transport directly; they delegate to the same rules so the
+       * two can never disagree about what a valid Host looks like.
+       *
        * @returns Error message if validation fails, undefined if validation passes.
        */
       validateRequestHeaders(req) {
         if (!this._options.enableDnsRebindingProtection) {
           return void 0;
         }
-        if (this._options.allowedHosts && this._options.allowedHosts.length > 0) {
-          const hostHeader = req.headers.host;
-          if (!hostHeader || !this._options.allowedHosts.includes(hostHeader)) {
-            return `Invalid Host header: ${hostHeader}`;
-          }
-        }
-        if (this._options.allowedOrigins && this._options.allowedOrigins.length > 0) {
-          const originHeader = req.headers.origin;
-          if (!originHeader || !this._options.allowedOrigins.includes(originHeader)) {
-            return `Invalid Origin header: ${originHeader}`;
-          }
-        }
-        return void 0;
+        const rejection = validateHostHeaders(
+          {
+            host: req.headers.host,
+            forwardedHost: req.headers["x-forwarded-host"],
+            origin: req.headers.origin
+          },
+          compileHostValidation({
+            allowedHosts: this._options.allowedHosts?.length ? this._options.allowedHosts : void 0,
+            allowedOrigins: this._options.allowedOrigins?.length ? this._options.allowedOrigins : void 0
+          })
+        );
+        return rejection?.message;
       }
       /**
        * Handles the initial SSE connection request.
@@ -55359,7 +55974,7 @@ var init_transport_local_adapter = __esm({
         }
       }
       ensureAuthInfo(req, transport) {
-        const { token, user, session } = req[ServerRequestTokens.auth];
+        const { token, user, session, scopes, claims } = req[ServerRequestTokens.auth];
         if (!session?.id) {
           throw new UnauthorizedError(
             "Session could not be reconstructed for the provided token. Re-authenticate to start a new session.",
@@ -55388,7 +56003,16 @@ var init_transport_local_adapter = __esm({
           user,
           sessionId,
           sessionIdPayload: sessionPayload,
-          scopes: [],
+          // Carry the scopes and claims the verified Authorization actually holds.
+          // These used to be dropped (`scopes: []`, no claims), which left every
+          // scope- or claim-based check downstream inert.
+          //
+          // Both are COPIED, not aliased. Tool code receives this object, and a
+          // nested mutation (`authInfo.claims.roles.push('admin')`) on a shared
+          // reference would rewrite the request's own verified authorization — which
+          // the job/workflow permission guard then reads.
+          scopes: Array.isArray(scopes) ? [...scopes] : [],
+          ...claims ? { claims: structuredClone(claims) } : {},
           clientId: user.sub ?? "",
           transport
         };
@@ -55869,6 +56493,7 @@ var init_transport_streamable_http_adapter = __esm({
   "libs/sdk/src/transport/adapters/transport.streamable-http.adapter.ts"() {
     "use strict";
     init_errors();
+    init_session_scoped_event_store();
     init_transport_error();
     init_streamable_http_transport();
     init_transport_local_adapter();
@@ -55878,7 +56503,8 @@ var init_transport_streamable_http_adapter = __esm({
     TransportStreamableHttpAdapter = class extends LocalTransportAdapter {
       createTransport(sessionId, response) {
         const sessionIdGenerator = resolveSessionIdGenerator(this.key.type, sessionId);
-        const eventStore = this.scope.eventStore;
+        const sharedEventStore = this.scope.eventStore;
+        const eventStore = sharedEventStore ? createSessionScopedEventStore(sharedEventStore, sessionId) : void 0;
         const isStateless = this.key.type === "stateless-http";
         return new RecreateableStreamableHTTPServerTransport({
           sessionIdGenerator,
@@ -59770,7 +60396,13 @@ function normalizeAppScope(appItem, metadata) {
       ...metadata,
       id: scopeId,
       apps: [appItem],
-      auth: appMetadata.auth,
+      // An app that declares no `auth` INHERITS the server's policy. Writing
+      // `appMetadata.auth` unconditionally set the key to `undefined`, which
+      // overrode the spread above and dropped the server's auth entirely — so a
+      // standalone app silently became public (GHSA-rgxj-434m-vxh3, where the
+      // dashboard's own scope was the case in point). Declaring
+      // `auth: { mode: 'public' }` explicitly is still honoured.
+      auth: appMetadata.auth ?? metadata.auth,
       // For a splitByApp scope, auth (and any auth.ui paths) come from `@App`, so
       // anchor on the App's captured source dir. Fall back to the server's.
       // `__sourceDir` lives on LocalAppMetadata only; read it defensively.
@@ -60032,6 +60664,11 @@ function createWebFetchHandler(scope, options = {}) {
   const entryPaths = new Set((Array.isArray(rawEntry) ? rawEntry : [rawEntry]).map(normalizePath));
   const cors2 = options.cors ?? mapHttpCors(httpConfig?.cors, scope);
   const corsEnabled = cors2?.origin !== void 0 && cors2.origin !== false;
+  const rebinding = httpConfig?.security?.dnsRebindingProtection;
+  const hostValidation = rebinding?.enabled === false || !rebinding?.allowedHosts?.length && !rebinding?.allowedOrigins?.length ? void 0 : compileHostValidation({
+    allowedHosts: rebinding.allowedHosts,
+    allowedOrigins: rebinding.allowedOrigins
+  });
   const corsHeadersFor = (request) => {
     if (!corsEnabled) return {};
     const reqOrigin = request.headers.get("origin") ?? "";
@@ -60062,6 +60699,19 @@ function createWebFetchHandler(scope, options = {}) {
   };
   return async function handle(request, ctx, env) {
     const url = new URL(request.url);
+    if (hostValidation) {
+      const rejection = validateHostHeaders(
+        {
+          host: request.headers.get("host") ?? url.host,
+          forwardedHost: request.headers.get("x-forwarded-host") ?? void 0,
+          origin: request.headers.get("origin") ?? void 0
+        },
+        hostValidation
+      );
+      if (rejection) {
+        return Response.json({ error: rejection.error, message: rejection.message }, { status: rejection.status });
+      }
+    }
     if (corsEnabled && request.method === "OPTIONS") {
       return new Response(null, { status: 204, headers: corsHeadersFor(request) });
     }
@@ -60195,6 +60845,7 @@ var init_web_fetch_handler = __esm({
     init_server_tokens();
     init_path_utils();
     init_errors();
+    init_host_validation();
     init_web_response_renderer();
   }
 });
@@ -60231,26 +60882,20 @@ function auditSecurityDefaults(config, isProduction5) {
     return findings;
   }
   const strict = config.security?.strict === true;
-  if (config.cors === void 0 && !strict) {
+  const corsOrigin = config.cors === false ? void 0 : config.cors?.origin;
+  if (corsOrigin === void 0 || corsOrigin === false) {
     findings.push({
-      level: "warn",
-      code: "CORS_PERMISSIVE_DEFAULT",
-      message: "CORS is using the permissive default (origin: true), which allows all origins.",
-      recommendation: "Set explicit cors.origin to restrict allowed origins in production."
+      level: "info",
+      code: "CORS_DISABLED",
+      message: "No CORS headers are sent. Cross-origin requests still reach the server \u2014 a browser just will not let the calling page read the response. CORS is not server-side access control."
     });
-  } else if (config.cors !== false && config.cors?.origin === true && !strict) {
+  } else if (corsOrigin === true) {
     findings.push({
       level: "warn",
       code: "CORS_ORIGIN_TRUE",
       message: "CORS origin=true allows all origins to make cross-origin requests.",
       recommendation: "Set cors.origin to specific allowed origins."
     });
-  } else if (config.cors === false) {
-    findings.push({
-      level: "info",
-      code: "CORS_DISABLED",
-      message: "CORS is disabled. Cross-origin requests will be blocked by browsers."
-    });
   } else {
     findings.push({
       level: "info",
@@ -60258,7 +60903,7 @@ function auditSecurityDefaults(config, isProduction5) {
       message: "CORS is explicitly configured."
     });
   }
-  const bindAddress = config.resolvedBindAddress ?? "0.0.0.0";
+  const bindAddress = config.resolvedBindAddress ?? "127.0.0.1";
   if (bindAddress === "0.0.0.0" || bindAddress === "::") {
     if (config.deploymentMode !== "distributed") {
       findings.push({
@@ -60300,7 +60945,7 @@ function auditSecurityDefaults(config, isProduction5) {
     findings.push({
       level: "info",
       code: "STRICT_MODE_ENABLED",
-      message: "Strict security mode is enabled: loopback binding, restrictive CORS, DNS rebinding protection."
+      message: config.deploymentMode === "distributed" ? "Strict security mode is enabled: DNS rebinding protection. Binding is unchanged for a distributed deployment \u2014 it still listens on all interfaces so peers can reach it." : "Strict security mode is enabled: loopback binding and DNS rebinding protection."
     });
   } else {
     findings.push({
@@ -60323,16 +60968,24 @@ function logSecurityFindings(findings, logger) {
     }
   }
 }
+function toBindAddress(value) {
+  if (value === "loopback") return "127.0.0.1";
+  if (value === "all") return "0.0.0.0";
+  return value;
+}
 function resolveBindAddress(security, deploymentMode) {
   if (security?.bindAddress) {
-    if (security.bindAddress === "loopback") return "127.0.0.1";
-    if (security.bindAddress === "all") return "0.0.0.0";
-    return security.bindAddress;
+    return toBindAddress(security.bindAddress);
+  }
+  const envBindAddress = process.env["FRONTMCP_BIND_ADDRESS"]?.trim();
+  if (envBindAddress) {
+    return toBindAddress(envBindAddress);
   }
   if (security?.strict) {
     return deploymentMode === "distributed" ? "0.0.0.0" : "127.0.0.1";
   }
-  return "0.0.0.0";
+  if (deploymentMode === "distributed") return "0.0.0.0";
+  return "127.0.0.1";
 }
 var init_security_audit = __esm({
   "libs/sdk/src/server/security/security-audit.ts"() {
@@ -60345,39 +60998,22 @@ function createHostValidationMiddleware(options) {
   if (!options.enabled) {
     return (_req, _res, next) => next();
   }
-  const allowedHostsSet = options.allowedHosts ? new Set(options.allowedHosts) : void 0;
-  const allowedOriginsSet = options.allowedOrigins ? new Set(options.allowedOrigins) : void 0;
+  const compiled = compileHostValidation({
+    allowedHosts: options.allowedHosts,
+    allowedOrigins: options.allowedOrigins
+  });
   return (req, res, next) => {
-    if (allowedHostsSet) {
-      const host = req.headers?.["host"];
-      if (!host || !allowedHostsSet.has(host)) {
-        res.status(403).json({
-          error: "Forbidden",
-          message: "Invalid Host header"
-        });
-        return;
-      }
-      const forwardedHost = req.headers?.["x-forwarded-host"];
-      if (forwardedHost) {
-        const candidates = forwardedHost.split(",").map((h2) => h2.trim()).filter(Boolean);
-        if (candidates.some((h2) => !allowedHostsSet.has(h2))) {
-          res.status(403).json({
-            error: "Forbidden",
-            message: "Invalid X-Forwarded-Host header"
-          });
-          return;
-        }
-      }
-    }
-    if (allowedOriginsSet) {
-      const origin = req.headers?.["origin"];
-      if (origin && !allowedOriginsSet.has(origin)) {
-        res.status(403).json({
-          error: "Forbidden",
-          message: "Invalid Origin header"
-        });
-        return;
-      }
+    const rejection = validateHostHeaders(
+      {
+        host: req.headers?.["host"],
+        forwardedHost: req.headers?.["x-forwarded-host"],
+        origin: req.headers?.["origin"]
+      },
+      compiled
+    );
+    if (rejection) {
+      res.status(rejection.status).json({ error: rejection.error, message: rejection.message });
+      return;
     }
     next();
   };
@@ -60385,6 +61021,82 @@ function createHostValidationMiddleware(options) {
 var init_host_validation_middleware = __esm({
   "libs/sdk/src/server/middleware/host-validation.middleware.ts"() {
     "use strict";
+    init_host_validation();
+  }
+});
+
+// libs/sdk/src/server/security/resolve-allowed-hosts.ts
+function canonicalizeAddress(address) {
+  const bare = address.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  if (!bare.includes(":")) return bare;
+  try {
+    return new URL(`http://[${bare}]`).hostname.replace(/^\[|\]$/g, "");
+  } catch {
+    return bare;
+  }
+}
+function isLoopbackAddress(address) {
+  if (!address) return false;
+  const normalized = canonicalizeAddress(address);
+  return normalized === "::1" || normalized === "localhost" || normalized.startsWith("127.") || // IPv4-mapped IPv6 loopback, which `URL` renders as `::ffff:7f00:1`.
+  normalized === "::ffff:7f00:1" || normalized.startsWith("::ffff:127.");
+}
+function withAndWithoutPort(host, port) {
+  return port ? [host, `${host}:${port}`] : [host];
+}
+function hostFromUrl(url) {
+  if (!url) return void 0;
+  try {
+    return new URL(url).host || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isRoutableBind(address) {
+  if (!address) return false;
+  return !isLoopbackAddress(address);
+}
+function deriveAllowedHosts(input) {
+  const hosts = /* @__PURE__ */ new Set();
+  if (input.socketPath) return [];
+  for (const name42 of LOOPBACK_NAMES) {
+    for (const value of withAndWithoutPort(name42, input.port)) hosts.add(value);
+  }
+  const bindAddress = input.bindAddress?.trim();
+  if (bindAddress && !isLoopbackAddress(bindAddress) && bindAddress !== "0.0.0.0" && bindAddress !== "::") {
+    const literal = bindAddress.includes(":") && !bindAddress.startsWith("[") ? `[${bindAddress}]` : bindAddress;
+    for (const value of withAndWithoutPort(literal, input.port)) hosts.add(value);
+  }
+  const issuerHost = hostFromUrl(input.issuer);
+  if (issuerHost) {
+    hosts.add(issuerHost);
+    const [name42] = issuerHost.split(":");
+    if (!issuerHost.includes(":") && input.port) hosts.add(`${name42}:${input.port}`);
+  }
+  for (const extra of input.extraHosts ?? []) {
+    const trimmed = extra.trim();
+    if (trimmed) hosts.add(trimmed);
+  }
+  return [...hosts];
+}
+function shouldEnforceDerivedHosts(input) {
+  if (input.socketPath) return false;
+  const hasExplicitName = hostFromUrl(input.issuer) !== void 0 || (input.extraHosts ?? []).some((h2) => h2.trim());
+  if (hasExplicitName) return true;
+  if (input.port === void 0) return false;
+  return !isRoutableBind(input.bindAddress);
+}
+function allowedHostsFromEnv(env = process.env) {
+  const raw = env["FRONTMCP_ALLOWED_HOSTS"]?.trim();
+  if (!raw) return void 0;
+  const hosts = raw.split(",").map((h2) => h2.trim()).filter(Boolean);
+  return hosts.length > 0 ? hosts : void 0;
+}
+var LOOPBACK_NAMES;
+var init_resolve_allowed_hosts = __esm({
+  "libs/sdk/src/server/security/resolve-allowed-hosts.ts"() {
+    "use strict";
+    LOOPBACK_NAMES = ["localhost", "127.0.0.1", "[::1]"];
   }
 });
 
@@ -60410,12 +61122,17 @@ var init_express_host_adapter = __esm({
     "use strict";
     init_mcp_error();
     init_host_validation_middleware();
+    init_resolve_allowed_hosts();
     init_base_host_adapter();
     DEFAULT_EXPRESS_BODY_LIMIT = "4mb";
     ExpressHostAdapter = class extends HostServerAdapter {
       app = express();
       router = express.Router();
       prepared = false;
+      /** Active host-validation middleware, or undefined while nothing is enforced. */
+      hostValidation;
+      /** Builds the derived allow-list, once this process commits to listening. */
+      deriveHostValidation;
       constructor(options) {
         super();
         const corsOptions = options?.cors;
@@ -60429,6 +61146,7 @@ var init_express_host_adapter = __esm({
             })
           );
         }
+        this.installHostValidation(options);
         const jsonLimit = options?.bodyLimit ?? DEFAULT_EXPRESS_BODY_LIMIT;
         const formLimit = options?.urlencodedLimit ?? jsonLimit;
         const headerContains = (req, needle) => (req.headers["content-type"] ?? "").toLowerCase().includes(needle);
@@ -60449,23 +61167,6 @@ var init_express_host_adapter = __esm({
           }
           next(err);
         });
-        const securityOpts = options?.security;
-        if (securityOpts?.dnsRebindingProtection?.enabled || securityOpts?.strict) {
-          const allowedHosts = securityOpts.dnsRebindingProtection?.allowedHosts;
-          const allowedOrigins = securityOpts.dnsRebindingProtection?.allowedOrigins;
-          const effectiveHosts = allowedHosts ?? (securityOpts.strict ? ["localhost", "127.0.0.1"] : void 0);
-          if (!effectiveHosts?.length && !allowedOrigins?.length) {
-            throw new Error(
-              "security.dnsRebindingProtection is enabled but no allowedHosts or allowedOrigins are configured. Provide at least one allowedHosts entry or disable dnsRebindingProtection."
-            );
-          }
-          const hostValidation = createHostValidationMiddleware({
-            enabled: true,
-            allowedHosts: effectiveHosts,
-            allowedOrigins
-          });
-          this.app.use(hostValidation);
-        }
         this.app.use((req, res, next) => {
           if (corsEnabled) {
             res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate, Mcp-Session-Id");
@@ -60475,6 +61176,64 @@ var init_express_host_adapter = __esm({
           next();
         });
       }
+      /**
+       * Install DNS-rebinding protection.
+       *
+       * ON by default since v1.7.2 (BC-035). `allowedHosts` falls back to the names
+       * this process actually answers to — the loopback aliases with and without
+       * the bound port, the bound NIC address, and the configured issuer host.
+       *
+       * Escape hatches, in precedence order: explicit
+       * `security.dnsRebindingProtection.allowedHosts`, the
+       * `FRONTMCP_ALLOWED_HOSTS` env var, or `enabled: false` to turn it off.
+       */
+      installHostValidation(options) {
+        const protection = options?.security?.dnsRebindingProtection;
+        if (protection?.enabled === false) return;
+        const allowedOrigins = protection?.allowedOrigins;
+        const explicitHosts = protection?.allowedHosts ?? allowedHostsFromEnv();
+        if (explicitHosts?.length || allowedOrigins?.length) {
+          this.hostValidation = createHostValidationMiddleware({
+            enabled: true,
+            allowedHosts: explicitHosts?.length ? explicitHosts : void 0,
+            allowedOrigins
+          });
+        } else {
+          this.deriveHostValidation = (portOrSocketPath, bindAddress) => {
+            const isSocket = typeof portOrSocketPath === "string";
+            const derivation = {
+              // `start()` binds `bindAddress ?? '0.0.0.0'`; mirror that exactly.
+              bindAddress: isSocket ? void 0 : bindAddress ?? "0.0.0.0",
+              port: isSocket ? void 0 : portOrSocketPath,
+              socketPath: isSocket ? portOrSocketPath : void 0,
+              issuer: options?.listen?.issuer
+            };
+            if (!shouldEnforceDerivedHosts(derivation)) {
+              console.warn(
+                `[frontmcp] DNS-rebinding protection is not enforcing a Host allow-list: the server binds a routable address (${derivation.bindAddress ?? "unknown"}) and no allowed hosts are configured. Set security.dnsRebindingProtection.allowedHosts (or FRONTMCP_ALLOWED_HOSTS) to your public hostname(s).`
+              );
+              return void 0;
+            }
+            const allowedHosts = deriveAllowedHosts(derivation);
+            if (!allowedHosts.length) return void 0;
+            return createHostValidationMiddleware({ enabled: true, allowedHosts });
+          };
+        }
+        this.app.use(((req, res, next) => {
+          const validate = this.hostValidation;
+          if (!validate) return next();
+          return validate(req, res, next);
+        }));
+      }
+      /**
+       * Enable the DERIVED host allow-list. Called from `start()` only — see
+       * `installHostValidation`.
+       */
+      enableDerivedHostValidation(portOrSocketPath, bindAddress) {
+        if (this.hostValidation || !this.deriveHostValidation) return;
+        this.hostValidation = this.deriveHostValidation(portOrSocketPath, bindAddress);
+        this.deriveHostValidation = void 0;
+      }
       registerRoute(method, path3, handler) {
         this.router[method.toLowerCase()](path3, this.enhancedHandler(handler));
       }
@@ -60507,6 +61266,7 @@ var init_express_host_adapter = __esm({
         return this.app;
       }
       async start(portOrSocketPath, bindAddress) {
+        this.enableDerivedHostValidation(portOrSocketPath, bindAddress);
         this.prepare();
         const server = http.createServer(this.app);
         server.requestTimeout = 0;
@@ -60572,7 +61332,7 @@ var init_server_instance = __esm({
     init_health2();
     init_metrics2();
     init_security_audit();
-    DEFAULT_CORS = { origin: true, credentials: false };
+    DEFAULT_CORS = void 0;
     FrontMcpServerInstance = class extends FrontMcpServer {
       config;
       host;
@@ -63365,49 +64125,7 @@ init_job_registry();
 init_job_instance();
 init_job_events();
 init_job_utils();
-
-// libs/sdk/src/job/job-permission.guard.ts
-var JobPermissionGuard = class _JobPermissionGuard {
-  /**
-   * Check if the given auth info is allowed to perform the action.
-   * Returns true if no permissions are defined (permissive by default).
-   */
-  static async check(permissions, action, authInfo) {
-    if (!permissions || permissions.length === 0) {
-      return true;
-    }
-    const relevant = permissions.filter((p) => p.action === action);
-    if (relevant.length === 0) {
-      return true;
-    }
-    for (const perm of relevant) {
-      const passed = await _JobPermissionGuard.checkSingle(perm, authInfo);
-      if (!passed) return false;
-    }
-    return true;
-  }
-  static async checkSingle(perm, authInfo) {
-    if (perm.roles && perm.roles.length > 0) {
-      const userRoles = authInfo["roles"];
-      if (!Array.isArray(userRoles)) return false;
-      const hasRole = perm.roles.some((r) => userRoles.includes(r));
-      if (!hasRole) return false;
-    }
-    if (perm.scopes && perm.scopes.length > 0) {
-      const userScopes = authInfo["scopes"] ?? authInfo["scope"];
-      const scopeArr = typeof userScopes === "string" ? userScopes.split(" ") : Array.isArray(userScopes) ? userScopes : [];
-      const hasScope = perm.scopes.some((s) => scopeArr.includes(s));
-      if (!hasScope) return false;
-    }
-    if (perm.custom) {
-      const result = await perm.custom(authInfo);
-      if (!result) return false;
-    }
-    return true;
-  }
-};
-
-// libs/sdk/src/job/index.ts
+init_job_permission_guard();
 init_job_scope_helper();
 
 // libs/sdk/src/job/execution/index.ts
@@ -63809,6 +64527,7 @@ export {
   DynamicAdapter,
   DynamicAdapterNameError,
   DynamicJobDirectExecutionError,
+  DynamicJobRegistrationDisabledError,
   DynamicPlugin,
   ELICITATION_FALLBACK_JSON_SCHEMA,
   ESM_SH_BASE_URL,
@@ -63963,6 +64682,7 @@ export {
   JobExecutionManager,
   JobInstance,
   JobKind,
+  JobNotAuthorizedError,
   JobPermissionGuard,
   JobRegistry,
   LLM_ADAPTER,
@@ -64480,6 +65200,7 @@ export {
   resolveNameConflicts,
   resolveOutputSchemaMode,
   resolvePendingTC39HooksForClass,
+  resolvePrincipal2 as resolvePrincipal,
   resolveRegistryToken,
   resolveSchemaDescriptionFormat,
   resolveToolVisibility,