@frontmcp/sdk 1.7.1 → 1.7.2

package/index.js

@@ -2309,7 +2309,10 @@ var init_schema7 = __esm({
     });
     eventStoreConfigSchema = import_lazy_zod12.z.object({
       enabled: import_lazy_zod12.z.boolean().default(false),
-      provider: import_lazy_zod12.z.enum(["memory", "redis"]).optional().default("memory"),
+      // 'sqlite' is supported by createEventStore and the TS interface but was
+      // missing from this enum, so a valid `provider: 'sqlite'` config failed
+      // validation.
+      provider: import_lazy_zod12.z.enum(["memory", "redis", "sqlite"]).optional().default("memory"),
       maxEvents: import_lazy_zod12.z.number().int().positive().optional().default(1e4),
       ttlMs: import_lazy_zod12.z.number().int().positive().optional().default(3e5),
       redis: redisOptionsSchema.optional()
@@ -4038,7 +4041,7 @@ function formatToolsForPlatform(tools, platform) {
         })
       );
     case "vercel-ai": {
-      const result = {};
+      const result = /* @__PURE__ */ Object.create(null);
       for (const tool of tools) {
         result[tool.name] = {
           description: tool.description ?? `Execute ${tool.name}`,
@@ -5576,6 +5579,32 @@ var init_sdk_errors = __esm({
   }
 });
 
+// libs/sdk/src/errors/job.errors.ts
+var JobNotAuthorizedError, DynamicJobRegistrationDisabledError;
+var init_job_errors = __esm({
+  "libs/sdk/src/errors/job.errors.ts"() {
+    "use strict";
+    init_mcp_error();
+    JobNotAuthorizedError = class extends PublicMcpError {
+      /** The requested name, for internal logs only — never surfaced publicly. */
+      requestedName;
+      constructor(requestedName) {
+        super(`Job or workflow "${requestedName}" not found or not permitted`, "JOB_NOT_AUTHORIZED", 403);
+        this.requestedName = requestedName;
+      }
+    };
+    DynamicJobRegistrationDisabledError = class extends PublicMcpError {
+      constructor(kind = "job") {
+        super(
+          `Dynamic ${kind} registration is disabled. Enable it with jobs: { allowDynamicRegistration: true }.`,
+          "DYNAMIC_REGISTRATION_DISABLED",
+          403
+        );
+      }
+    };
+  }
+});
+
 // libs/sdk/src/errors/index.ts
 var errors_exports = {};
 __export(errors_exports, {
@@ -5601,6 +5630,7 @@ __export(errors_exports, {
   DependencyNotFoundError: () => DependencyNotFoundError,
   DynamicAdapterNameError: () => DynamicAdapterNameError,
   DynamicJobDirectExecutionError: () => DynamicJobDirectExecutionError,
+  DynamicJobRegistrationDisabledError: () => DynamicJobRegistrationDisabledError,
   ElicitationDisabledError: () => ElicitationDisabledError,
   ElicitationEncryptionError: () => ElicitationEncryptionError,
   ElicitationFallbackRequired: () => ElicitationFallbackRequired,
@@ -5649,6 +5679,7 @@ __export(errors_exports, {
   InvalidUseFactoryError: () => InvalidUseFactoryError,
   InvalidUseValueError: () => InvalidUseValueError,
   InvokeStateMissingKeyError: () => InvokeStateMissingKeyError,
+  JobNotAuthorizedError: () => JobNotAuthorizedError,
   MCP_ERROR_CODES: () => MCP_ERROR_CODES,
   McpError: () => McpError,
   MethodNotImplementedError: () => MethodNotImplementedError,
@@ -5771,6 +5802,7 @@ var init_errors = __esm({
     init_workflow_errors();
     init_esm_errors();
     init_sdk_errors();
+    init_job_errors();
   }
 });
 
@@ -7093,6 +7125,10 @@ var require_dist = __commonJS({
         }
         return id;
       }
+      async getStreamIdForEventId(eventId) {
+        const row = this.prepared().getStreamId.get(eventId);
+        return row?.stream_id;
+      }
       async replayEventsAfter(lastEventId, { send }) {
         const stmts = this.prepared();
         const streamRow = stmts.getStreamId.get(lastEventId);
@@ -14015,22 +14051,38 @@ async function loadYamlConfig(basePath, configPath) {
   }
   return {};
 }
+function stripUnsafeKeys(value) {
+  if (Array.isArray(value)) return value.map(stripUnsafeKeys);
+  if (!isPlainObject(value)) return value;
+  const clean = {};
+  for (const [key, nested] of Object.entries(value)) {
+    if (UNSAFE_MERGE_KEYS.has(key)) continue;
+    clean[key] = stripUnsafeKeys(nested);
+  }
+  return clean;
+}
+function isPlainObject(value) {
+  if (!value || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
 function deepMerge(target, source) {
   const result = { ...target };
   for (const key in source) {
+    if (UNSAFE_MERGE_KEYS.has(key)) continue;
     const sourceVal = source[key];
     const targetVal = result[key];
     if (sourceVal !== void 0 && sourceVal !== null) {
       if (typeof sourceVal === "object" && !Array.isArray(sourceVal) && typeof targetVal === "object" && !Array.isArray(targetVal) && targetVal !== null) {
         result[key] = deepMerge(targetVal, sourceVal);
       } else {
-        result[key] = sourceVal;
+        result[key] = stripUnsafeKeys(sourceVal);
       }
     }
   }
   return result;
 }
-var yaml2, import_utils32;
+var yaml2, import_utils32, UNSAFE_MERGE_KEYS;
 var init_config_loader = __esm({
   "libs/sdk/src/builtin/config/providers/config-loader.ts"() {
     "use strict";
@@ -14038,6 +14090,7 @@ var init_config_loader = __esm({
     import_utils32 = require("@frontmcp/utils");
     init_config_service();
     init_env_loader();
+    UNSAFE_MERGE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
   }
 });
 
@@ -20704,10 +20757,11 @@ var init_tool_credentials_gate = __esm({
 });
 
 // libs/sdk/src/tool/flows/call-tool.flow.ts
-var import_guard4, import_lazy_zod56, import_protocol38, import_adapters4, import_utils45, inputSchema13, outputSchema12, stateSchema12, plan12, name12, Stage12, CallToolFlow;
+var import_auth17, import_guard4, import_lazy_zod56, import_protocol38, import_adapters4, import_utils45, inputSchema13, outputSchema12, stateSchema12, plan12, name12, Stage12, CallToolFlow;
 var init_call_tool_flow = __esm({
   "libs/sdk/src/tool/flows/call-tool.flow.ts"() {
     "use strict";
+    import_auth17 = require("@frontmcp/auth");
     import_guard4 = require("@frontmcp/guard");
     import_lazy_zod56 = require("@frontmcp/lazy-zod");
     import_protocol38 = require("@frontmcp/protocol");
@@ -21080,7 +21134,7 @@ var init_call_tool_flow = __esm({
             this.logger.verbose(`checkToolAuthorization: using anonymous for ${appId}`);
             return;
           }
-          const authUrl = this.buildProgressiveAuthUrl(appId, tool?.fullName || "");
+          const authUrl = this.buildProgressiveAuthUrl(appId, tool?.fullName || "", authInfo, claimAuthorizedApps);
           this.logger.info(`checkToolAuthorization: authorization required for app "${appId}"`);
           throw new AuthorizationRequiredError({
             appId,
@@ -21092,11 +21146,51 @@ var init_call_tool_flow = __esm({
         this.logger.verbose("checkToolAuthorization:done");
       }
       /**
-       * Build the URL for progressive/incremental authorization
+       * Build the URL for progressive/incremental authorization.
+       *
+       * This is the ONE point in the request lifecycle where the caller's identity
+       * is both known and verified, so it is where the incremental-authorization
+       * ticket is minted (GHSA-2c4g-9c8x-6m8g). The ticket is what later authorizes
+       * `/oauth/authorize` to skip the login step; `app`/`tool` are carried purely
+       * for display and are re-read from the signed payload server-side.
+       *
+       * When no verified subject or signing secret is available the URL is emitted
+       * WITHOUT a ticket — the user then completes an ordinary login, which is the
+       * correct fail-closed outcome rather than a credential-free shortcut.
        */
-      buildProgressiveAuthUrl(appId, toolId) {
+      buildProgressiveAuthUrl(appId, toolId, authInfo, priorAppIds) {
         const baseUrl = this.scope.fullPath || "";
-        return `${baseUrl}/oauth/authorize?app=${encodeURIComponent(appId)}&tool=${encodeURIComponent(toolId)}`;
+        const url = new URL(`${baseUrl}/oauth/authorize`, "http://placeholder.invalid");
+        url.searchParams.set("app", appId);
+        url.searchParams.set("tool", toolId);
+        const ticket = this.mintIncrementalTicket(appId, toolId, authInfo, priorAppIds);
+        if (ticket) {
+          url.searchParams.set("ticket", ticket);
+        } else {
+          this.logger.verbose("buildProgressiveAuthUrl: no incremental ticket minted \u2014 link requires a full login");
+        }
+        return baseUrl.startsWith("http") ? url.toString() : `${url.pathname}${url.search}`;
+      }
+      /**
+       * Mint a single-use, short-lived incremental-authorization ticket for the
+       * verified caller. Returns undefined when the scope has no local signing
+       * secret or the request has no verified subject.
+       */
+      mintIncrementalTicket(appId, toolId, authInfo, priorAppIds) {
+        const extraUser = authInfo?.extra?.user;
+        const sub = extraUser?.sub ?? authInfo?.user?.sub;
+        if (!sub) return void 0;
+        const secret = this.scope.auth?.signingSecret;
+        if (!secret) return void 0;
+        return (0, import_auth17.signIncrementalAuthTicket)(
+          {
+            sub,
+            appId,
+            toolId,
+            ...priorAppIds && priorAppIds.size > 0 ? { priorAppIds: [...priorAppIds] } : {}
+          },
+          secret
+        );
       }
       async checkEntryAuthorities() {
         this.logger.verbose("checkEntryAuthorities:start");
@@ -35577,25 +35671,25 @@ var init_auth_utils = __esm({
 });
 
 // libs/sdk/src/auth/authorization/orchestrated.context-extension.ts
-var import_auth17, orchestratedAuthContextExtension;
+var import_auth18, orchestratedAuthContextExtension;
 var init_orchestrated_context_extension = __esm({
   "libs/sdk/src/auth/authorization/orchestrated.context-extension.ts"() {
     "use strict";
-    import_auth17 = require("@frontmcp/auth");
+    import_auth18 = require("@frontmcp/auth");
     orchestratedAuthContextExtension = {
       property: "orchestration",
-      token: import_auth17.ORCHESTRATED_AUTH_ACCESSOR,
+      token: import_auth18.ORCHESTRATED_AUTH_ACCESSOR,
       errorMessage: "Orchestrated authorization not available. Ensure your server is configured with orchestrated mode and the user has completed authentication."
     };
   }
 });
 
 // libs/sdk/src/auth/cimd/index.ts
-var import_auth18;
+var import_auth19;
 var init_cimd = __esm({
   "libs/sdk/src/auth/cimd/index.ts"() {
     "use strict";
-    import_auth18 = require("@frontmcp/auth");
+    import_auth19 = require("@frontmcp/auth");
   }
 });
 
@@ -35617,9 +35711,9 @@ function createCredentialsProviders(opts) {
     name: "SessionCredentialVault"
   };
   const accessorProvider = {
-    provide: import_auth19.CREDENTIALS_ACCESSOR,
+    provide: import_auth20.CREDENTIALS_ACCESSOR,
     inject: () => [FRONTMCP_CONTEXT, FrontMcpLogger],
-    useFactory: (ctx, logger) => new import_auth19.CredentialsAccessorImpl({
+    useFactory: (ctx, logger) => new import_auth20.CredentialsAccessorImpl({
       vault,
       resolveSub: () => resolveRequestSub(ctx),
       signingSecret,
@@ -35632,11 +35726,11 @@ function createCredentialsProviders(opts) {
   };
   return [vaultProvider, accessorProvider];
 }
-var import_auth19, import_di31, SESSION_CREDENTIAL_VAULT;
+var import_auth20, import_di31, SESSION_CREDENTIAL_VAULT;
 var init_credentials_providers = __esm({
   "libs/sdk/src/auth/credentials/credentials.providers.ts"() {
     "use strict";
-    import_auth19 = require("@frontmcp/auth");
+    import_auth20 = require("@frontmcp/auth");
     import_di31 = require("@frontmcp/di");
     init_common();
     init_frontmcp_context_provider();
@@ -35647,14 +35741,14 @@ var init_credentials_providers = __esm({
 });
 
 // libs/sdk/src/auth/credentials/credentials.context-extension.ts
-var import_auth20, credentialsContextExtension;
+var import_auth21, credentialsContextExtension;
 var init_credentials_context_extension = __esm({
   "libs/sdk/src/auth/credentials/credentials.context-extension.ts"() {
     "use strict";
-    import_auth20 = require("@frontmcp/auth");
+    import_auth21 = require("@frontmcp/auth");
     credentialsContextExtension = {
       property: "credentials",
-      token: import_auth20.CREDENTIALS_ACCESSOR,
+      token: import_auth21.CREDENTIALS_ACCESSOR,
       errorMessage: "Per-session credentials are not available. Ensure the server uses auth mode 'local' (or 'remote'); credentials are persisted by a local authenticate() verifier."
     };
   }
@@ -35823,11 +35917,11 @@ function getConfiguredProviders(auth) {
 function getConfiguredProviderIds(auth) {
   return getConfiguredProviders(auth).map((p) => p.id);
 }
-var import_auth21, import_lazy_zod64, import_utils66, pkceChallengeSchema, codeChallengeMethodSchema, responseTypeSchema, safeRedirectUriSchema, oauthAuthorizeRequestSchema, anonymousAuthorizeRequestSchema, inputSchema16, stateSchema15, outputSchema15, plan15, name15, Stage15, OauthAuthorizeFlow;
+var import_auth22, import_lazy_zod64, import_utils66, pkceChallengeSchema, codeChallengeMethodSchema, responseTypeSchema, safeRedirectUriSchema, oauthAuthorizeRequestSchema, anonymousAuthorizeRequestSchema, inputSchema16, stateSchema15, outputSchema15, plan15, name15, Stage15, OauthAuthorizeFlow;
 var init_oauth_authorize_flow = __esm({
   "libs/sdk/src/auth/flows/oauth.authorize.flow.ts"() {
     "use strict";
-    import_auth21 = require("@frontmcp/auth");
+    import_auth22 = require("@frontmcp/auth");
     import_lazy_zod64 = require("@frontmcp/lazy-zod");
     import_utils66 = require("@frontmcp/utils");
     init_common();
@@ -35885,6 +35979,13 @@ var init_oauth_authorize_flow = __esm({
       targetAppId: import_lazy_zod64.z.string().optional().describe("Target app ID for incremental authorization"),
       targetToolId: import_lazy_zod64.z.string().optional().describe("Target tool ID that triggered the incremental auth"),
       existingSessionId: import_lazy_zod64.z.string().optional().describe("Existing session ID for incremental auth"),
+      /**
+       * The VERIFIED incremental-authorization ticket (GHSA-2c4g-9c8x-6m8g). Set
+       * only when `?ticket=` carried a valid, unexpired server signature. Its `sub`
+       * is the proven identity the expanded grant is minted for; `isIncrementalAuth`
+       * is derived from its presence, never from a raw query parameter.
+       */
+      incrementalTicket: import_lazy_zod64.z.custom().optional(),
       /**
        * Apps the client already holds a grant for (the prior `authorized_apps`
        * claim), carried forward on an incremental authorize so the newly-minted
@@ -35898,7 +35999,7 @@ var init_oauth_authorize_flow = __esm({
       requiresConsent: import_lazy_zod64.z.boolean().default(false).describe("Whether consent flow is enabled"),
       // CIMD (Client ID Metadata Documents)
       isCimdClient: import_lazy_zod64.z.boolean().default(false).describe("Whether client_id is a CIMD URL"),
-      cimdMetadata: import_auth18.clientMetadataDocumentSchema.optional().describe("CIMD metadata document for the client")
+      cimdMetadata: import_auth19.clientMetadataDocumentSchema.optional().describe("CIMD metadata document for the client")
     });
     outputSchema15 = import_lazy_zod64.z.union([
       HttpRedirectSchema,
@@ -35937,18 +36038,21 @@ var init_oauth_authorize_flow = __esm({
         const { request } = this.rawInput;
         const rawRedirectUri = request.query["redirect_uri"];
         const rawState = request.query["state"];
-        const targetAppId = request.query["app"];
-        const targetToolId = request.query["tool"];
-        const existingSessionId = request.query["session_id"];
-        const mode = request.query["mode"];
-        const isIncrementalAuth = mode === "incremental" || !!targetAppId;
-        const appsParam = request.query["apps"];
+        const incrementalTicket = this.verifyIncrementalTicket(request.query["ticket"]);
+        const isIncrementalAuth = incrementalTicket !== void 0;
+        const targetAppId = incrementalTicket?.appId;
+        const targetToolId = incrementalTicket?.toolId;
         let priorAuthorizedAppIds;
-        if (appsParam) {
-          const raw = Array.isArray(appsParam) ? appsParam : [appsParam];
-          const ids = raw.flatMap((v) => String(v).split(",")).map((s) => s.trim()).filter(Boolean);
-          priorAuthorizedAppIds = ids.length > 0 ? Array.from(new Set(ids)) : void 0;
+        if (incrementalTicket) {
+          priorAuthorizedAppIds = incrementalTicket.priorAppIds && incrementalTicket.priorAppIds.length > 0 ? Array.from(new Set(incrementalTicket.priorAppIds)) : void 0;
+        } else {
+          const appsParam = request.query["apps"];
+          if (appsParam) {
+            const ids = (Array.isArray(appsParam) ? appsParam : [appsParam]).flatMap((v) => String(v).split(",")).map((v) => v.trim()).filter(Boolean);
+            priorAuthorizedAppIds = ids.length > 0 ? Array.from(new Set(ids)) : void 0;
+          }
         }
+        const existingSessionId = request.query["session_id"];
         const isDefaultAuthProvider = !metadata.auth;
         let requiresFederatedLogin = false;
         if (metadata.auth && (0, import_auth10.isOrchestratedMode)(metadata.auth)) {
@@ -35974,6 +36078,7 @@ var init_oauth_authorize_flow = __esm({
           targetToolId,
           existingSessionId,
           priorAuthorizedAppIds,
+          incrementalTicket,
           // Federated Login
           requiresFederatedLogin,
           // Consent Flow
@@ -36045,7 +36150,7 @@ var init_oauth_authorize_flow = __esm({
           }
         }
         const { client_id, redirect_uri } = result.data;
-        const cimdService = this.get(import_auth18.CimdService);
+        const cimdService = this.get(import_auth19.CimdService);
         const isCimdClientId2 = !!cimdService?.enabled && cimdService.isCimdClientId(client_id);
         const dcrError = this.checkDcrAllowlist(client_id, redirect_uri, isCimdClientId2);
         if (dcrError) {
@@ -36099,6 +36204,28 @@ var init_oauth_authorize_flow = __esm({
           }
         }
       }
+      /**
+       * Verify a client-supplied incremental-authorization ticket.
+       *
+       * Returns the verified payload, or `undefined` when the parameter is absent,
+       * malformed, expired, or not signed by this server. Verification is
+       * side-effect free — the ticket is CLAIMED (single use) later, in
+       * {@link prepareAuthorizationRequest}, so a request that fails OAuth
+       * validation does not burn the user's ticket.
+       */
+      verifyIncrementalTicket(raw) {
+        const token = typeof raw === "string" ? raw : Array.isArray(raw) ? raw[0] : void 0;
+        if (typeof token !== "string" || token.length === 0) return void 0;
+        const localAuth = this.scope.auth;
+        const secret = localAuth?.signingSecret;
+        if (!secret) return void 0;
+        const payload = (0, import_auth22.verifyIncrementalAuthTicket)(token, secret);
+        if (!payload) {
+          this.logger.warn("Incremental auth ticket failed verification \u2014 treating as an ordinary login");
+          return void 0;
+        }
+        return payload;
+      }
       async checkIfAuthorized() {
       }
       async prepareAuthorizationRequest() {
@@ -36110,7 +36237,8 @@ var init_oauth_authorize_flow = __esm({
           existingSessionId,
           priorAuthorizedAppIds,
           requiresFederatedLogin,
-          requiresConsent
+          requiresConsent,
+          incrementalTicket
         } = this.state;
         const { metadata } = this.scope;
         if (!validatedRequest) {
@@ -36123,6 +36251,18 @@ var init_oauth_authorize_flow = __esm({
         }
         const localAuth = auth;
         const store = localAuth.authorizationStore;
+        let effectiveIncremental = isIncrementalAuth;
+        if (incrementalTicket) {
+          const claimed = await localAuth.claimIncrementalTicket(
+            incrementalTicket.jti,
+            Math.max(0, incrementalTicket.exp - Date.now())
+          );
+          if (!claimed) {
+            this.logger.warn("Incremental auth ticket already used \u2014 falling back to an ordinary login");
+            effectiveIncremental = false;
+            this.state.set({ isIncrementalAuth: false, targetAppId: void 0, targetToolId: void 0 });
+          }
+        }
         let federatedLogin;
         if (requiresFederatedLogin) {
           const apps = this.scope.apps.getApps();
@@ -36170,10 +36310,14 @@ var init_oauth_authorize_flow = __esm({
           },
           state: validatedRequest.state,
           resource: validatedRequest.resource,
-          // Progressive/Incremental Authorization Fields
-          isIncremental: isIncrementalAuth,
-          targetAppId,
-          targetToolId,
+          // Progressive/Incremental Authorization Fields. `isIncremental` reflects a
+          // CLAIMED, server-signed ticket; `incrementalSub` is the identity that
+          // ticket proved, and is the only subject the callback may mint for when
+          // it skips the credential gate.
+          isIncremental: effectiveIncremental,
+          incrementalSub: effectiveIncremental ? incrementalTicket?.sub : void 0,
+          targetAppId: effectiveIncremental ? targetAppId : void 0,
+          targetToolId: effectiveIncremental ? targetToolId : void 0,
           existingSessionId,
           priorAuthorizedAppIds,
           // Federated Login State
@@ -36183,7 +36327,7 @@ var init_oauth_authorize_flow = __esm({
         });
         await localAuth.authorizationStore.storePendingAuthorization(pendingRecord);
         this.logger.info(
-          `Pending authorization created: ${pendingRecord.id}${isIncrementalAuth ? ` (incremental for app: ${targetAppId})` : ""}${requiresFederatedLogin ? " (federated)" : ""}${requiresConsent ? " (consent enabled)" : ""}`
+          `Pending authorization created: ${pendingRecord.id}${effectiveIncremental ? ` (incremental for app: ${targetAppId})` : ""}${requiresFederatedLogin ? " (federated)" : ""}${requiresConsent ? " (consent enabled)" : ""}`
         );
         this.state.set("pendingAuthId", pendingRecord.id);
       }
@@ -36404,7 +36548,7 @@ var init_oauth_authorize_flow = __esm({
           );
           return;
         }
-        const session = (0, import_auth21.createFederatedAuthSession)({
+        const session = (0, import_auth22.createFederatedAuthSession)({
           pendingAuthId,
           clientId: validatedRequest.client_id,
           redirectUri: validatedRequest.redirect_uri,
@@ -36419,7 +36563,7 @@ var init_oauth_authorize_flow = __esm({
         const challenge = (0, import_utils66.sha256Base64url)(verifier);
         const pkce = { verifier, challenge, method: "S256" };
         const providerState = `federated:${session.id}:${(0, import_utils66.randomUUID)()}`;
-        (0, import_auth21.startNextProvider)(session, pkce, providerState);
+        (0, import_auth22.startNextProvider)(session, pkce, providerState);
         await localAuth.federatedSessionStore.store(session);
         const redirectUrl = await localAuth.buildProviderAuthorizeUrl(providerId, {
           state: providerState,
@@ -36520,7 +36664,7 @@ var init_oauth_authorize_flow = __esm({
           callbackPath,
           fields: login?.fields ?? {}
         };
-        return (0, import_auth21.renderLocalLoginPage)(login, ctx);
+        return (0, import_auth22.renderLocalLoginPage)(login, ctx);
       }
       /**
        * Render incremental authorization page for a single app using HTMX templates
@@ -36533,7 +36677,7 @@ var init_oauth_authorize_flow = __esm({
           appName,
           description: appDescription
         };
-        return (0, import_auth21.buildIncrementalAuthPage)({
+        return (0, import_auth22.buildIncrementalAuthPage)({
           app,
           toolId: toolId || "unknown tool",
           sessionHint: pendingAuthId,
@@ -36554,7 +36698,7 @@ var init_oauth_authorize_flow = __esm({
           appIds: provider.appIds.filter((id) => id !== "__parent__"),
           isPrimary: provider.isParentProvider
         }));
-        return (0, import_auth21.buildFederatedLoginPage)({
+        return (0, import_auth22.buildFederatedLoginPage)({
           providers,
           clientName: clientId,
           pendingAuthId,
@@ -36599,8 +36743,8 @@ var init_oauth_authorize_flow = __esm({
   <div class="error-container">
     <div class="error-icon">\u26A0\uFE0F</div>
     <h1>Authorization Error</h1>
-    <p><span class="error-code">${(0, import_auth21.escapeHtml)(error)}</span></p>
-    <p>${(0, import_auth21.escapeHtml)(description)}</p>
+    <p><span class="error-code">${(0, import_auth22.escapeHtml)(error)}</span></p>
+    <p>${(0, import_auth22.escapeHtml)(description)}</p>
   </div>
 </body>
 </html>`;
@@ -36649,11 +36793,11 @@ function timingSafeEqualStr3(a, b) {
   }
   return diff === 0;
 }
-var import_auth22, import_lazy_zod65, import_utils67, inputSchema17, stateSchema16, outputSchema16, plan16, name16, Stage16, OauthCallbackFlow;
+var import_auth23, import_lazy_zod65, import_utils67, inputSchema17, stateSchema16, outputSchema16, plan16, name16, Stage16, OauthCallbackFlow;
 var init_oauth_callback_flow = __esm({
   "libs/sdk/src/auth/flows/oauth.callback.flow.ts"() {
     "use strict";
-    import_auth22 = require("@frontmcp/auth");
+    import_auth23 = require("@frontmcp/auth");
     import_lazy_zod65 = require("@frontmcp/lazy-zod");
     import_utils67 = require("@frontmcp/utils");
     init_common();
@@ -36744,8 +36888,6 @@ var init_oauth_callback_flow = __esm({
         const email = request.query["email"];
         const name42 = request.query["name"];
         const loginFields = this.collectLoginFields(request);
-        const isIncremental = request.query["incremental"] === "true";
-        const targetAppId = request.query["app_id"];
         const isFederated = request.query["federated"] === "true";
         const providersParam = request.query["providers"];
         let selectedProviders;
@@ -36764,8 +36906,6 @@ var init_oauth_callback_flow = __esm({
           pendingAuthId,
           email,
           name: name42,
-          isIncremental,
-          targetAppId,
           isFederated,
           selectedProviders,
           selectedTools,
@@ -36773,9 +36913,6 @@ var init_oauth_callback_flow = __esm({
           loginFields,
           csrf
         });
-        if (isIncremental) {
-          this.logger.info(`Incremental auth callback for app: ${targetAppId}`);
-        }
         if (isFederated) {
           this.logger.info(`Federated login callback with ${selectedProviders?.length || 0} selected providers`);
         }
@@ -36784,31 +36921,13 @@ var init_oauth_callback_flow = __esm({
         }
       }
       async validatePendingAuth() {
-        const {
-          pendingAuthId,
-          email,
-          name: name42,
-          isIncremental,
-          isFederated,
-          selectedProviders,
-          selectedTools,
-          consentSubmitted,
-          loginFields
-        } = this.state;
+        const { pendingAuthId, email, name: name42, isFederated, selectedProviders, selectedTools, consentSubmitted, loginFields } = this.state;
         if (!pendingAuthId) {
           this.logger.warn("Missing pending_auth_id in callback");
           this.respond(httpRespond.html(this.renderErrorPage("invalid_request", "Missing pending_auth_id parameter"), 400));
           return;
         }
         const localAuth = this.scope.auth;
-        const localOptions = localAuth.options;
-        const authenticateFn = typeof localOptions.authenticate === "function" ? localOptions.authenticate : void 0;
-        const requireEmail = localOptions.requireEmail ?? true;
-        if (!authenticateFn && !isIncremental && !email && requireEmail) {
-          this.logger.warn("Missing email in callback");
-          this.respond(httpRespond.html(this.renderErrorPage("invalid_request", "Email is required"), 400));
-          return;
-        }
         const pendingAuth = await localAuth.authorizationStore.getPendingAuthorization(pendingAuthId);
         if (!pendingAuth) {
           this.logger.warn(`Pending authorization not found or expired: ${pendingAuthId}`);
@@ -36820,6 +36939,20 @@ var init_oauth_callback_flow = __esm({
           );
           return;
         }
+        const isIncremental = pendingAuth.isIncremental === true && typeof pendingAuth.incrementalSub === "string";
+        const targetAppId = isIncremental ? pendingAuth.targetAppId : void 0;
+        this.state.set({ isIncremental, targetAppId });
+        if (isIncremental) {
+          this.logger.info(`Incremental auth callback for app: ${targetAppId}`);
+        }
+        const localOptions = localAuth.options;
+        const authenticateFn = typeof localOptions.authenticate === "function" ? localOptions.authenticate : void 0;
+        const requireEmail = localOptions.requireEmail ?? true;
+        if (!authenticateFn && !isIncremental && !email && requireEmail) {
+          this.logger.warn("Missing email in callback");
+          this.respond(httpRespond.html(this.renderErrorPage("invalid_request", "Email is required"), 400));
+          return;
+        }
         if (pendingAuth.authUiCsrf) {
           const submitted = this.state.csrf;
           if (!submitted || !timingSafeEqualStr3(pendingAuth.authUiCsrf, submitted)) {
@@ -36834,9 +36967,11 @@ var init_oauth_callback_flow = __esm({
           return;
         }
         let userSub;
-        if (email) {
+        if (isIncremental) {
+          userSub = pendingAuth.incrementalSub;
+        } else if (email) {
           userSub = this.generateUserSub(email);
-        } else if (!requireEmail || isIncremental) {
+        } else if (!requireEmail) {
           const anonymousSubject = localOptions.anonymousSubject ?? "local-operator";
           userSub = this.generateUserSub(anonymousSubject);
         } else {
@@ -37005,10 +37140,13 @@ var init_oauth_callback_flow = __esm({
           originalState: pendingAuth.state,
           resource: pendingAuth.resource,
           userSub,
-          // Progressive/Incremental Authorization from pending record
-          isIncremental: pendingAuth.isIncremental || isIncremental,
-          targetAppId: pendingAuth.targetAppId || this.state.targetAppId,
-          targetToolId: pendingAuth.targetToolId,
+          // Progressive/Incremental Authorization — from the pending record ONLY.
+          // `isIncremental` was derived above from the record plus its proven
+          // subject; OR-ing a client-supplied flag in here is what let a caller
+          // override the server's `false` (GHSA-2c4g-9c8x-6m8g).
+          isIncremental,
+          targetAppId,
+          targetToolId: isIncremental ? pendingAuth.targetToolId : void 0,
           existingSessionId: pendingAuth.existingSessionId,
           existingAuthorizationId: pendingAuth.existingAuthorizationId,
           priorAuthorizedAppIds: pendingAuth.priorAuthorizedAppIds,
@@ -37091,7 +37229,7 @@ var init_oauth_callback_flow = __esm({
           this.respond(httpRespond.html(this.renderErrorPage("server_error", "Authorization request incomplete"), 500));
           return;
         }
-        const federatedSession = (0, import_auth22.createFederatedAuthSession)({
+        const federatedSession = (0, import_auth23.createFederatedAuthSession)({
           pendingAuthId: this.state.required.pendingAuthId || (0, import_utils67.randomUUID)(),
           clientId,
           redirectUri,
@@ -37120,7 +37258,7 @@ var init_oauth_callback_flow = __esm({
           method: "S256"
         };
         const providerState = `federated:${federatedSession.id}:${(0, import_utils67.randomUUID)()}`;
-        (0, import_auth22.startNextProvider)(federatedSession, pkce, providerState);
+        (0, import_auth23.startNextProvider)(federatedSession, pkce, providerState);
         await sessionStore.update(federatedSession);
         const providerConfig = localAuth.getProviderConfig(firstProviderId);
         if (!providerConfig) {
@@ -37424,7 +37562,7 @@ var init_oauth_callback_flow = __esm({
           fields: login?.fields ?? {},
           error: failure.message
         };
-        return (0, import_auth22.renderLocalLoginPage)(login, ctx, fields);
+        return (0, import_auth23.renderLocalLoginPage)(login, ctx, fields);
       }
       /**
        * Render a custom `@AuthUi({ slot: 'consent' })` page when one is registered.
@@ -37520,7 +37658,7 @@ var init_oauth_callback_flow = __esm({
         if (pendingAuth.authUiCsrf) {
           hiddenFields.push({ name: "csrf", value: pendingAuth.authUiCsrf });
         }
-        return (0, import_auth22.buildToolConsentPage)({
+        return (0, import_auth23.buildToolConsentPage)({
           tools: toolCards,
           clientName: pendingAuth.clientId,
           pendingAuthId: pendingAuth.id,
@@ -37553,8 +37691,8 @@ var init_oauth_callback_flow = __esm({
        * Render an error page
        */
       renderErrorPage(error, description) {
-        const safeError = (0, import_auth22.escapeHtml)(error);
-        const safeDescription = (0, import_auth22.escapeHtml)(description);
+        const safeError = (0, import_auth23.escapeHtml)(error);
+        const safeDescription = (0, import_auth23.escapeHtml)(description);
         return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -37612,6 +37750,7 @@ var init_oauth_callback_flow = __esm({
       "pending_auth_id",
       "incremental",
       "app_id",
+      "ticket",
       "federated",
       "providers",
       "tools",
@@ -37664,11 +37803,11 @@ var init_oauth_callback_flow = __esm({
 });
 
 // libs/sdk/src/auth/flows/oauth.connect.flow.ts
-var import_auth23, import_lazy_zod66, inputSchema18, stateSchema17, outputSchema17, plan17, name17, Stage17, RESERVED_CONNECT_PARAMS, OauthConnectFlow;
+var import_auth24, import_lazy_zod66, inputSchema18, stateSchema17, outputSchema17, plan17, name17, Stage17, RESERVED_CONNECT_PARAMS, OauthConnectFlow;
 var init_oauth_connect_flow = __esm({
   "libs/sdk/src/auth/flows/oauth.connect.flow.ts"() {
     "use strict";
-    import_auth23 = require("@frontmcp/auth");
+    import_auth24 = require("@frontmcp/auth");
     import_lazy_zod66 = require("@frontmcp/lazy-zod");
     init_common();
     inputSchema18 = httpInputSchema;
@@ -37778,7 +37917,7 @@ var init_oauth_connect_flow = __esm({
         }
         this.logger.info(`Connected ${stored} credential(s) mid-session for key "${payload.key}"`);
         this.notifyResourcesUpdated(payload.key);
-        this.respond(httpRespond.html((0, import_auth23.buildConnectSuccessPage)({ key: payload.key })));
+        this.respond(httpRespond.html((0, import_auth24.buildConnectSuccessPage)({ key: payload.key })));
       }
       // ============================================
       // Helpers
@@ -37786,7 +37925,7 @@ var init_oauth_connect_flow = __esm({
       /** Verify the signed resume token against the server secret (constant-time + expiry). */
       verifyToken(token, localAuth) {
         const secret = new TextDecoder().decode(localAuth.secret);
-        return (0, import_auth23.verifyCredentialResumeToken)(token, secret);
+        return (0, import_auth24.verifyCredentialResumeToken)(token, secret);
       }
       /** Resolve the single credential field to render from `login.fields` (first field), or a default. */
       resolveConnectField(login, key) {
@@ -37802,8 +37941,8 @@ var init_oauth_connect_flow = __esm({
       renderConnectPage(payload, login, token, error) {
         const { name: name42, def } = this.resolveConnectField(login, payload.key);
         const action = `${this.scope.fullPath}/oauth/connect`;
-        const [field] = (0, import_auth23.toLoginExtraFields)({ [name42]: def });
-        return (0, import_auth23.buildConnectPage)({
+        const [field] = (0, import_auth24.toLoginExtraFields)({ [name42]: def });
+        return (0, import_auth24.buildConnectPage)({
           token,
           field,
           action,
@@ -37902,8 +38041,8 @@ var init_oauth_connect_flow = __esm({
         return `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><title>Connect Error</title></head>
 <body style="font-family:-apple-system,sans-serif;padding:40px;text-align:center">
 <h1 style="color:#e53e3e">Connect Error</h1>
-<p><code>${(0, import_auth23.escapeHtml)(error)}</code></p>
-<p>${(0, import_auth23.escapeHtml)(description)}</p>
+<p><code>${(0, import_auth24.escapeHtml)(error)}</code></p>
+<p>${(0, import_auth24.escapeHtml)(description)}</p>
 </body></html>`;
       }
     };
@@ -37930,11 +38069,11 @@ var init_oauth_connect_flow = __esm({
 });
 
 // libs/sdk/src/auth/flows/oauth.provider-callback.flow.ts
-var import_auth24, import_lazy_zod67, import_utils68, inputSchema19, stateSchema18, outputSchema18, plan18, name18, Stage18, OauthProviderCallbackFlow;
+var import_auth25, import_lazy_zod67, import_utils68, inputSchema19, stateSchema18, outputSchema18, plan18, name18, Stage18, OauthProviderCallbackFlow;
 var init_oauth_provider_callback_flow = __esm({
   "libs/sdk/src/auth/flows/oauth.provider-callback.flow.ts"() {
     "use strict";
-    import_auth24 = require("@frontmcp/auth");
+    import_auth25 = require("@frontmcp/auth");
     import_lazy_zod67 = require("@frontmcp/lazy-zod");
     import_utils68 = require("@frontmcp/utils");
     init_common();
@@ -38037,7 +38176,7 @@ var init_oauth_provider_callback_flow = __esm({
           );
           return;
         }
-        if (!(0, import_auth24.isSessionComplete)(session)) {
+        if (!(0, import_auth25.isSessionComplete)(session)) {
           this.respond(
             httpRespond.html(this.renderErrorPage("invalid_request", "Authentication is still in progress."), 400)
           );
@@ -38236,7 +38375,7 @@ var init_oauth_provider_callback_flow = __esm({
           this.logger.info(`Stored tokens for provider ${providerId} (temp auth: ${tempAuthId})`);
         }
         if (tokens) {
-          (0, import_auth24.completeCurrentProvider)(session, tokens, userInfo);
+          (0, import_auth25.completeCurrentProvider)(session, tokens, userInfo);
           if (userInfo) {
             if (!session.userInfo.sub && userInfo.sub) {
               session.userInfo.sub = userInfo.sub;
@@ -38269,11 +38408,11 @@ var init_oauth_provider_callback_flow = __esm({
           return;
         }
         const localAuth = this.getLocalAuth();
-        if ((0, import_auth24.isSessionComplete)(session)) {
+        if ((0, import_auth25.isSessionComplete)(session)) {
           this.logger.info("All providers authenticated, completing federated auth flow");
           return this.completeFederatedAuth(session);
         }
-        const nextProviderId = (0, import_auth24.getNextProvider)(session);
+        const nextProviderId = (0, import_auth25.getNextProvider)(session);
         if (!nextProviderId) {
           return this.completeFederatedAuth(session);
         }
@@ -38285,7 +38424,7 @@ var init_oauth_provider_callback_flow = __esm({
           method: "S256"
         };
         const providerState = `federated:${session.id}:${(0, import_utils68.randomUUID)()}`;
-        (0, import_auth24.startNextProvider)(session, pkce, providerState);
+        (0, import_auth25.startNextProvider)(session, pkce, providerState);
         const sessionStore = localAuth.federatedSessionStore;
         if (sessionStore) {
           await sessionStore.update(session);
@@ -38448,7 +38587,7 @@ var init_oauth_provider_callback_flow = __esm({
       renderConsentScreen(session, consentConfig, error, preSelectedTools) {
         const callbackPath = `${this.scope.fullPath}/oauth/provider/_consent/callback`;
         const { toolCards } = projectConsentTools(this.scope, consentConfig.excludedTools);
-        return (0, import_auth24.buildToolConsentPage)({
+        return (0, import_auth25.buildToolConsentPage)({
           tools: toolCards,
           clientName: session.clientId,
           // The pending_auth_id input is unused on the federated round-trip (we key
@@ -38485,8 +38624,8 @@ var init_oauth_provider_callback_flow = __esm({
        * Render an error page
        */
       renderErrorPage(error, description) {
-        const safeError = (0, import_auth24.escapeHtml)(error);
-        const safeDescription = (0, import_auth24.escapeHtml)(description);
+        const safeError = (0, import_auth25.escapeHtml)(error);
+        const safeDescription = (0, import_auth25.escapeHtml)(description);
         return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -39229,12 +39368,12 @@ var init_oauth_token_flow = __esm({
 });
 
 // libs/sdk/src/auth/flows/oauth.userinfo.flow.ts
-var import_reflect_metadata16, import_auth25, import_lazy_zod70, inputSchema22, stateSchema21, outputSchema21, plan21, name21, Stage21, OauthUserInfoFlow;
+var import_reflect_metadata16, import_auth26, import_lazy_zod70, inputSchema22, stateSchema21, outputSchema21, plan21, name21, Stage21, OauthUserInfoFlow;
 var init_oauth_userinfo_flow = __esm({
   "libs/sdk/src/auth/flows/oauth.userinfo.flow.ts"() {
     "use strict";
     import_reflect_metadata16 = require("reflect-metadata");
-    import_auth25 = require("@frontmcp/auth");
+    import_auth26 = require("@frontmcp/auth");
     import_lazy_zod70 = require("@frontmcp/lazy-zod");
     init_common();
     inputSchema22 = httpInputSchema;
@@ -39254,7 +39393,7 @@ var init_oauth_userinfo_flow = __esm({
       async parseInput() {
         const { request } = this.rawInput;
         const authorizationHeader = request.headers?.["authorization"] ?? void 0;
-        const token = (0, import_auth25.extractBearerToken)(authorizationHeader);
+        const token = (0, import_auth26.extractBearerToken)(authorizationHeader);
         const baseUrl = getRequestBaseUrl(request, this.scope.entryPath);
         this.state.set({ token, baseUrl });
       }
@@ -39325,13 +39464,13 @@ var init_oauth_userinfo_flow = __esm({
 });
 
 // libs/sdk/src/auth/flows/session.verify.flow.ts
-var import_reflect_metadata17, import_auth26, import_lazy_zod71, import_utils71, inputSchema23, stateSchema22, UnauthorizedSchema, AuthorizedSchema, ForbiddenSchema, sessionVerifyOutputSchema, plan22, name22, Stage22, warnedUnpinnedAudience, SessionVerifyFlow;
+var import_reflect_metadata17, import_auth27, import_lazy_zod71, import_utils71, inputSchema23, stateSchema22, UnauthorizedSchema, AuthorizedSchema, ForbiddenSchema, sessionVerifyOutputSchema, plan22, name22, Stage22, warnedUnpinnedAudience, SessionVerifyFlow;
 var init_session_verify_flow = __esm({
   "libs/sdk/src/auth/flows/session.verify.flow.ts"() {
     "use strict";
     init_common();
     import_reflect_metadata17 = require("reflect-metadata");
-    import_auth26 = require("@frontmcp/auth");
+    import_auth27 = require("@frontmcp/auth");
     import_lazy_zod71 = require("@frontmcp/lazy-zod");
     import_utils71 = require("@frontmcp/utils");
     init_notification_service();
@@ -39426,7 +39565,7 @@ var init_session_verify_flow = __esm({
           authMode,
           ...platformType !== "unknown" && { platformType }
         };
-        const sessionId = (0, import_auth26.encryptJson)(payload);
+        const sessionId = (0, import_auth27.encryptJson)(payload);
         this.respond({
           kind: "authorized",
           authorization: {
@@ -39447,11 +39586,11 @@ var init_session_verify_flow = __esm({
         const sessionIdQuery = request.query["sessionId"];
         const sessionIdHeader = sessionIdRawHeader ?? sessionIdQuery ?? void 0;
         const sessionProtocol = httpTransportHeader ? "http" : sessionIdRawHeader ? "streamable-http" : sessionIdQuery ? "sse" : void 0;
-        const token = (0, import_auth26.extractBearerToken)(authorizationHeader);
+        const token = (0, import_auth27.extractBearerToken)(authorizationHeader);
         const userAgent = request.headers?.["user-agent"] ?? void 0;
         const prmMetadataPath = `/.well-known/oauth-protected-resource${entryPath}${routeBase}`;
         const prmUrl = `${getRequestBaseUrl(request)}${prmMetadataPath}`;
-        const prmMetadataHeader = (0, import_auth26.buildUnauthorizedHeader)(prmUrl);
+        const prmMetadataHeader = (0, import_auth27.buildUnauthorizedHeader)(prmUrl);
         this.logger.verbose("parseInput", {
           hasAuthHeader: !!authorizationHeader,
           hasToken: !!token,
@@ -39505,7 +39644,7 @@ var init_session_verify_flow = __esm({
         });
       }
       async verifyIfJwt() {
-        const jwks = this.get(import_auth26.JwksService);
+        const jwks = this.get(import_auth27.JwksService);
         const token = this.state.token;
         if (!token) {
           this.logger.warn("verifyIfJwt: missing or empty bearer token, returning 401");
@@ -39515,11 +39654,11 @@ var init_session_verify_flow = __esm({
           });
           return;
         }
-        if (!(0, import_auth26.isJwt)(token)) {
+        if (!(0, import_auth27.isJwt)(token)) {
           this.logger.warn("verifyIfJwt: token is not a JWT, returning 401");
           this.respond({
             kind: "unauthorized",
-            prmMetadataHeader: (0, import_auth26.buildInvalidTokenHeader)(this.state.required.prmUrl, "Token is not a valid JWT")
+            prmMetadataHeader: (0, import_auth27.buildInvalidTokenHeader)(this.state.required.prmUrl, "Token is not a valid JWT")
           });
           return;
         }
@@ -39564,8 +39703,8 @@ var init_session_verify_flow = __esm({
                 "transparent audience validation is deriving the expected audience from the request Host: set auth.expectedAudience or FRONTMCP_PUBLIC_URL to bind tokens to a fixed resource. X-Forwarded-Host is ignored unless FRONTMCP_TRUST_PROXY is enabled."
               );
             }
-            const expectedAudiences = configuredAudience ? Array.isArray(configuredAudience) ? configuredAudience : [configuredAudience] : (0, import_auth26.deriveExpectedAudience)(this.state.required.baseUrl);
-            const audResult = (0, import_auth26.validateAudience)(result.payload?.["aud"], {
+            const expectedAudiences = configuredAudience ? Array.isArray(configuredAudience) ? configuredAudience : [configuredAudience] : (0, import_auth27.deriveExpectedAudience)(this.state.required.baseUrl);
+            const audResult = (0, import_auth27.validateAudience)(result.payload?.["aud"], {
               expectedAudiences,
               // By default accept tokens with no `aud` claim: many IdPs omit it, and
               // rejecting them here would break existing transparent deployments.
@@ -39579,7 +39718,7 @@ var init_session_verify_flow = __esm({
               this.logger.warn("verifyIfJwt: audience validation failed", { error: audResult.error });
               this.respond({
                 kind: "unauthorized",
-                prmMetadataHeader: (0, import_auth26.buildInvalidTokenHeader)(
+                prmMetadataHeader: (0, import_auth27.buildInvalidTokenHeader)(
                   this.state.required.prmUrl,
                   audResult.error ?? "Token audience is not valid for this resource"
                 )
@@ -39599,7 +39738,7 @@ var init_session_verify_flow = __esm({
               });
               this.respond({
                 kind: "forbidden",
-                prmMetadataHeader: (0, import_auth26.buildInsufficientScopeHeader)(this.state.required.prmUrl, requiredScopes)
+                prmMetadataHeader: (0, import_auth27.buildInsufficientScopeHeader)(this.state.required.prmUrl, requiredScopes)
               });
               return;
             }
@@ -39609,14 +39748,14 @@ var init_session_verify_flow = __esm({
         this.logger.warn("verifyIfJwt: JWT verification failed", { error: result.error });
         this.respond({
           kind: "unauthorized",
-          prmMetadataHeader: (0, import_auth26.buildInvalidTokenHeader)(
+          prmMetadataHeader: (0, import_auth27.buildInvalidTokenHeader)(
             this.state.required.prmUrl,
             result.error ?? "Token verification failed"
           )
         });
       }
       async deriveUser() {
-        this.state.set("user", (0, import_auth26.deriveTypedUser)(this.state.required.jwtPayload ?? {}));
+        this.state.set("user", (0, import_auth27.deriveTypedUser)(this.state.required.jwtPayload ?? {}));
       }
       async parseSessionHeader() {
         const {
@@ -39702,13 +39841,13 @@ var init_session_verify_flow = __esm({
 });
 
 // libs/sdk/src/auth/flows/well-known.jwks.flow.ts
-var import_reflect_metadata18, import_auth27, import_lazy_zod72, inputSchema24, stateSchema23, outputSchema22, plan23, name23, Stage23, WellKnownJwksFlow;
+var import_reflect_metadata18, import_auth28, import_lazy_zod72, inputSchema24, stateSchema23, outputSchema22, plan23, name23, Stage23, WellKnownJwksFlow;
 var init_well_known_jwks_flow = __esm({
   "libs/sdk/src/auth/flows/well-known.jwks.flow.ts"() {
     "use strict";
     init_common();
     import_reflect_metadata18 = require("reflect-metadata");
-    import_auth27 = require("@frontmcp/auth");
+    import_auth28 = require("@frontmcp/auth");
     import_lazy_zod72 = require("@frontmcp/lazy-zod");
     init_auth_internal_errors();
     inputSchema24 = httpInputSchema;
@@ -39734,7 +39873,7 @@ var init_well_known_jwks_flow = __esm({
       }
       async collectData() {
         const { isOrchestrated } = this.state.required;
-        const jwksSvc = this.get(import_auth27.JwksService);
+        const jwksSvc = this.get(import_auth28.JwksService);
         if (isOrchestrated) {
           const keysDoc = await jwksSvc.getPublicJwks();
           if (!keysDoc?.keys || !Array.isArray(keysDoc.keys)) {
@@ -40064,9 +40203,9 @@ function createSecureStoreProviders(opts) {
     name: "SecureStoreBackend"
   };
   const accessorProvider = {
-    provide: import_auth28.SECURE_STORE_ACCESSOR,
+    provide: import_auth29.SECURE_STORE_ACCESSOR,
     inject: () => [FRONTMCP_CONTEXT, FrontMcpLogger],
-    useFactory: (ctx, logger) => new import_auth28.SecureStoreAccessorImpl({
+    useFactory: (ctx, logger) => new import_auth29.SecureStoreAccessorImpl({
       backend,
       scope,
       resolveSub: () => resolveRequestSub(ctx),
@@ -40079,11 +40218,11 @@ function createSecureStoreProviders(opts) {
   };
   return [backendProvider, accessorProvider];
 }
-var import_auth28, import_di32, SECURE_STORE_BACKEND;
+var import_auth29, import_di32, SECURE_STORE_BACKEND;
 var init_secure_store_providers = __esm({
   "libs/sdk/src/auth/secure-store/secure-store.providers.ts"() {
     "use strict";
-    import_auth28 = require("@frontmcp/auth");
+    import_auth29 = require("@frontmcp/auth");
     import_di32 = require("@frontmcp/di");
     init_common();
     init_frontmcp_context_provider();
@@ -40093,14 +40232,14 @@ var init_secure_store_providers = __esm({
 });
 
 // libs/sdk/src/auth/secure-store/secure-store.context-extension.ts
-var import_auth29, secureStoreContextExtension;
+var import_auth30, secureStoreContextExtension;
 var init_secure_store_context_extension = __esm({
   "libs/sdk/src/auth/secure-store/secure-store.context-extension.ts"() {
     "use strict";
-    import_auth29 = require("@frontmcp/auth");
+    import_auth30 = require("@frontmcp/auth");
     secureStoreContextExtension = {
       property: "secureStore",
-      token: import_auth29.SECURE_STORE_ACCESSOR,
+      token: import_auth30.SECURE_STORE_ACCESSOR,
       errorMessage: "The secure store is not available. Ensure the server uses auth mode 'local' (or 'remote'); the secure store is enabled automatically there."
     };
   }
@@ -40135,12 +40274,15 @@ function validateAuthorizationIssuer(received, expected) {
   }
   return { ok: true };
 }
-var import_jose, import_auth30, import_utils73, defaultNoAuthSecret, RESERVED_JWT_CLAIMS, LocalPrimaryAuth;
+function isUnsupportedOperation(error) {
+  return error instanceof import_utils73.StorageNotSupportedError;
+}
+var import_jose, import_auth31, import_utils73, defaultNoAuthSecret, RESERVED_JWT_CLAIMS, LocalPrimaryAuth;
 var init_instance_local_primary_auth = __esm({
   "libs/sdk/src/auth/instances/instance.local-primary-auth.ts"() {
     "use strict";
     import_jose = require("jose");
-    import_auth30 = require("@frontmcp/auth");
+    import_auth31 = require("@frontmcp/auth");
     import_utils73 = require("@frontmcp/utils");
     init_common();
     init_auth2();
@@ -40196,17 +40338,17 @@ var init_instance_local_primary_auth = __esm({
           this.secret = getDefaultNoAuthSecret();
         }
         this.tokenStorage = this.readTokenStorage(options);
-        this.authorizationStoreImpl = new import_auth30.InMemoryAuthorizationStore();
-        this.federatedSessionStoreImpl = new import_auth30.InMemoryFederatedAuthSessionStore();
-        this.orchestratedTokenStoreImpl = new import_auth30.InMemoryOrchestratedTokenStore({
+        this.authorizationStoreImpl = new import_auth31.InMemoryAuthorizationStore();
+        this.federatedSessionStoreImpl = new import_auth31.InMemoryFederatedAuthSessionStore();
+        this.orchestratedTokenStoreImpl = new import_auth31.InMemoryOrchestratedTokenStore({
           encryptionKey: this.secret
           // Reuse JWT secret for token encryption
         });
-        this.consentStoreImpl = new import_auth30.InMemoryConsentStore();
-        this.dcrClientRegistryImpl = new import_auth30.DcrClientRegistry(this.getDcrConfig() ?? {});
+        this.consentStoreImpl = new import_auth31.InMemoryConsentStore();
+        this.dcrClientRegistryImpl = new import_auth31.DcrClientRegistry(this.getDcrConfig() ?? {});
         if ((0, import_auth10.isOrchestratedMode)(options)) {
           const cimdConfig = options.cimd;
-          this.cimdService = new import_auth18.CimdService(this.logger, cimdConfig);
+          this.cimdService = new import_auth19.CimdService(this.logger, cimdConfig);
         }
         this.ready = this.initialize();
       }
@@ -40218,7 +40360,7 @@ var init_instance_local_primary_auth = __esm({
       keys = [];
       secret;
       logger;
-      jwks = new import_auth30.JwksService();
+      jwks = new import_auth31.JwksService();
       cimdService;
       /**
        * Token storage backend selected from `options.tokenStorage`.
@@ -40249,6 +40391,17 @@ var init_instance_local_primary_auth = __esm({
       dcrClientRegistryImpl;
       /** Storage adapter backing the persistent stores (kept for disposal). */
       storageAdapter;
+      /**
+       * Replay guard for incremental-authorization tickets (GHSA-2c4g-9c8x-6m8g).
+       * Shares the persistent adapter when one is configured so the guard holds
+       * across a distributed deployment; falls back to a dedicated in-memory
+       * adapter, matching how the credential vault selects its backing store.
+       *
+       * Holds the in-flight PROMISE, not the resolved adapter: two concurrent
+       * claims for the same ticket must not each build their own store, or each
+       * would write and read back its own nonce and both would win.
+       */
+      ticketReplayStorage;
       /**
        * Per-session encrypted credential vault (Checkpoint 3b). Backs
        * `this.credentials` in tools and persists `authenticate()` credentials.
@@ -40386,19 +40539,19 @@ var init_instance_local_primary_auth = __esm({
        * key, so upstream provider tokens stay encrypted at rest in every backend.
        */
       async initializeStores() {
-        if (!(0, import_auth30.isPersistentTokenStorage)(this.tokenStorage)) {
+        if (!(0, import_auth31.isPersistentTokenStorage)(this.tokenStorage)) {
           return;
         }
         try {
-          const adapter = await (0, import_auth30.createTokenStorageAdapter)(this.tokenStorage);
+          const adapter = await (0, import_auth31.createTokenStorageAdapter)(this.tokenStorage);
           this.storageAdapter = adapter;
-          this.authorizationStoreImpl = new import_auth30.StorageAuthorizationStore(adapter);
-          this.federatedSessionStoreImpl = new import_auth30.StorageFederatedAuthSessionStore(adapter);
-          this.orchestratedTokenStoreImpl = new import_auth30.StorageOrchestratedTokenStore(adapter, {
+          this.authorizationStoreImpl = new import_auth31.StorageAuthorizationStore(adapter);
+          this.federatedSessionStoreImpl = new import_auth31.StorageFederatedAuthSessionStore(adapter);
+          this.orchestratedTokenStoreImpl = new import_auth31.StorageOrchestratedTokenStore(adapter, {
             encryptionKey: this.secret
           });
-          this.consentStoreImpl = new import_auth30.StorageConsentStore(adapter);
-          const backend = (0, import_auth30.isSqliteTokenStorage)(this.tokenStorage) ? "sqlite" : (0, import_auth30.isRedisTokenStorage)(this.tokenStorage) ? "redis" : "unknown";
+          this.consentStoreImpl = new import_auth31.StorageConsentStore(adapter);
+          const backend = (0, import_auth31.isSqliteTokenStorage)(this.tokenStorage) ? "sqlite" : (0, import_auth31.isRedisTokenStorage)(this.tokenStorage) ? "redis" : "unknown";
           this.logger.info(`Token storage initialized with persistent backend: ${backend}`);
         } catch (err) {
           this.logger.error("Failed to initialize persistent token storage", err);
@@ -40416,6 +40569,81 @@ var init_instance_local_primary_auth = __esm({
        * (`this.secret`), so resume URLs are framework-signed with the same trust
        * root as the access tokens.
        */
+      /**
+       * The server HMAC signing key, as the string form the `signData`/`verifyData`
+       * helpers take. These are the exact bytes the access tokens are signed with,
+       * so framework-signed URLs share the access tokens' trust root.
+       */
+      get signingSecret() {
+        return new TextDecoder().decode(this.secret);
+      }
+      /**
+       * Claim an incremental-authorization ticket, exactly once.
+       *
+       * A signature check proves a ticket was minted by this server for a verified
+       * subject; it cannot prove the ticket has not already been used. The `auth_url`
+       * carrying the ticket travels through agent transcripts and server logs, so a
+       * leaked ticket must not stay usable for the rest of its TTL.
+       *
+       * The claim is race-free without a transaction: each attempt writes its OWN
+       * nonce under `ifNotExists` and reads the key back. Only the attempt whose
+       * nonce survives won, so concurrent replays all lose.
+       *
+       * @returns true when this caller claimed the ticket, false when it was already used.
+       */
+      async claimIncrementalTicket(jti, ttlMs) {
+        const key = `incremental-ticket:${jti}`;
+        const nonce = (0, import_utils73.randomUUID)();
+        const ttlSeconds = Math.max(1, Math.ceil(ttlMs / 1e3));
+        let storage = await this.getTicketReplayStorage();
+        try {
+          await storage.set(key, nonce, { ifNotExists: true, ttlSeconds });
+        } catch (error) {
+          if (!isUnsupportedOperation(error)) {
+            this.logger.warn(`Incremental ticket replay guard unavailable: ${String(error)}`);
+            return false;
+          }
+          this.logger.warn(
+            "Incremental ticket replay guard: the configured storage has no conditional write; falling back to an in-memory guard (single use holds within this instance only)."
+          );
+          storage = await this.useInMemoryTicketReplayStorage();
+          try {
+            await storage.set(key, nonce, { ifNotExists: true, ttlSeconds });
+          } catch (fallbackError) {
+            this.logger.warn(`Incremental ticket replay guard unavailable: ${String(fallbackError)}`);
+            return false;
+          }
+        }
+        try {
+          return await storage.get(key) === nonce;
+        } catch (error) {
+          this.logger.warn(`Incremental ticket replay guard unavailable: ${String(error)}`);
+          return false;
+        }
+      }
+      getTicketReplayStorage() {
+        if (!this.ticketReplayStorage) {
+          if (this.storageAdapter) {
+            this.ticketReplayStorage = Promise.resolve(this.storageAdapter);
+          } else {
+            this.logger.debug(
+              "Incremental ticket replay guard is in-memory (no persistent tokenStorage configured); single use holds within this instance only."
+            );
+            this.ticketReplayStorage = this.useInMemoryTicketReplayStorage();
+          }
+        }
+        return this.ticketReplayStorage;
+      }
+      /** Replace the replay guard with a fresh in-memory adapter, memoized. */
+      useInMemoryTicketReplayStorage() {
+        const pending = (async () => {
+          const memory = new import_utils73.MemoryStorageAdapter();
+          await memory.connect();
+          return memory;
+        })();
+        this.ticketReplayStorage = pending;
+        return pending;
+      }
       async initializeCredentialVault() {
         if ((0, import_auth10.isPublicMode)(this.options)) {
           return;
@@ -40429,12 +40657,12 @@ var init_instance_local_primary_auth = __esm({
           storage = memory;
         }
         const pepper = (0, import_utils73.getEnv)("VAULT_SECRET") ?? (0, import_utils73.getEnv)("JWT_SECRET") ?? void 0;
-        this.credentialVaultImpl = new import_auth30.SessionCredentialVault({
+        this.credentialVaultImpl = new import_auth31.SessionCredentialVault({
           storage,
           pepper,
           logger: this.logger.child("SessionCredentialVault")
         });
-        const signingSecret = new TextDecoder().decode(this.secret);
+        const signingSecret = this.signingSecret;
         const basePath = this.issuer;
         await this.providers.addDynamicProviders(
           createCredentialsProviders({
@@ -40480,7 +40708,7 @@ var init_instance_local_primary_auth = __esm({
         const config = this.readSecureStoreConfig();
         const reuseAdapter = this.storageAdapter && this.secureStoreSharesTokenStorage(config) ? this.storageAdapter : void 0;
         const pepper = (0, import_utils73.getEnv)("VAULT_SECRET") ?? (0, import_utils73.getEnv)("JWT_SECRET") ?? new TextDecoder().decode(this.secret);
-        const resolved = await (0, import_auth30.createSecureStore)({
+        const resolved = await (0, import_auth31.createSecureStore)({
           config,
           pepper,
           storage: reuseAdapter,
@@ -40507,8 +40735,8 @@ var init_instance_local_primary_auth = __esm({
        */
       secureStoreSharesTokenStorage(config) {
         if (typeof config !== "object" || config === null) return false;
-        if ("sqlite" in config && config.sqlite) return (0, import_auth30.isSqliteTokenStorage)(this.tokenStorage);
-        if ("redis" in config && config.redis) return (0, import_auth30.isRedisTokenStorage)(this.tokenStorage);
+        if ("sqlite" in config && config.sqlite) return (0, import_auth31.isSqliteTokenStorage)(this.tokenStorage);
+        if ("redis" in config && config.redis) return (0, import_auth31.isRedisTokenStorage)(this.tokenStorage);
         return false;
       }
       async signAnonymousJwt() {
@@ -40636,7 +40864,7 @@ var init_instance_local_primary_auth = __esm({
             error_description: "Redirect URI does not match"
           };
         }
-        if (!(0, import_auth30.verifyPkce)(codeVerifier, codeRecord.pkce)) {
+        if (!(0, import_auth31.verifyPkce)(codeVerifier, codeRecord.pkce)) {
           this.logger.warn(`PKCE verification failed`);
           return {
             error: "invalid_grant",
@@ -40807,7 +41035,7 @@ var init_instance_local_primary_auth = __esm({
             scope: import_di4.ProviderScope.GLOBAL,
             name: "auth:jwk-service"
           },
-          provide: import_auth30.JwksService
+          provide: import_auth31.JwksService
         });
         if (this.cimdService) {
           this.providers.injectProvider({
@@ -40816,7 +41044,7 @@ var init_instance_local_primary_auth = __esm({
               scope: import_di4.ProviderScope.GLOBAL,
               name: "auth:cimd-service"
             },
-            provide: import_auth18.CimdService
+            provide: import_auth19.CimdService
           });
           this.logger.debug("CIMD service registered");
         }
@@ -41182,11 +41410,11 @@ var init_instance_local_primary_auth = __esm({
 });
 
 // libs/sdk/src/auth/instances/instance.remote-primary-auth.ts
-var import_auth32, RemotePrimaryAuth;
+var import_auth33, RemotePrimaryAuth;
 var init_instance_remote_primary_auth = __esm({
   "libs/sdk/src/auth/instances/instance.remote-primary-auth.ts"() {
     "use strict";
-    import_auth32 = require("@frontmcp/auth");
+    import_auth33 = require("@frontmcp/auth");
     init_common();
     init_session_verify_flow();
     init_well_known_jwks_flow();
@@ -41202,7 +41430,7 @@ var init_instance_remote_primary_auth = __esm({
       scope;
       providers;
       ready;
-      jwks = new import_auth32.JwksService();
+      jwks = new import_auth33.JwksService();
       fetch(input, init) {
         return fetch(input, init);
       }
@@ -41220,7 +41448,7 @@ var init_instance_remote_primary_auth = __esm({
             scope: import_di4.ProviderScope.GLOBAL,
             name: "auth:jwk-service"
           },
-          provide: import_auth32.JwksService
+          provide: import_auth33.JwksService
         });
         await this.registerAuthFlows(scope);
         return Promise.resolve();
@@ -41238,12 +41466,12 @@ var init_instance_remote_primary_auth = __esm({
 });
 
 // libs/sdk/src/auth/auth.registry.ts
-var import_reflect_metadata21, import_auth33, import_di33, DEFAULT_AUTH_OPTIONS, AuthRegistry;
+var import_reflect_metadata21, import_auth34, import_di33, DEFAULT_AUTH_OPTIONS, AuthRegistry;
 var init_auth_registry = __esm({
   "libs/sdk/src/auth/auth.registry.ts"() {
     "use strict";
     import_reflect_metadata21 = require("reflect-metadata");
-    import_auth33 = require("@frontmcp/auth");
+    import_auth34 = require("@frontmcp/auth");
     import_di33 = require("@frontmcp/di");
     init_common();
     init_context_extension();
@@ -41275,7 +41503,7 @@ var init_auth_registry = __esm({
         this.logger = providers.get(FrontMcpLogger).child("AuthRegistry");
         this.parsedOptions = (0, import_auth10.parseAuthOptions)(primaryInput ?? DEFAULT_AUTH_OPTIONS);
         const appAuthInfos = this.extractAppAuthInfo(scope);
-        this.detection = (0, import_auth33.detectAuthProviders)(this.parsedOptions, appAuthInfos);
+        this.detection = (0, import_auth34.detectAuthProviders)(this.parsedOptions, appAuthInfos);
         this.requiresOrchestration = this.detection.requiresOrchestration;
         this.logDetectionResults();
         this.validateConfiguration();
@@ -44733,6 +44961,7 @@ var init_execute_workflow_tool = __esm({
     "use strict";
     import_lazy_zod81 = require("@frontmcp/lazy-zod");
     init_common();
+    init_errors();
     ExecuteWorkflowTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -44744,12 +44973,13 @@ var init_execute_workflow_tool = __esm({
         }
         const workflow = workflowRegistry.findByName(input.name);
         if (!workflow) {
-          return this.fail(new Error(`Workflow "${input.name}" not found`));
+          return this.fail(new JobNotAuthorizedError(input.name));
         }
         const result = await executionManager.executeWorkflow(workflow, jobRegistry, {
           background: input.background,
           sessionId: this.authInfo.sessionId,
           authInfo: this.authInfo,
+          authoritiesContextBuilder: this.scope.authoritiesContextBuilder,
           workflowInput: input.input
         });
         return result;
@@ -44774,6 +45004,55 @@ var init_execute_workflow_tool = __esm({
   }
 });
 
+// libs/sdk/src/common/utils/principal.utils.ts
+function toStringArray(value) {
+  if (Array.isArray(value)) return value.filter((v) => typeof v === "string");
+  if (typeof value === "string" && value.length > 0) return value.split(" ").filter(Boolean);
+  return [];
+}
+function asRecord(value) {
+  return value && typeof value === "object" ? value : void 0;
+}
+function firstPresent(sources, convert) {
+  for (const source of sources) {
+    if (source !== void 0 && source !== null) return convert(source);
+  }
+  return [];
+}
+function resolvePrincipal2(authInfo, contextBuilder) {
+  const info = authInfo ?? {};
+  const user = asRecord(info["user"]) ?? {};
+  const extraAuthorization = asRecord(asRecord(info["extra"])?.["authorization"]);
+  const authInfoClaims = asRecord(info["claims"]) ?? {};
+  const authorizationClaims = asRecord(extraAuthorization?.["claims"]) ?? {};
+  const claims = { ...authorizationClaims, ...authInfoClaims, ...user };
+  const scopes = toStringArray(info["scopes"]).length ? toStringArray(info["scopes"]) : firstPresent([extraAuthorization?.["scopes"], claims["scope"], claims["scopes"]], toStringArray);
+  if (contextBuilder) {
+    const ctx = contextBuilder.build(info);
+    return {
+      sub: ctx.user.sub,
+      roles: ctx.user.roles,
+      permissions: ctx.user.permissions,
+      scopes,
+      claims: ctx.user.claims
+    };
+  }
+  const roles = firstPresent([user["roles"], claims["roles"], extraAuthorization?.["scopes"]], toStringArray);
+  const permissions = firstPresent([user["permissions"], claims["permissions"]], toStringArray);
+  return {
+    sub: typeof user["sub"] === "string" ? user["sub"] : "",
+    roles,
+    permissions,
+    scopes,
+    claims
+  };
+}
+var init_principal_utils = __esm({
+  "libs/sdk/src/common/utils/principal.utils.ts"() {
+    "use strict";
+  }
+});
+
 // libs/sdk/src/workflow/tools/get-workflow-status.tool.ts
 var import_lazy_zod82, GetWorkflowStatusTool;
 var init_get_workflow_status_tool = __esm({
@@ -44781,6 +45060,7 @@ var init_get_workflow_status_tool = __esm({
     "use strict";
     import_lazy_zod82 = require("@frontmcp/lazy-zod");
     init_common();
+    init_principal_utils();
     GetWorkflowStatusTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -44789,7 +45069,7 @@ var init_get_workflow_status_tool = __esm({
           return this.fail(new Error("Jobs system is not enabled"));
         }
         const record = await executionManager.getStatus(input.runId);
-        if (!record) {
+        if (!record || !this.ownsRun(record)) {
           return this.fail(new Error(`Run "${input.runId}" not found`));
         }
         const workflowRecord = record;
@@ -44802,6 +45082,23 @@ var init_get_workflow_status_tool = __esm({
           completedAt: record.completedAt
         };
       }
+      /**
+       * Match on the owning subject, falling back to the session for runs started
+       * before an owner was recorded (and for anonymous/public servers, where every
+       * caller has an empty subject and the session is the only identity there is).
+       *
+       * A record carrying NEITHER identity is refused. Such a run cannot be
+       * attributed to anyone, and its inputs and results are exactly what this check
+       * exists to protect — anyone holding the id would otherwise be able to read
+       * it. Internal callers that must read unattributed runs should go through the
+       * execution manager directly rather than this tool.
+       */
+      ownsRun(record) {
+        const callerSub = resolvePrincipal2(this.authInfo, this.scope.authoritiesContextBuilder).sub;
+        if (record.ownerSub) return record.ownerSub === callerSub;
+        if (record.sessionId) return record.sessionId === this.authInfo.sessionId;
+        return false;
+      }
     };
     GetWorkflowStatusTool = __decorateClass([
       FrontMcpTool({
@@ -44829,6 +45126,53 @@ var init_get_workflow_status_tool = __esm({
   }
 });
 
+// libs/sdk/src/job/job-permission.guard.ts
+var JobPermissionGuard;
+var init_job_permission_guard = __esm({
+  "libs/sdk/src/job/job-permission.guard.ts"() {
+    "use strict";
+    init_principal_utils();
+    JobPermissionGuard = class _JobPermissionGuard {
+      /**
+       * Check whether the caller may perform `action`.
+       *
+       * @param permissions - the entry's declared rules (undefined = unrestricted).
+       * @param action - the action being attempted.
+       * @param authInfo - the request's AuthInfo.
+       * @param contextBuilder - the scope's authorities context builder, when configured.
+       */
+      static async check(permissions, action, authInfo, contextBuilder) {
+        if (!permissions || permissions.length === 0) {
+          return true;
+        }
+        const relevant = permissions.filter((p) => p.action === action);
+        if (relevant.length === 0) {
+          return true;
+        }
+        const principal = resolvePrincipal2(authInfo, contextBuilder);
+        for (const perm of relevant) {
+          const passed = await _JobPermissionGuard.checkSingle(perm, principal, authInfo);
+          if (!passed) return false;
+        }
+        return true;
+      }
+      static async checkSingle(perm, principal, authInfo) {
+        if (perm.roles && perm.roles.length > 0) {
+          if (!perm.roles.some((role) => principal.roles.includes(role))) return false;
+        }
+        if (perm.scopes && perm.scopes.length > 0) {
+          if (!perm.scopes.some((scope) => principal.scopes.includes(scope))) return false;
+        }
+        if (perm.custom) {
+          const result = await perm.custom(authInfo ?? {});
+          if (!result) return false;
+        }
+        return true;
+      }
+    };
+  }
+});
+
 // libs/sdk/src/workflow/tools/list-workflows.tool.ts
 var import_lazy_zod83, ListWorkflowsTool;
 var init_list_workflows_tool = __esm({
@@ -44836,6 +45180,7 @@ var init_list_workflows_tool = __esm({
     "use strict";
     import_lazy_zod83 = require("@frontmcp/lazy-zod");
     init_common();
+    init_job_permission_guard();
     ListWorkflowsTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -44847,7 +45192,11 @@ var init_list_workflows_tool = __esm({
           tags: input.tags,
           labels: input.labels
         });
-        const mapped = workflows.map((w) => ({
+        const visible = [];
+        for (const workflow of workflows) {
+          if (await this.maySee(workflow)) visible.push(workflow);
+        }
+        const mapped = visible.map((w) => ({
           name: w.name,
           description: w.metadata.description,
           trigger: w.getTrigger(),
@@ -44859,6 +45208,12 @@ var init_list_workflows_tool = __esm({
           count: mapped.length
         };
       }
+      async maySee(workflow) {
+        const permissions = workflow.metadata.permissions;
+        const builder = this.scope.authoritiesContextBuilder;
+        if (!await JobPermissionGuard.check(permissions, "list", this.authInfo, builder)) return false;
+        return JobPermissionGuard.check(permissions, "execute", this.authInfo, builder);
+      }
     };
     ListWorkflowsTool = __decorateClass([
       FrontMcpTool({
@@ -44894,6 +45249,7 @@ var init_register_workflow_tool = __esm({
     "use strict";
     import_lazy_zod84 = require("@frontmcp/lazy-zod");
     init_common();
+    init_errors();
     RegisterWorkflowTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -44901,6 +45257,9 @@ var init_register_workflow_tool = __esm({
         if (!workflowRegistry) {
           return this.fail(new Error("Workflows system is not enabled"));
         }
+        if (!this.dynamicRegistrationEnabled()) {
+          return this.fail(new DynamicJobRegistrationDisabledError("workflow"));
+        }
         const existing = workflowRegistry.findByName(input.name);
         if (existing) {
           return this.fail(new Error(`Workflow "${input.name}" already exists`));
@@ -44922,6 +45281,10 @@ var init_register_workflow_tool = __esm({
         });
         return { success: true, workflowId };
       }
+      dynamicRegistrationEnabled() {
+        const jobs = this.scope.metadata?.jobs;
+        return jobs?.allowDynamicRegistration === true;
+      }
     };
     RegisterWorkflowTool = __decorateClass([
       FrontMcpTool({
@@ -44960,6 +45323,8 @@ var init_remove_workflow_tool = __esm({
     "use strict";
     import_lazy_zod85 = require("@frontmcp/lazy-zod");
     init_common();
+    init_errors();
+    init_job_permission_guard();
     RemoveWorkflowTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -44969,7 +45334,16 @@ var init_remove_workflow_tool = __esm({
         }
         const workflow = workflowRegistry.findByName(input.name);
         if (!workflow) {
-          return this.fail(new Error(`Workflow "${input.name}" not found`));
+          return this.fail(new JobNotAuthorizedError(input.name));
+        }
+        const allowed = await JobPermissionGuard.check(
+          workflow.metadata.permissions,
+          "delete",
+          this.authInfo,
+          this.scope.authoritiesContextBuilder
+        );
+        if (!allowed) {
+          return this.fail(new JobNotAuthorizedError(input.name));
         }
         if (!workflow.isDynamic()) {
           return this.fail(new Error(`Workflow "${input.name}" is not dynamic and cannot be removed`));
@@ -45579,7 +45953,10 @@ var init_job_execution_manager = __esm({
   "libs/sdk/src/job/execution/job-execution.manager.ts"() {
     "use strict";
     import_utils79 = require("@frontmcp/utils");
+    init_principal_utils();
+    init_errors();
     init_workflow_engine();
+    init_job_permission_guard();
     JobExecutionManager = class {
       stateStore;
       logger;
@@ -45593,6 +45970,7 @@ var init_job_execution_manager = __esm({
        * Execute a job inline (synchronous) or in background.
        */
       async executeJob(job, input, opts = {}) {
+        await this.assertMayExecute(job.metadata.permissions, job.name, opts);
         const runId = (0, import_utils79.randomUUID)();
         const retryConfig = job.metadata.retry ?? {};
         const maxAttempts = retryConfig.maxAttempts ?? 1;
@@ -45601,6 +45979,7 @@ var init_job_execution_manager = __esm({
           jobId: job.metadata.id ?? job.name,
           jobName: job.name,
           sessionId: opts.sessionId,
+          ownerSub: resolvePrincipal2(opts.authInfo, opts.authoritiesContextBuilder).sub || void 0,
           state: "pending",
           input,
           startedAt: Date.now(),
@@ -45631,6 +46010,7 @@ var init_job_execution_manager = __esm({
        * Execute a workflow inline or in background.
        */
       async executeWorkflow(workflow, jobRegistry, opts = {}) {
+        await this.assertMayExecute(workflow.metadata.permissions, workflow.name, opts);
         const runId = (0, import_utils79.randomUUID)();
         const runRecord = {
           runId,
@@ -45638,6 +46018,7 @@ var init_job_execution_manager = __esm({
           jobName: workflow.name,
           workflowName: workflow.name,
           sessionId: opts.sessionId,
+          ownerSub: resolvePrincipal2(opts.authInfo, opts.authoritiesContextBuilder).sub || void 0,
           state: "pending",
           input: opts.workflowInput,
           startedAt: Date.now(),
@@ -45665,6 +46046,25 @@ var init_job_execution_manager = __esm({
         }
         return this.executeWorkflowInline(workflow, jobRegistry, runId, opts);
       }
+      /**
+       * Throw unless the caller may execute the entry.
+       *
+       * Uses the same error for "not authorized" as the tools use for "not found",
+       * so a caller cannot enumerate which restricted jobs exist by comparing
+       * responses.
+       */
+      async assertMayExecute(permissions, name42, opts) {
+        const allowed = await JobPermissionGuard.check(
+          permissions,
+          "execute",
+          opts.authInfo,
+          opts.authoritiesContextBuilder
+        );
+        if (!allowed) {
+          this.logger.warn(`Execution of "${name42}" denied: caller does not satisfy its execute permissions`);
+          throw new JobNotAuthorizedError(name42);
+        }
+      }
       /**
        * Get execution status.
        */
@@ -46690,6 +47090,7 @@ var init_execute_job_tool = __esm({
     "use strict";
     import_lazy_zod88 = require("@frontmcp/lazy-zod");
     init_common();
+    init_errors();
     ExecuteJobTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -46700,12 +47101,13 @@ var init_execute_job_tool = __esm({
         }
         const job = jobRegistry.findByName(input.name);
         if (!job) {
-          return this.fail(new Error(`Job "${input.name}" not found`));
+          return this.fail(new JobNotAuthorizedError(input.name));
         }
         const result = await executionManager.executeJob(job, input.input ?? {}, {
           background: input.background,
           sessionId: this.authInfo.sessionId,
-          authInfo: this.authInfo
+          authInfo: this.authInfo,
+          authoritiesContextBuilder: this.scope.authoritiesContextBuilder
         });
         return result;
       }
@@ -46737,6 +47139,7 @@ var init_get_job_status_tool = __esm({
     "use strict";
     import_lazy_zod89 = require("@frontmcp/lazy-zod");
     init_common();
+    init_principal_utils();
     init_errors();
     GetJobStatusTool = class extends ToolContext {
       async execute(input) {
@@ -46746,7 +47149,7 @@ var init_get_job_status_tool = __esm({
           return this.fail(new GenericServerError("Jobs system is not enabled"));
         }
         const record = await executionManager.getStatus(input.runId);
-        if (!record) {
+        if (!record || !this.ownsRun(record)) {
           return this.fail(new InvalidInputError(`Run "${input.runId}" not found`));
         }
         return {
@@ -46761,6 +47164,23 @@ var init_get_job_status_tool = __esm({
           logs: record.logs
         };
       }
+      /**
+       * Match on the owning subject, falling back to the session for runs started
+       * before an owner was recorded (and for anonymous/public servers, where every
+       * caller has an empty subject and the session is the only identity there is).
+       *
+       * A record carrying NEITHER identity is refused. Such a run cannot be
+       * attributed to anyone, and its inputs and results are exactly what this check
+       * exists to protect — anyone holding the id would otherwise be able to read
+       * it. Internal callers that must read unattributed runs should go through the
+       * execution manager directly rather than this tool.
+       */
+      ownsRun(record) {
+        const callerSub = resolvePrincipal2(this.authInfo, this.scope.authoritiesContextBuilder).sub;
+        if (record.ownerSub) return record.ownerSub === callerSub;
+        if (record.sessionId) return record.sessionId === this.authInfo.sessionId;
+        return false;
+      }
     };
     GetJobStatusTool = __decorateClass([
       FrontMcpTool({
@@ -46795,6 +47215,7 @@ var init_list_jobs_tool = __esm({
     "use strict";
     import_lazy_zod90 = require("@frontmcp/lazy-zod");
     init_common();
+    init_job_permission_guard();
     ListJobsTool = class extends ToolContext {
       async execute(input) {
         const jobRegistry = this.scope.jobs;
@@ -46805,7 +47226,11 @@ var init_list_jobs_tool = __esm({
           tags: input.tags,
           labels: input.labels
         });
-        const mapped = jobs.map((j) => ({
+        const visible = [];
+        for (const job of jobs) {
+          if (await this.maySee(job)) visible.push(job);
+        }
+        const mapped = visible.map((j) => ({
           name: j.name,
           description: j.metadata.description,
           tags: j.getTags(),
@@ -46817,6 +47242,17 @@ var init_list_jobs_tool = __esm({
           count: mapped.length
         };
       }
+      /**
+       * A job is listable when the caller passes its `list` rules and is not
+       * blocked from executing it. Checking `execute` too keeps the listing honest:
+       * showing a job the caller can never run is the disclosure this closes.
+       */
+      async maySee(job) {
+        const permissions = job.metadata.permissions;
+        const builder = this.scope.authoritiesContextBuilder;
+        if (!await JobPermissionGuard.check(permissions, "list", this.authInfo, builder)) return false;
+        return JobPermissionGuard.check(permissions, "execute", this.authInfo, builder);
+      }
     };
     ListJobsTool = __decorateClass([
       FrontMcpTool({
@@ -46852,6 +47288,7 @@ var init_register_job_tool = __esm({
     "use strict";
     import_lazy_zod91 = require("@frontmcp/lazy-zod");
     init_common();
+    init_errors();
     RegisterJobTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -46859,6 +47296,9 @@ var init_register_job_tool = __esm({
         if (!jobRegistry) {
           return this.fail(new Error("Jobs system is not enabled"));
         }
+        if (!this.dynamicRegistrationEnabled()) {
+          return this.fail(new DynamicJobRegistrationDisabledError("job"));
+        }
         const existing = jobRegistry.findByName(input.name);
         if (existing) {
           return this.fail(new Error(`Job "${input.name}" already exists`));
@@ -46881,6 +47321,10 @@ var init_register_job_tool = __esm({
         });
         return { success: true, jobId };
       }
+      dynamicRegistrationEnabled() {
+        const jobs = this.scope.metadata?.jobs;
+        return jobs?.allowDynamicRegistration === true;
+      }
     };
     RegisterJobTool = __decorateClass([
       FrontMcpTool({
@@ -46911,6 +47355,8 @@ var init_remove_job_tool = __esm({
     "use strict";
     import_lazy_zod92 = require("@frontmcp/lazy-zod");
     init_common();
+    init_errors();
+    init_job_permission_guard();
     RemoveJobTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -46920,7 +47366,16 @@ var init_remove_job_tool = __esm({
         }
         const job = jobRegistry.findByName(input.name);
         if (!job) {
-          return this.fail(new Error(`Job "${input.name}" not found`));
+          return this.fail(new JobNotAuthorizedError(input.name));
+        }
+        const allowed = await JobPermissionGuard.check(
+          job.metadata.permissions,
+          "delete",
+          this.authInfo,
+          this.scope.authoritiesContextBuilder
+        );
+        if (!allowed) {
+          return this.fail(new JobNotAuthorizedError(input.name));
         }
         if (!job.isDynamic()) {
           return this.fail(new Error(`Job "${input.name}" is not a dynamic job and cannot be removed`));
@@ -46981,14 +47436,18 @@ async function registerJobCapabilities(args) {
     ListJobsTool,
     ExecuteJobTool,
     GetJobStatusTool,
-    RegisterJobTool,
     RemoveJobTool,
     ListWorkflowsTool,
     ExecuteWorkflowTool,
     GetWorkflowStatusTool,
-    RegisterWorkflowTool,
     RemoveWorkflowTool
   ];
+  if (jobsConfig.allowDynamicRegistration === true) {
+    managementTools.push(RegisterJobTool, RegisterWorkflowTool);
+    logger.warn(
+      "Dynamic job registration is ENABLED: register_job/register_workflow accept a raw script and register it as an executable job."
+    );
+  }
   logger.info(
     `Jobs initialized: ${jobRegistry.getJobs().length} jobs, ${workflowRegistry.getWorkflows().length} workflows`
   );
@@ -51820,6 +52279,7 @@ var init_utils2 = __esm({
     init_caller_dir_utils();
     init_decide_request_intent_utils();
     init_path_utils();
+    init_principal_utils();
     init_global_config_utils();
     init_primitive_filter();
     init_validate_remote_url();
@@ -52767,9 +53227,24 @@ var init_redis_event_store = __esm({
         await client.expire(streamKey, this.ttlSeconds);
         return `${streamId}:${redisId}`;
       }
+      /**
+       * Resolve the stream an event belongs to.
+       *
+       * Optional in the upstream `EventStore` contract, and the transport's
+       * 409-conflict guard (refusing a second live stream for the same id) is dead
+       * code while no store provides it (GHSA-84j6-jc92-77jm).
+       */
+      async getStreamIdForEventId(eventId) {
+        const parsed = this.parseEventId(eventId);
+        return parsed ? parsed[0] : void 0;
+      }
       async replayEventsAfter(lastEventId, { send }) {
+        const parsed = this.parseEventId(lastEventId);
+        if (!parsed) {
+          return "default-stream";
+        }
         const client = await this.getClient();
-        const [streamId, redisId] = this.parseEventId(lastEventId);
+        const [streamId, redisId] = parsed;
         const streamKey = `${this.keyPrefix}${streamId}`;
         const entries = await client.xrange(streamKey, `(${redisId}`, "+");
         for (const [id, fields] of entries) {
@@ -52788,16 +53263,32 @@ var init_redis_event_store = __esm({
        * Event IDs have format: `{streamId}:{redisStreamEntryId}`
        * Redis stream entry IDs have format: `{timestamp}-{sequence}`
        *
+       * The entry-id half is validated because it is interpolated into the `xrange`
+       * range argument (`(${redisId}`), where a malformed value is a protocol error
+       * rather than data.
+       *
+       * The stream-id half is NOT character-filtered. `xadd`/`xrange` take the key
+       * as an exact argument — Redis applies no glob matching there — and ioredis
+       * length-prefixes it, so no character is special. Filtering here would also
+       * make `storeEvent`, which accepts any `StreamId`, able to mint ids this
+       * function then refuses, silently breaking replay for that stream. Ownership
+       * is enforced by the session-scoped facade (GHSA-84j6-jc92-77jm), not by
+       * guessing at the id's characters.
+       *
+       * @returns the pair, or `undefined` when the id is malformed.
+       *
        * @example
        * 'my-stream:1234567890123-0' -> ['my-stream', '1234567890123-0']
        */
       parseEventId(eventId) {
-        const lastColonBeforeDash = eventId.lastIndexOf(":", eventId.lastIndexOf("-"));
-        if (lastColonBeforeDash === -1) {
-          const lastColon = eventId.lastIndexOf(":");
-          return [eventId.slice(0, lastColon), eventId.slice(lastColon + 1)];
-        }
-        return [eventId.slice(0, lastColonBeforeDash), eventId.slice(lastColonBeforeDash + 1)];
+        const value = String(eventId);
+        const lastDash = value.lastIndexOf("-");
+        const separator = lastDash === -1 ? value.lastIndexOf(":") : value.lastIndexOf(":", lastDash);
+        if (separator <= 0 || separator === value.length - 1) return void 0;
+        const streamId = value.slice(0, separator);
+        const redisId = value.slice(separator + 1);
+        if (!/^\d+(-\d+)?$/.test(redisId)) return void 0;
+        return [streamId, redisId];
       }
       /**
        * Close the Redis client connection.
@@ -52843,6 +53334,16 @@ var init_memory_event_store = __esm({
         }
         return id;
       }
+      /**
+       * Resolve the stream an event belongs to.
+       *
+       * Optional in the upstream `EventStore` contract, and the transport's
+       * 409-conflict guard (refusing a second live stream for the same id) is dead
+       * code while no store provides it (GHSA-84j6-jc92-77jm).
+       */
+      async getStreamIdForEventId(eventId) {
+        return this.index.get(eventId)?.streamId;
+      }
       async replayEventsAfter(lastEventId, { send }) {
         const meta = this.index.get(lastEventId);
         if (!meta) {
@@ -52994,6 +53495,50 @@ var init_event_store_factory = __esm({
   }
 });
 
+// libs/sdk/src/transport/event-stores/session-scoped.event-store.ts
+function createSessionScopedEventStore(store, sessionId) {
+  const prefix = `${sessionId}${SCOPE_SEPARATOR}`;
+  const scope = (streamId) => `${prefix}${streamId}`;
+  const unscope = (streamId) => {
+    const value = String(streamId);
+    return value.startsWith(prefix) ? value.slice(prefix.length) : value;
+  };
+  const resolveOwnedStream = async (eventId) => {
+    const lookup = store.getStreamIdForEventId;
+    if (lookup) {
+      const resolved = await lookup.call(store, eventId);
+      return resolved !== void 0 && String(resolved).startsWith(prefix) ? resolved : void 0;
+    }
+    if (!String(eventId).startsWith(prefix)) return void 0;
+    const value = String(eventId);
+    const lastColon = value.lastIndexOf(":");
+    return lastColon === -1 ? void 0 : value.slice(0, lastColon);
+  };
+  return {
+    async storeEvent(streamId, message) {
+      return store.storeEvent(scope(streamId), message);
+    },
+    async getStreamIdForEventId(eventId) {
+      const owned = await resolveOwnedStream(eventId);
+      return owned === void 0 ? void 0 : unscope(owned);
+    },
+    async replayEventsAfter(lastEventId, options) {
+      const owned = await resolveOwnedStream(lastEventId);
+      if (owned === void 0) {
+        return "default-stream";
+      }
+      return unscope(await store.replayEventsAfter(lastEventId, options));
+    }
+  };
+}
+var SCOPE_SEPARATOR;
+var init_session_scoped_event_store = __esm({
+  "libs/sdk/src/transport/event-stores/session-scoped.event-store.ts"() {
+    "use strict";
+    SCOPE_SEPARATOR = " ";
+  }
+});
+
 // libs/sdk/src/transport/event-stores/index.ts
 var init_event_stores = __esm({
   "libs/sdk/src/transport/event-stores/index.ts"() {
@@ -54664,6 +55209,61 @@ var init_transport_error = __esm({
   }
 });
 
+// libs/sdk/src/server/security/host-validation.ts
+function normalizeHost(value) {
+  const host = value.trim().toLowerCase();
+  if (host.length === 0) return host;
+  const portSeparator = host.startsWith("[") ? host.indexOf(":", host.indexOf("]")) : host.lastIndexOf(":");
+  if (portSeparator === -1) return host;
+  const name42 = host.slice(0, portSeparator);
+  const port = host.slice(portSeparator + 1);
+  if (port.length === 0 || !/^\d+$/.test(port)) return host;
+  return DEFAULT_PORTS.has(port) ? name42 : `${name42}:${port}`;
+}
+function normalizeOrigin(value) {
+  const origin = value.trim().toLowerCase();
+  try {
+    return new URL(origin).origin.toLowerCase();
+  } catch {
+    return origin;
+  }
+}
+function compileHostValidation(rules) {
+  return {
+    hosts: rules.allowedHosts ? new Set(rules.allowedHosts.map(normalizeHost)) : void 0,
+    origins: rules.allowedOrigins ? new Set(rules.allowedOrigins.map(normalizeOrigin)) : void 0
+  };
+}
+function validateHostHeaders(headers, compiled) {
+  if (compiled.hosts) {
+    const host = headers.host;
+    if (!host || !compiled.hosts.has(normalizeHost(host))) {
+      return { status: 403, error: "Forbidden", message: "Invalid Host header" };
+    }
+    const forwardedHost = headers.forwardedHost;
+    if (forwardedHost) {
+      const candidates = forwardedHost.split(",").map((h2) => h2.trim()).filter(Boolean);
+      if (candidates.some((h2) => !compiled.hosts?.has(normalizeHost(h2)))) {
+        return { status: 403, error: "Forbidden", message: "Invalid X-Forwarded-Host header" };
+      }
+    }
+  }
+  if (compiled.origins) {
+    const origin = headers.origin;
+    if (origin && !compiled.origins.has(normalizeOrigin(origin))) {
+      return { status: 403, error: "Forbidden", message: "Invalid Origin header" };
+    }
+  }
+  return void 0;
+}
+var DEFAULT_PORTS;
+var init_host_validation = __esm({
+  "libs/sdk/src/server/security/host-validation.ts"() {
+    "use strict";
+    DEFAULT_PORTS = /* @__PURE__ */ new Set(["80", "443"]);
+  }
+});
+
 // libs/sdk/src/transport/adapters/base-sse-transport.ts
 var import_content_type, import_raw_body, import_protocol54, import_utils93, MAXIMUM_MESSAGE_SIZE, SSEServerTransport;
 var init_base_sse_transport = __esm({
@@ -54674,6 +55274,7 @@ var init_base_sse_transport = __esm({
     import_protocol54 = require("@frontmcp/protocol");
     import_utils93 = require("@frontmcp/utils");
     init_transport_errors();
+    init_host_validation();
     MAXIMUM_MESSAGE_SIZE = "4mb";
     SSEServerTransport = class {
       /**
@@ -54697,25 +55298,31 @@ var init_base_sse_transport = __esm({
       onmessage;
       /**
        * Validates request headers for DNS rebinding protection.
+       *
+       * Since v1.7.2 the primary defence is the adapter-level Host validation, which
+       * runs before routing and therefore already covers `/sse` and `/message`
+       * (GHSA-mc9g-v2cp-vfff). These per-transport options remain for a host that
+       * constructs the transport directly; they delegate to the same rules so the
+       * two can never disagree about what a valid Host looks like.
+       *
        * @returns Error message if validation fails, undefined if validation passes.
        */
       validateRequestHeaders(req) {
         if (!this._options.enableDnsRebindingProtection) {
           return void 0;
         }
-        if (this._options.allowedHosts && this._options.allowedHosts.length > 0) {
-          const hostHeader = req.headers.host;
-          if (!hostHeader || !this._options.allowedHosts.includes(hostHeader)) {
-            return `Invalid Host header: ${hostHeader}`;
-          }
-        }
-        if (this._options.allowedOrigins && this._options.allowedOrigins.length > 0) {
-          const originHeader = req.headers.origin;
-          if (!originHeader || !this._options.allowedOrigins.includes(originHeader)) {
-            return `Invalid Origin header: ${originHeader}`;
-          }
-        }
-        return void 0;
+        const rejection = validateHostHeaders(
+          {
+            host: req.headers.host,
+            forwardedHost: req.headers["x-forwarded-host"],
+            origin: req.headers.origin
+          },
+          compileHostValidation({
+            allowedHosts: this._options.allowedHosts?.length ? this._options.allowedHosts : void 0,
+            allowedOrigins: this._options.allowedOrigins?.length ? this._options.allowedOrigins : void 0
+          })
+        );
+        return rejection?.message;
       }
       /**
        * Handles the initial SSE connection request.
@@ -55213,7 +55820,7 @@ var init_transport_local_adapter = __esm({
         }
       }
       ensureAuthInfo(req, transport) {
-        const { token, user, session } = req[ServerRequestTokens.auth];
+        const { token, user, session, scopes, claims } = req[ServerRequestTokens.auth];
         if (!session?.id) {
           throw new UnauthorizedError(
             "Session could not be reconstructed for the provided token. Re-authenticate to start a new session.",
@@ -55242,7 +55849,16 @@ var init_transport_local_adapter = __esm({
           user,
           sessionId,
           sessionIdPayload: sessionPayload,
-          scopes: [],
+          // Carry the scopes and claims the verified Authorization actually holds.
+          // These used to be dropped (`scopes: []`, no claims), which left every
+          // scope- or claim-based check downstream inert.
+          //
+          // Both are COPIED, not aliased. Tool code receives this object, and a
+          // nested mutation (`authInfo.claims.roles.push('admin')`) on a shared
+          // reference would rewrite the request's own verified authorization — which
+          // the job/workflow permission guard then reads.
+          scopes: Array.isArray(scopes) ? [...scopes] : [],
+          ...claims ? { claims: structuredClone(claims) } : {},
           clientId: user.sub ?? "",
           transport
         };
@@ -55723,6 +56339,7 @@ var init_transport_streamable_http_adapter = __esm({
     "use strict";
     import_lazy_zod105 = require("@frontmcp/lazy-zod");
     init_errors();
+    init_session_scoped_event_store();
     init_transport_error();
     init_streamable_http_transport();
     init_transport_local_adapter();
@@ -55732,7 +56349,8 @@ var init_transport_streamable_http_adapter = __esm({
     TransportStreamableHttpAdapter = class extends LocalTransportAdapter {
       createTransport(sessionId, response) {
         const sessionIdGenerator = resolveSessionIdGenerator(this.key.type, sessionId);
-        const eventStore = this.scope.eventStore;
+        const sharedEventStore = this.scope.eventStore;
+        const eventStore = sharedEventStore ? createSessionScopedEventStore(sharedEventStore, sessionId) : void 0;
         const isStateless = this.key.type === "stateless-http";
         return new RecreateableStreamableHTTPServerTransport({
           sessionIdGenerator,
@@ -56789,11 +57407,11 @@ function parseUserScopes(user) {
   const s = user?.scope;
   return typeof s === "string" ? s.split(/\s+/).filter(Boolean) : [];
 }
-var import_auth38, import_lazy_zod106, import_utils96, plan40, httpRequestStateSchema, name41, Stage41, HttpRequestFlow;
+var import_auth39, import_lazy_zod106, import_utils96, plan40, httpRequestStateSchema, name41, Stage41, HttpRequestFlow;
 var init_http_request_flow = __esm({
   "libs/sdk/src/scope/flows/http.request.flow.ts"() {
     "use strict";
-    import_auth38 = require("@frontmcp/auth");
+    import_auth39 = require("@frontmcp/auth");
     import_lazy_zod106 = require("@frontmcp/lazy-zod");
     import_utils96 = require("@frontmcp/utils");
     init_session_verify_flow();
@@ -56987,20 +57605,20 @@ var init_http_request_flow = __esm({
         const tokenStore = auth.orchestratedTokenStore;
         let providers;
         try {
-          const authorizationId = (0, import_auth38.deriveAuthorizationId)(token);
+          const authorizationId = (0, import_auth39.deriveAuthorizationId)(token);
           const providerIds = await tokenStore.getProviderIds(authorizationId);
           providers = Object.fromEntries(providerIds.map((id) => [id, { id }]));
         } catch (err) {
           this.logger.warn(`[${this.requestId}] failed to load orchestrated providers: ${String(err)}`);
         }
-        const authorization = import_auth38.OrchestratedAuthorization.create({
+        const authorization = import_auth39.OrchestratedAuthorization.create({
           token,
           user: { sub: user.sub ?? "unknown", name: user.name, email: user.email, picture: user.picture },
           expiresAt: user.exp ? user.exp * 1e3 : void 0,
           tokenStore,
           providers
         });
-        ctx.setContextToken(import_auth38.ORCHESTRATED_AUTH_ACCESSOR, new import_auth38.OrchestratedAuthAccessorAdapter(authorization));
+        ctx.setContextToken(import_auth39.ORCHESTRATED_AUTH_ACCESSOR, new import_auth39.OrchestratedAuthAccessorAdapter(authorization));
       }
       async router() {
         try {
@@ -59611,7 +60229,13 @@ function normalizeAppScope(appItem, metadata) {
       ...metadata,
       id: scopeId,
       apps: [appItem],
-      auth: appMetadata.auth,
+      // An app that declares no `auth` INHERITS the server's policy. Writing
+      // `appMetadata.auth` unconditionally set the key to `undefined`, which
+      // overrode the spread above and dropped the server's auth entirely — so a
+      // standalone app silently became public (GHSA-rgxj-434m-vxh3, where the
+      // dashboard's own scope was the case in point). Declaring
+      // `auth: { mode: 'public' }` explicitly is still honoured.
+      auth: appMetadata.auth ?? metadata.auth,
       // For a splitByApp scope, auth (and any auth.ui paths) come from `@App`, so
       // anchor on the App's captured source dir. Fall back to the server's.
       // `__sourceDir` lives on LocalAppMetadata only; read it defensively.
@@ -59875,6 +60499,11 @@ function createWebFetchHandler(scope, options = {}) {
   const entryPaths = new Set((Array.isArray(rawEntry) ? rawEntry : [rawEntry]).map(normalizePath));
   const cors2 = options.cors ?? mapHttpCors(httpConfig?.cors, scope);
   const corsEnabled = cors2?.origin !== void 0 && cors2.origin !== false;
+  const rebinding = httpConfig?.security?.dnsRebindingProtection;
+  const hostValidation = rebinding?.enabled === false || !rebinding?.allowedHosts?.length && !rebinding?.allowedOrigins?.length ? void 0 : compileHostValidation({
+    allowedHosts: rebinding.allowedHosts,
+    allowedOrigins: rebinding.allowedOrigins
+  });
   const corsHeadersFor = (request) => {
     if (!corsEnabled) return {};
     const reqOrigin = request.headers.get("origin") ?? "";
@@ -59905,6 +60534,19 @@ function createWebFetchHandler(scope, options = {}) {
   };
   return async function handle(request, ctx, env) {
     const url = new URL(request.url);
+    if (hostValidation) {
+      const rejection = validateHostHeaders(
+        {
+          host: request.headers.get("host") ?? url.host,
+          forwardedHost: request.headers.get("x-forwarded-host") ?? void 0,
+          origin: request.headers.get("origin") ?? void 0
+        },
+        hostValidation
+      );
+      if (rejection) {
+        return Response.json({ error: rejection.error, message: rejection.message }, { status: rejection.status });
+      }
+    }
     if (corsEnabled && request.method === "OPTIONS") {
       return new Response(null, { status: 204, headers: corsHeadersFor(request) });
     }
@@ -60038,6 +60680,7 @@ var init_web_fetch_handler = __esm({
     init_server_tokens();
     init_path_utils();
     init_errors();
+    init_host_validation();
     init_web_response_renderer();
   }
 });
@@ -60190,39 +60833,22 @@ function createHostValidationMiddleware(options) {
   if (!options.enabled) {
     return (_req, _res, next) => next();
   }
-  const allowedHostsSet = options.allowedHosts ? new Set(options.allowedHosts) : void 0;
-  const allowedOriginsSet = options.allowedOrigins ? new Set(options.allowedOrigins) : void 0;
+  const compiled = compileHostValidation({
+    allowedHosts: options.allowedHosts,
+    allowedOrigins: options.allowedOrigins
+  });
   return (req, res, next) => {
-    if (allowedHostsSet) {
-      const host = req.headers?.["host"];
-      if (!host || !allowedHostsSet.has(host)) {
-        res.status(403).json({
-          error: "Forbidden",
-          message: "Invalid Host header"
-        });
-        return;
-      }
-      const forwardedHost = req.headers?.["x-forwarded-host"];
-      if (forwardedHost) {
-        const candidates = forwardedHost.split(",").map((h2) => h2.trim()).filter(Boolean);
-        if (candidates.some((h2) => !allowedHostsSet.has(h2))) {
-          res.status(403).json({
-            error: "Forbidden",
-            message: "Invalid X-Forwarded-Host header"
-          });
-          return;
-        }
-      }
-    }
-    if (allowedOriginsSet) {
-      const origin = req.headers?.["origin"];
-      if (origin && !allowedOriginsSet.has(origin)) {
-        res.status(403).json({
-          error: "Forbidden",
-          message: "Invalid Origin header"
-        });
-        return;
-      }
+    const rejection = validateHostHeaders(
+      {
+        host: req.headers?.["host"],
+        forwardedHost: req.headers?.["x-forwarded-host"],
+        origin: req.headers?.["origin"]
+      },
+      compiled
+    );
+    if (rejection) {
+      res.status(rejection.status).json({ error: rejection.error, message: rejection.message });
+      return;
     }
     next();
   };
@@ -60230,6 +60856,82 @@ function createHostValidationMiddleware(options) {
 var init_host_validation_middleware = __esm({
   "libs/sdk/src/server/middleware/host-validation.middleware.ts"() {
     "use strict";
+    init_host_validation();
+  }
+});
+
+// libs/sdk/src/server/security/resolve-allowed-hosts.ts
+function canonicalizeAddress(address) {
+  const bare = address.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  if (!bare.includes(":")) return bare;
+  try {
+    return new URL(`http://[${bare}]`).hostname.replace(/^\[|\]$/g, "");
+  } catch {
+    return bare;
+  }
+}
+function isLoopbackAddress(address) {
+  if (!address) return false;
+  const normalized = canonicalizeAddress(address);
+  return normalized === "::1" || normalized === "localhost" || normalized.startsWith("127.") || // IPv4-mapped IPv6 loopback, which `URL` renders as `::ffff:7f00:1`.
+  normalized === "::ffff:7f00:1" || normalized.startsWith("::ffff:127.");
+}
+function withAndWithoutPort(host, port) {
+  return port ? [host, `${host}:${port}`] : [host];
+}
+function hostFromUrl(url) {
+  if (!url) return void 0;
+  try {
+    return new URL(url).host || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isRoutableBind(address) {
+  if (!address) return false;
+  return !isLoopbackAddress(address);
+}
+function deriveAllowedHosts(input) {
+  const hosts = /* @__PURE__ */ new Set();
+  if (input.socketPath) return [];
+  for (const name42 of LOOPBACK_NAMES) {
+    for (const value of withAndWithoutPort(name42, input.port)) hosts.add(value);
+  }
+  const bindAddress = input.bindAddress?.trim();
+  if (bindAddress && !isLoopbackAddress(bindAddress) && bindAddress !== "0.0.0.0" && bindAddress !== "::") {
+    const literal = bindAddress.includes(":") && !bindAddress.startsWith("[") ? `[${bindAddress}]` : bindAddress;
+    for (const value of withAndWithoutPort(literal, input.port)) hosts.add(value);
+  }
+  const issuerHost = hostFromUrl(input.issuer);
+  if (issuerHost) {
+    hosts.add(issuerHost);
+    const [name42] = issuerHost.split(":");
+    if (!issuerHost.includes(":") && input.port) hosts.add(`${name42}:${input.port}`);
+  }
+  for (const extra of input.extraHosts ?? []) {
+    const trimmed = extra.trim();
+    if (trimmed) hosts.add(trimmed);
+  }
+  return [...hosts];
+}
+function shouldEnforceDerivedHosts(input) {
+  if (input.socketPath) return false;
+  const hasExplicitName = hostFromUrl(input.issuer) !== void 0 || (input.extraHosts ?? []).some((h2) => h2.trim());
+  if (hasExplicitName) return true;
+  if (input.port === void 0) return false;
+  return !isRoutableBind(input.bindAddress);
+}
+function allowedHostsFromEnv(env = process.env) {
+  const raw = env["FRONTMCP_ALLOWED_HOSTS"]?.trim();
+  if (!raw) return void 0;
+  const hosts = raw.split(",").map((h2) => h2.trim()).filter(Boolean);
+  return hosts.length > 0 ? hosts : void 0;
+}
+var LOOPBACK_NAMES;
+var init_resolve_allowed_hosts = __esm({
+  "libs/sdk/src/server/security/resolve-allowed-hosts.ts"() {
+    "use strict";
+    LOOPBACK_NAMES = ["localhost", "127.0.0.1", "[::1]"];
   }
 });
 
@@ -60255,12 +60957,17 @@ var init_express_host_adapter = __esm({
     import_utils98 = require("@frontmcp/utils");
     init_mcp_error();
     init_host_validation_middleware();
+    init_resolve_allowed_hosts();
     init_base_host_adapter();
     DEFAULT_EXPRESS_BODY_LIMIT = "4mb";
     ExpressHostAdapter = class extends HostServerAdapter {
       app = (0, import_express.default)();
       router = import_express.default.Router();
       prepared = false;
+      /** Active host-validation middleware, or undefined while nothing is enforced. */
+      hostValidation;
+      /** Builds the derived allow-list, once this process commits to listening. */
+      deriveHostValidation;
       constructor(options) {
         super();
         const corsOptions = options?.cors;
@@ -60274,6 +60981,7 @@ var init_express_host_adapter = __esm({
             })
           );
         }
+        this.installHostValidation(options);
         const jsonLimit = options?.bodyLimit ?? DEFAULT_EXPRESS_BODY_LIMIT;
         const formLimit = options?.urlencodedLimit ?? jsonLimit;
         const headerContains = (req, needle) => (req.headers["content-type"] ?? "").toLowerCase().includes(needle);
@@ -60294,23 +61002,6 @@ var init_express_host_adapter = __esm({
           }
           next(err);
         });
-        const securityOpts = options?.security;
-        if (securityOpts?.dnsRebindingProtection?.enabled || securityOpts?.strict) {
-          const allowedHosts = securityOpts.dnsRebindingProtection?.allowedHosts;
-          const allowedOrigins = securityOpts.dnsRebindingProtection?.allowedOrigins;
-          const effectiveHosts = allowedHosts ?? (securityOpts.strict ? ["localhost", "127.0.0.1"] : void 0);
-          if (!effectiveHosts?.length && !allowedOrigins?.length) {
-            throw new Error(
-              "security.dnsRebindingProtection is enabled but no allowedHosts or allowedOrigins are configured. Provide at least one allowedHosts entry or disable dnsRebindingProtection."
-            );
-          }
-          const hostValidation = createHostValidationMiddleware({
-            enabled: true,
-            allowedHosts: effectiveHosts,
-            allowedOrigins
-          });
-          this.app.use(hostValidation);
-        }
         this.app.use((req, res, next) => {
           if (corsEnabled) {
             res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate, Mcp-Session-Id");
@@ -60320,6 +61011,64 @@ var init_express_host_adapter = __esm({
           next();
         });
       }
+      /**
+       * Install DNS-rebinding protection.
+       *
+       * ON by default since v1.7.2 (BC-035). `allowedHosts` falls back to the names
+       * this process actually answers to — the loopback aliases with and without
+       * the bound port, the bound NIC address, and the configured issuer host.
+       *
+       * Escape hatches, in precedence order: explicit
+       * `security.dnsRebindingProtection.allowedHosts`, the
+       * `FRONTMCP_ALLOWED_HOSTS` env var, or `enabled: false` to turn it off.
+       */
+      installHostValidation(options) {
+        const protection = options?.security?.dnsRebindingProtection;
+        if (protection?.enabled === false) return;
+        const allowedOrigins = protection?.allowedOrigins;
+        const explicitHosts = protection?.allowedHosts ?? allowedHostsFromEnv();
+        if (explicitHosts?.length || allowedOrigins?.length) {
+          this.hostValidation = createHostValidationMiddleware({
+            enabled: true,
+            allowedHosts: explicitHosts?.length ? explicitHosts : void 0,
+            allowedOrigins
+          });
+        } else {
+          this.deriveHostValidation = (portOrSocketPath, bindAddress) => {
+            const isSocket = typeof portOrSocketPath === "string";
+            const derivation = {
+              // `start()` binds `bindAddress ?? '0.0.0.0'`; mirror that exactly.
+              bindAddress: isSocket ? void 0 : bindAddress ?? "0.0.0.0",
+              port: isSocket ? void 0 : portOrSocketPath,
+              socketPath: isSocket ? portOrSocketPath : void 0,
+              issuer: options?.listen?.issuer
+            };
+            if (!shouldEnforceDerivedHosts(derivation)) {
+              console.warn(
+                `[frontmcp] DNS-rebinding protection is not enforcing a Host allow-list: the server binds a routable address (${derivation.bindAddress ?? "unknown"}) and no allowed hosts are configured. Set security.dnsRebindingProtection.allowedHosts (or FRONTMCP_ALLOWED_HOSTS) to your public hostname(s).`
+              );
+              return void 0;
+            }
+            const allowedHosts = deriveAllowedHosts(derivation);
+            if (!allowedHosts.length) return void 0;
+            return createHostValidationMiddleware({ enabled: true, allowedHosts });
+          };
+        }
+        this.app.use(((req, res, next) => {
+          const validate = this.hostValidation;
+          if (!validate) return next();
+          return validate(req, res, next);
+        }));
+      }
+      /**
+       * Enable the DERIVED host allow-list. Called from `start()` only — see
+       * `installHostValidation`.
+       */
+      enableDerivedHostValidation(portOrSocketPath, bindAddress) {
+        if (this.hostValidation || !this.deriveHostValidation) return;
+        this.hostValidation = this.deriveHostValidation(portOrSocketPath, bindAddress);
+        this.deriveHostValidation = void 0;
+      }
       registerRoute(method, path3, handler) {
         this.router[method.toLowerCase()](path3, this.enhancedHandler(handler));
       }
@@ -60352,6 +61101,7 @@ var init_express_host_adapter = __esm({
         return this.app;
       }
       async start(portOrSocketPath, bindAddress) {
+        this.enableDerivedHostValidation(portOrSocketPath, bindAddress);
         this.prepare();
         const server = http.createServer(this.app);
         server.requestTimeout = 0;
@@ -63241,6 +63991,7 @@ __export(index_exports, {
   DynamicAdapter: () => DynamicAdapter,
   DynamicAdapterNameError: () => DynamicAdapterNameError,
   DynamicJobDirectExecutionError: () => DynamicJobDirectExecutionError,
+  DynamicJobRegistrationDisabledError: () => DynamicJobRegistrationDisabledError,
   DynamicPlugin: () => DynamicPlugin,
   ELICITATION_FALLBACK_JSON_SCHEMA: () => ELICITATION_FALLBACK_JSON_SCHEMA,
   ESM_SH_BASE_URL: () => ESM_SH_BASE_URL,
@@ -63364,7 +64115,7 @@ __export(index_exports, {
   HttpTextSchema: () => HttpTextSchema,
   HttpWebResponseSchema: () => HttpWebResponseSchema,
   ImageOutputSchema: () => ImageOutputSchema,
-  InMemoryOrchestratedTokenStore: () => import_auth40.InMemoryOrchestratedTokenStore,
+  InMemoryOrchestratedTokenStore: () => import_auth41.InMemoryOrchestratedTokenStore,
   InMemoryStoreRequiredError: () => import_auth11.InMemoryStoreRequiredError,
   InProcessTaskRunner: () => InProcessTaskRunner,
   InputRequiredSignal: () => InputRequiredSignal,
@@ -63395,6 +64146,7 @@ __export(index_exports, {
   JobExecutionManager: () => JobExecutionManager,
   JobInstance: () => JobInstance,
   JobKind: () => JobKind,
+  JobNotAuthorizedError: () => JobNotAuthorizedError,
   JobPermissionGuard: () => JobPermissionGuard,
   JobRegistry: () => JobRegistry,
   LLM_ADAPTER: () => LLM_ADAPTER,
@@ -63912,6 +64664,7 @@ __export(index_exports, {
   resolveNameConflicts: () => resolveNameConflicts,
   resolveOutputSchemaMode: () => resolveOutputSchemaMode,
   resolvePendingTC39HooksForClass: () => resolvePendingTC39HooksForClass,
+  resolvePrincipal: () => resolvePrincipal2,
   resolveRegistryToken: () => resolveRegistryToken,
   resolveSchemaDescriptionFormat: () => resolveSchemaDescriptionFormat,
   resolveToolVisibility: () => resolveToolVisibility,
@@ -64004,49 +64757,7 @@ init_job_registry();
 init_job_instance();
 init_job_events();
 init_job_utils();
-
-// libs/sdk/src/job/job-permission.guard.ts
-var JobPermissionGuard = class _JobPermissionGuard {
-  /**
-   * Check if the given auth info is allowed to perform the action.
-   * Returns true if no permissions are defined (permissive by default).
-   */
-  static async check(permissions, action, authInfo) {
-    if (!permissions || permissions.length === 0) {
-      return true;
-    }
-    const relevant = permissions.filter((p) => p.action === action);
-    if (relevant.length === 0) {
-      return true;
-    }
-    for (const perm of relevant) {
-      const passed = await _JobPermissionGuard.checkSingle(perm, authInfo);
-      if (!passed) return false;
-    }
-    return true;
-  }
-  static async checkSingle(perm, authInfo) {
-    if (perm.roles && perm.roles.length > 0) {
-      const userRoles = authInfo["roles"];
-      if (!Array.isArray(userRoles)) return false;
-      const hasRole = perm.roles.some((r) => userRoles.includes(r));
-      if (!hasRole) return false;
-    }
-    if (perm.scopes && perm.scopes.length > 0) {
-      const userScopes = authInfo["scopes"] ?? authInfo["scope"];
-      const scopeArr = typeof userScopes === "string" ? userScopes.split(" ") : Array.isArray(userScopes) ? userScopes : [];
-      const hasScope = perm.scopes.some((s) => scopeArr.includes(s));
-      if (!hasScope) return false;
-    }
-    if (perm.custom) {
-      const result = await perm.custom(authInfo);
-      if (!result) return false;
-    }
-    return true;
-  }
-};
-
-// libs/sdk/src/job/index.ts
+init_job_permission_guard();
 init_job_scope_helper();
 
 // libs/sdk/src/job/execution/index.ts
@@ -64342,7 +65053,7 @@ init_mcp_20260728();
 init_mcp_stateless_client_adapter();
 var import_protocol57 = require("@frontmcp/protocol");
 init_ext_apps2();
-var import_auth40 = require("@frontmcp/auth");
+var import_auth41 = require("@frontmcp/auth");
 (function suppressZodExpressWarning() {
   if (typeof process === "undefined" || typeof process.emitWarning !== "function") return;
   const originalEmitWarning = process.emitWarning.bind(process);
@@ -64449,6 +65160,7 @@ var ChannelListHook = FlowHooksOf("channels:list");
   DynamicAdapter,
   DynamicAdapterNameError,
   DynamicJobDirectExecutionError,
+  DynamicJobRegistrationDisabledError,
   DynamicPlugin,
   ELICITATION_FALLBACK_JSON_SCHEMA,
   ESM_SH_BASE_URL,
@@ -64603,6 +65315,7 @@ var ChannelListHook = FlowHooksOf("channels:list");
   JobExecutionManager,
   JobInstance,
   JobKind,
+  JobNotAuthorizedError,
   JobPermissionGuard,
   JobRegistry,
   LLM_ADAPTER,
@@ -65119,6 +65832,7 @@ var ChannelListHook = FlowHooksOf("channels:list");
   resolveNameConflicts,
   resolveOutputSchemaMode,
   resolvePendingTC39HooksForClass,
+  resolvePrincipal,
   resolveRegistryToken,
   resolveSchemaDescriptionFormat,
   resolveToolVisibility,