@frontmcp/sdk 1.7.1 → 1.8.0

package/esm/index.mjs

@@ -679,6 +679,7 @@ var init_server_tokens = __esm({
       reinitialize: tokenFactory.meta("reinitialize"),
       webRequest: tokenFactory.meta("webRequest"),
       webCtx: tokenFactory.meta("webCtx"),
+      webEnv: tokenFactory.meta("webEnv"),
       webTransport: tokenFactory.meta("webTransport")
     };
   }
@@ -1938,6 +1939,7 @@ import {
   localDcrConfigSchema
 } from "@frontmcp/auth";
 import { publicAuthOptionsSchema } from "@frontmcp/auth";
+import { staticAuthOptionsSchema } from "@frontmcp/auth";
 import { transparentAuthOptionsSchema } from "@frontmcp/auth";
 import {
   localAuthSchema,
@@ -1952,6 +1954,7 @@ import { appAuthOptionsSchema } from "@frontmcp/auth";
 import {
   parseAuthOptions,
   isPublicMode,
+  isStaticMode,
   isTransparentMode,
   isLocalMode,
   isRemoteMode,
@@ -2345,7 +2348,10 @@ var init_schema7 = __esm({
     });
     eventStoreConfigSchema = z12.object({
       enabled: z12.boolean().default(false),
-      provider: z12.enum(["memory", "redis"]).optional().default("memory"),
+      // 'sqlite' is supported by createEventStore and the TS interface but was
+      // missing from this enum, so a valid `provider: 'sqlite'` config failed
+      // validation.
+      provider: z12.enum(["memory", "redis", "sqlite"]).optional().default("memory"),
       maxEvents: z12.number().int().positive().optional().default(1e4),
       ttlMs: z12.number().int().positive().optional().default(3e5),
       redis: redisOptionsSchema.optional()
@@ -3149,6 +3155,10 @@ var init_front_mcp_metadata = __esm({
       output: outputPolicySchema.optional(),
       jobs: z24.object({
         enabled: z24.boolean(),
+        // Opt-in for `register_job` / `register_workflow` (GHSA-58v2-gpcc-jmqv).
+        // Omitting it here would let Zod strip the flag before the scope reads
+        // it, leaving the documented escape hatch permanently off.
+        allowDynamicRegistration: z24.boolean().optional(),
         store: z24.object({
           redis: redisOptionsSchema.optional(),
           keyPrefix: z24.string().optional()
@@ -4081,7 +4091,7 @@ function formatToolsForPlatform(tools, platform) {
         })
       );
     case "vercel-ai": {
-      const result = {};
+      const result = /* @__PURE__ */ Object.create(null);
       for (const tool of tools) {
         result[tool.name] = {
           description: tool.description ?? `Execute ${tool.name}`,
@@ -5348,6 +5358,8 @@ import {
   TokenStoreRequiredError,
   NoProviderIdError,
   TokenLeakDetectedError,
+  JwtSecretRequiredError,
+  JwtSecretWeakError,
   SessionSecretRequiredError,
   CredentialProviderAlreadyRegisteredError,
   AuthProvidersNotConfiguredError,
@@ -5636,6 +5648,32 @@ var init_sdk_errors = __esm({
   }
 });
 
+// libs/sdk/src/errors/job.errors.ts
+var JobNotAuthorizedError, DynamicJobRegistrationDisabledError;
+var init_job_errors = __esm({
+  "libs/sdk/src/errors/job.errors.ts"() {
+    "use strict";
+    init_mcp_error();
+    JobNotAuthorizedError = class extends PublicMcpError {
+      /** The requested name, for internal logs only — never surfaced publicly. */
+      requestedName;
+      constructor(requestedName) {
+        super(`Job or workflow "${requestedName}" not found or not permitted`, "JOB_NOT_AUTHORIZED", 403);
+        this.requestedName = requestedName;
+      }
+    };
+    DynamicJobRegistrationDisabledError = class extends PublicMcpError {
+      constructor(kind = "job") {
+        super(
+          `Dynamic ${kind} registration is disabled. Enable it with jobs: { allowDynamicRegistration: true }.`,
+          "DYNAMIC_REGISTRATION_DISABLED",
+          403
+        );
+      }
+    };
+  }
+});
+
 // libs/sdk/src/errors/index.ts
 var errors_exports = {};
 __export(errors_exports, {
@@ -5661,6 +5699,7 @@ __export(errors_exports, {
   DependencyNotFoundError: () => DependencyNotFoundError,
   DynamicAdapterNameError: () => DynamicAdapterNameError,
   DynamicJobDirectExecutionError: () => DynamicJobDirectExecutionError,
+  DynamicJobRegistrationDisabledError: () => DynamicJobRegistrationDisabledError,
   ElicitationDisabledError: () => ElicitationDisabledError,
   ElicitationEncryptionError: () => ElicitationEncryptionError,
   ElicitationFallbackRequired: () => ElicitationFallbackRequired,
@@ -5709,6 +5748,9 @@ __export(errors_exports, {
   InvalidUseFactoryError: () => InvalidUseFactoryError,
   InvalidUseValueError: () => InvalidUseValueError,
   InvokeStateMissingKeyError: () => InvokeStateMissingKeyError,
+  JobNotAuthorizedError: () => JobNotAuthorizedError,
+  JwtSecretRequiredError: () => JwtSecretRequiredError,
+  JwtSecretWeakError: () => JwtSecretWeakError,
   MCP_ERROR_CODES: () => MCP_ERROR_CODES,
   McpError: () => McpError,
   MethodNotImplementedError: () => MethodNotImplementedError,
@@ -5831,6 +5873,7 @@ var init_errors = __esm({
     init_workflow_errors();
     init_esm_errors();
     init_sdk_errors();
+    init_job_errors();
   }
 });
 
@@ -7158,6 +7201,10 @@ var require_dist = __commonJS({
         }
         return id;
       }
+      async getStreamIdForEventId(eventId) {
+        const row = this.prepared().getStreamId.get(eventId);
+        return row?.stream_id;
+      }
       async replayEventsAfter(lastEventId, { send }) {
         const stmts = this.prepared();
         const streamRow = stmts.getStreamId.get(lastEventId);
@@ -9313,22 +9360,24 @@ function hasValidSessionStructure(dec) {
 function isValidSessionPayload(dec, sig) {
   return hasValidSessionStructure(dec) && dec.authSig === sig;
 }
-function isValidPublicSessionPayload(dec) {
+function isValidPublicSessionPayload(dec, expectedAuthSig = "public") {
   if (typeof dec !== "object" || dec === null) return false;
   const d = dec;
-  return typeof d["nodeId"] === "string" && d["authSig"] === "public" && typeof d["uuid"] === "string" && typeof d["iat"] === "number" && d["isPublic"] === true;
+  return typeof d["nodeId"] === "string" && d["authSig"] === expectedAuthSig && typeof d["uuid"] === "string" && typeof d["iat"] === "number" && // `isPublic` is set only for public mode, so it must track the signature —
+  // a static-mode session must never decrypt as a public one.
+  d["isPublic"] === (expectedAuthSig === "public");
 }
 function decryptSessionId(sessionId, sig) {
   const dec = safeDecrypt(sessionId);
   return isValidSessionPayload(dec, sig) ? dec : null;
 }
-function decryptPublicSession(sessionId) {
+function decryptPublicSession(sessionId, expectedAuthSig = "public") {
   const cached = cache.get(sessionId);
-  if (cached && isValidPublicSessionPayload(cached)) {
+  if (cached && isValidPublicSessionPayload(cached, expectedAuthSig)) {
     return cached;
   }
   const dec = safeDecrypt(sessionId);
-  if (isValidPublicSessionPayload(dec)) {
+  if (isValidPublicSessionPayload(dec, expectedAuthSig)) {
     cache.set(sessionId, dec);
     return dec;
   }
@@ -14073,26 +14122,44 @@ async function loadYamlConfig(basePath, configPath) {
   }
   return {};
 }
+function stripUnsafeKeys(value) {
+  if (Array.isArray(value)) return value.map(stripUnsafeKeys);
+  if (!isPlainObject(value)) return value;
+  const clean = {};
+  for (const [key, nested] of Object.entries(value)) {
+    if (UNSAFE_MERGE_KEYS.has(key)) continue;
+    clean[key] = stripUnsafeKeys(nested);
+  }
+  return clean;
+}
+function isPlainObject(value) {
+  if (!value || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
 function deepMerge(target, source) {
   const result = { ...target };
   for (const key in source) {
+    if (UNSAFE_MERGE_KEYS.has(key)) continue;
     const sourceVal = source[key];
     const targetVal = result[key];
     if (sourceVal !== void 0 && sourceVal !== null) {
       if (typeof sourceVal === "object" && !Array.isArray(sourceVal) && typeof targetVal === "object" && !Array.isArray(targetVal) && targetVal !== null) {
         result[key] = deepMerge(targetVal, sourceVal);
       } else {
-        result[key] = sourceVal;
+        result[key] = stripUnsafeKeys(sourceVal);
       }
     }
   }
   return result;
 }
+var UNSAFE_MERGE_KEYS;
 var init_config_loader = __esm({
   "libs/sdk/src/builtin/config/providers/config-loader.ts"() {
     "use strict";
     init_config_service();
     init_env_loader();
+    UNSAFE_MERGE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
   }
 });
 
@@ -18128,7 +18195,7 @@ function isUIResourceUri(uri) {
   return uri.startsWith("ui://");
 }
 function parseWidgetUri(uri) {
-  const match = uri.match(/^ui:\/\/widget\/([^.]+)\.(\w+)$/);
+  const match = uri.match(WIDGET_URI_PATTERN);
   if (!match) return null;
   return { toolName: match[1], extension: match[2] };
 }
@@ -18137,7 +18204,7 @@ function getUIResourceMimeType(_platformOrUri) {
   if (_platformOrUri?.endsWith(".css")) return "text/css";
   return MCP_APPS_MIME_TYPE;
 }
-var ToolUIRegistry;
+var ToolUIRegistry, WIDGET_URI_PATTERN;
 var init_ui_shared = __esm({
   "libs/sdk/src/tool/ui/ui-shared.ts"() {
     "use strict";
@@ -18262,6 +18329,7 @@ var init_ui_shared = __esm({
         return { meta: result.meta };
       }
     };
+    WIDGET_URI_PATTERN = /^ui:\/\/widget\/([A-Za-z0-9_:@-]+)\.(html|js|css)$/;
   }
 });
 
@@ -20746,6 +20814,7 @@ var init_tool_credentials_gate = __esm({
 });
 
 // libs/sdk/src/tool/flows/call-tool.flow.ts
+import { signIncrementalAuthTicket } from "@frontmcp/auth";
 import { ConcurrencyLimitError, ExecutionTimeoutError, withTimeout } from "@frontmcp/guard";
 import { z as z56 } from "@frontmcp/lazy-zod";
 import { CallToolRequestSchema as CallToolRequestSchema2, CallToolResultSchema as CallToolResultSchema2 } from "@frontmcp/protocol";
@@ -21134,7 +21203,7 @@ var init_call_tool_flow = __esm({
             this.logger.verbose(`checkToolAuthorization: using anonymous for ${appId}`);
             return;
           }
-          const authUrl = this.buildProgressiveAuthUrl(appId, tool?.fullName || "");
+          const authUrl = this.buildProgressiveAuthUrl(appId, tool?.fullName || "", authInfo, claimAuthorizedApps);
           this.logger.info(`checkToolAuthorization: authorization required for app "${appId}"`);
           throw new AuthorizationRequiredError({
             appId,
@@ -21146,11 +21215,51 @@ var init_call_tool_flow = __esm({
         this.logger.verbose("checkToolAuthorization:done");
       }
       /**
-       * Build the URL for progressive/incremental authorization
+       * Build the URL for progressive/incremental authorization.
+       *
+       * This is the ONE point in the request lifecycle where the caller's identity
+       * is both known and verified, so it is where the incremental-authorization
+       * ticket is minted (GHSA-2c4g-9c8x-6m8g). The ticket is what later authorizes
+       * `/oauth/authorize` to skip the login step; `app`/`tool` are carried purely
+       * for display and are re-read from the signed payload server-side.
+       *
+       * When no verified subject or signing secret is available the URL is emitted
+       * WITHOUT a ticket — the user then completes an ordinary login, which is the
+       * correct fail-closed outcome rather than a credential-free shortcut.
        */
-      buildProgressiveAuthUrl(appId, toolId) {
+      buildProgressiveAuthUrl(appId, toolId, authInfo, priorAppIds) {
         const baseUrl = this.scope.fullPath || "";
-        return `${baseUrl}/oauth/authorize?app=${encodeURIComponent(appId)}&tool=${encodeURIComponent(toolId)}`;
+        const url = new URL(`${baseUrl}/oauth/authorize`, "http://placeholder.invalid");
+        url.searchParams.set("app", appId);
+        url.searchParams.set("tool", toolId);
+        const ticket = this.mintIncrementalTicket(appId, toolId, authInfo, priorAppIds);
+        if (ticket) {
+          url.searchParams.set("ticket", ticket);
+        } else {
+          this.logger.verbose("buildProgressiveAuthUrl: no incremental ticket minted \u2014 link requires a full login");
+        }
+        return baseUrl.startsWith("http") ? url.toString() : `${url.pathname}${url.search}`;
+      }
+      /**
+       * Mint a single-use, short-lived incremental-authorization ticket for the
+       * verified caller. Returns undefined when the scope has no local signing
+       * secret or the request has no verified subject.
+       */
+      mintIncrementalTicket(appId, toolId, authInfo, priorAppIds) {
+        const extraUser = authInfo?.extra?.user;
+        const sub = extraUser?.sub ?? authInfo?.user?.sub;
+        if (!sub) return void 0;
+        const secret = this.scope.auth?.signingSecret;
+        if (!secret) return void 0;
+        return signIncrementalAuthTicket(
+          {
+            sub,
+            appId,
+            toolId,
+            ...priorAppIds && priorAppIds.size > 0 ? { priorAppIds: [...priorAppIds] } : {}
+          },
+          secret
+        );
       }
       async checkEntryAuthorities() {
         this.logger.verbose("checkEntryAuthorities:start");
@@ -23107,8 +23216,180 @@ var init_adapter_registry = __esm({
   }
 });
 
+// libs/sdk/src/common/utils/path.utils.ts
+import { joinPath, trimSlashes } from "@frontmcp/utils";
+import { trimSlashes as trimSlashes2, joinPath as joinPath2 } from "@frontmcp/utils";
+function normalizeEntryPrefix(entryPath) {
+  const t = trimSlashes(entryPath ?? "");
+  return t ? `/${t}` : "";
+}
+function resolveEntryPath(entryPath) {
+  if (entryPath !== void 0) return entryPath;
+  return process.env["FRONTMCP_HTTP_ENTRY_PATH"] ?? "";
+}
+function normalizeScopeBase(scopeBase) {
+  const t = trimSlashes(scopeBase ?? "");
+  return t ? `/${t}` : "";
+}
+function readPublicUrlPin() {
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      const v = process.env["FRONTMCP_PUBLIC_URL"];
+      if (typeof v === "string" && v.trim()) {
+        return v.trim().replace(/\/+$/, "");
+      }
+    }
+  } catch {
+  }
+  return void 0;
+}
+function isPublicUrlPinned() {
+  return readPublicUrlPin() !== void 0;
+}
+function isProxyTrusted() {
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      const v = process.env["FRONTMCP_TRUST_PROXY"];
+      return typeof v === "string" && /^(1|true|yes|on)$/i.test(v.trim());
+    }
+  } catch {
+  }
+  return false;
+}
+function getRequestBaseUrl(req, entryPath) {
+  const pin = readPublicUrlPin();
+  if (pin) {
+    return `${pin}${entryPath ?? ""}`;
+  }
+  const trustProxy = isProxyTrusted();
+  const fwdProto = trustProxy ? req.headers["x-forwarded-proto"] : void 0;
+  const fwdHost = trustProxy ? req.headers["x-forwarded-host"] : void 0;
+  const proto = fwdProto || req.protocol || "http";
+  const host = fwdHost || req.headers["host"];
+  return `${proto}://${host}${entryPath ?? ""}`;
+}
+function computeIssuer(req, entryPath, scopeBase) {
+  const entryPrefix = normalizeEntryPrefix(entryPath);
+  const scope = normalizeScopeBase(scopeBase);
+  return `${getRequestBaseUrl(req)}${entryPrefix}${scope}`;
+}
+function computeResource(req, entryPath, scopeBase) {
+  const entryPrefix = normalizeEntryPrefix(entryPath);
+  const scope = normalizeScopeBase(scopeBase);
+  return `${getRequestBaseUrl(req)}${entryPrefix}${scope}`;
+}
+function normalizeResourceUri(uri) {
+  try {
+    const url = new URL(uri);
+    let normalized = `${url.protocol}//${url.hostname}`;
+    const isDefaultPort = url.protocol === "https:" && url.port === "443" || url.protocol === "http:" && url.port === "80";
+    if (url.port && !isDefaultPort) {
+      normalized += `:${url.port}`;
+    }
+    let path3 = url.pathname;
+    if (path3.length > 1 && path3.endsWith("/")) {
+      path3 = path3.slice(0, -1);
+    }
+    normalized += path3;
+    return normalized;
+  } catch {
+    return uri;
+  }
+}
+function resourceUriMatches(provided, canonical) {
+  return normalizeResourceUri(provided) === normalizeResourceUri(canonical);
+}
+function urlToSafeId(url) {
+  const u = new URL(url);
+  const raw = (u.host + (u.pathname && u.pathname !== "/" ? u.pathname : "")).replace(/\/+$/, "");
+  return trimSlashes(raw).replace(/[^a-zA-Z0-9_-]/g, "-");
+}
+function makeWellKnownPaths(name42, entryPrefix, scopeBase = "") {
+  const prefix = normalizeEntryPrefix(entryPrefix);
+  const scope = normalizeScopeBase(scopeBase);
+  const reversed = joinPath(".well-known", name42) + `${prefix}${scope}`;
+  const inPrefixRoot = `${prefix}${joinPath(".well-known", name42)}${scope}`;
+  const inPrefixScope = `${prefix}${scope}${joinPath(".well-known", name42)}`;
+  return /* @__PURE__ */ new Set([reversed, inPrefixRoot, inPrefixScope]);
+}
+var init_path_utils = __esm({
+  "libs/sdk/src/common/utils/path.utils.ts"() {
+    "use strict";
+  }
+});
+
 // libs/sdk/src/context/metadata.utils.ts
-function extractMetadata(headers) {
+function isIpv4(value) {
+  const match = IPV4_PATTERN.exec(value);
+  if (!match) return false;
+  return match.slice(1).every((octet) => {
+    if (octet.length > 1 && octet.startsWith("0")) return false;
+    return Number(octet) <= 255;
+  });
+}
+function isIpv6(value) {
+  const text = value.includes("%") ? value.slice(0, value.indexOf("%")) : value;
+  if (text.length === 0) return false;
+  let head = text;
+  let embedded = 0;
+  const lastColon = head.lastIndexOf(":");
+  const tail = lastColon === -1 ? "" : head.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    if (!isIpv4(tail)) return false;
+    head = head.slice(0, lastColon + 1);
+    embedded = 2;
+  }
+  const halves = head.split("::");
+  if (halves.length > 2) return false;
+  const countGroups = (part) => {
+    if (part === "") return 0;
+    const groups = part.split(":").filter((group, index, all) => !(group === "" && index === all.length - 1));
+    for (const group of groups) {
+      if (!/^[0-9A-Fa-f]{1,4}$/.test(group)) return null;
+    }
+    return groups.length;
+  };
+  const headCount = countGroups(halves[0]);
+  if (headCount === null) return false;
+  if (halves.length === 1) {
+    return headCount + embedded === 8;
+  }
+  const tailCount = countGroups(halves[1]);
+  if (tailCount === null) return false;
+  return headCount + tailCount + embedded <= 7;
+}
+function isIpAddress(value) {
+  const candidate = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
+  return candidate.includes(":") ? isIpv6(candidate) : isIpv4(candidate);
+}
+function normalizeIp(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  if (!trimmed) return void 0;
+  return isIpAddress(trimmed) ? trimmed : void 0;
+}
+function readTrustedProxyDepth() {
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      const parsed = Number(process.env["FRONTMCP_TRUSTED_PROXY_DEPTH"]);
+      if (Number.isInteger(parsed) && parsed > 0) return parsed;
+    }
+  } catch {
+  }
+  return 1;
+}
+function normalizeDepth(depth) {
+  if (depth === void 0) return readTrustedProxyDepth();
+  return Number.isInteger(depth) && depth > 0 ? depth : readTrustedProxyDepth();
+}
+function headerValues(header) {
+  if (typeof header === "string") return header.split(",");
+  if (Array.isArray(header)) {
+    return header.filter((entry) => typeof entry === "string").flatMap((entry) => entry.split(","));
+  }
+  return [];
+}
+function extractMetadata(headers, options) {
   const customHeaders = {};
   for (const [key, value] of Object.entries(headers)) {
     if (key.toLowerCase().startsWith("x-frontmcp-") && typeof value === "string") {
@@ -23119,30 +23400,34 @@ function extractMetadata(headers) {
     userAgent: typeof headers["user-agent"] === "string" ? headers["user-agent"] : void 0,
     contentType: typeof headers["content-type"] === "string" ? headers["content-type"] : void 0,
     accept: typeof headers["accept"] === "string" ? headers["accept"] : void 0,
-    clientIp: extractClientIp(headers),
+    clientIp: extractClientIp(headers, options),
     customHeaders
   };
 }
-function extractClientIp(headers) {
-  const xff = headers["x-forwarded-for"];
-  if (typeof xff === "string") {
-    return xff.split(",")[0]?.trim();
-  }
-  if (Array.isArray(xff) && typeof xff[0] === "string") {
-    return xff[0].split(",")[0]?.trim();
+function extractClientIp(headers, options) {
+  const peerIp = normalizeIp(options?.peerAddress);
+  const trustProxy = options?.trustProxy ?? isProxyTrusted();
+  if (!trustProxy) {
+    return peerIp;
   }
-  const realIp = headers["x-real-ip"];
-  if (typeof realIp === "string") {
-    return realIp;
+  const depth = normalizeDepth(options?.trustedProxyDepth);
+  const forwarded = headerValues(headers["x-forwarded-for"]).map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+  if (forwarded.length > 0) {
+    if (forwarded.length < depth) return peerIp;
+    return normalizeIp(forwarded[forwarded.length - depth]) ?? peerIp;
   }
-  if (Array.isArray(realIp) && typeof realIp[0] === "string") {
-    return realIp[0];
+  if (depth === 1) {
+    const realIp = normalizeIp(headerValues(headers["x-real-ip"])[0]);
+    if (realIp) return realIp;
   }
-  return void 0;
+  return peerIp;
 }
+var IPV4_PATTERN;
 var init_metadata_utils = __esm({
   "libs/sdk/src/context/metadata.utils.ts"() {
     "use strict";
+    init_path_utils();
+    IPV4_PATTERN = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
   }
 });
 
@@ -23187,10 +23472,11 @@ var init_frontmcp_context_storage = __esm({
        * @returns Result of the callback
        */
       runFromHeaders(headers, args, fn) {
+        const { peerAddress, ...contextArgs } = args;
         const traceContext = parseTraceContext(headers);
-        const metadata = extractMetadata(headers);
+        const metadata = extractMetadata(headers, { peerAddress });
         const context = new FrontMcpContext({
-          ...args,
+          ...contextArgs,
           traceContext,
           metadata
         });
@@ -24370,11 +24656,13 @@ var init_flow_instance = __esm({
         const headerSessionId = typeof headers["mcp-session-id"] === "string" ? headers["mcp-session-id"].trim() : "";
         const sessionId = headerSessionId.length > 0 ? headerSessionId : `anon:${randomUUID13()}`;
         const scope = this.globalProviders.getActiveScope();
+        const peerAddress = request.socket?.remoteAddress;
         return storage.runFromHeaders(
           headers,
           {
             sessionId,
-            scopeId: scope.id
+            scopeId: scope.id,
+            peerAddress
           },
           async () => {
             return this.run(input, deps);
@@ -34318,13 +34606,13 @@ var init_esm_module_loader = __esm({
             URL.revokeObjectURL(url);
           }
         }
-        const { ensureDir, fileExists: fileExists9, sha256Hex: sha256Hex11, writeFile } = await import("@frontmcp/utils");
+        const { ensureDir, fileExists: fileExists9, sha256Hex: sha256Hex12, writeFile } = await import("@frontmcp/utils");
         const nodePath = await import("node:path");
         const nodeOs = await import("node:os");
         const { pathToFileURL } = await import("node:url");
         const dir = nodePath.join(nodeOs.tmpdir(), "frontmcp-esm-modules");
         await ensureDir(dir);
-        const tempPath = nodePath.join(dir, `${sha256Hex11(bundleContent)}.mjs`);
+        const tempPath = nodePath.join(dir, `${sha256Hex12(bundleContent)}.mjs`);
         if (!await fileExists9(tempPath)) {
           await writeFile(tempPath, bundleContent);
         }
@@ -35896,7 +36184,8 @@ import {
   createFederatedAuthSession,
   escapeHtml as escapeHtml2,
   renderLocalLoginPage,
-  startNextProvider
+  startNextProvider,
+  verifyIncrementalAuthTicket
 } from "@frontmcp/auth";
 import { z as z64 } from "@frontmcp/lazy-zod";
 import { generateCodeVerifier, randomUUID as randomUUID15, sha256Base64url } from "@frontmcp/utils";
@@ -35971,6 +36260,13 @@ var init_oauth_authorize_flow = __esm({
       targetAppId: z64.string().optional().describe("Target app ID for incremental authorization"),
       targetToolId: z64.string().optional().describe("Target tool ID that triggered the incremental auth"),
       existingSessionId: z64.string().optional().describe("Existing session ID for incremental auth"),
+      /**
+       * The VERIFIED incremental-authorization ticket (GHSA-2c4g-9c8x-6m8g). Set
+       * only when `?ticket=` carried a valid, unexpired server signature. Its `sub`
+       * is the proven identity the expanded grant is minted for; `isIncrementalAuth`
+       * is derived from its presence, never from a raw query parameter.
+       */
+      incrementalTicket: z64.custom().optional(),
       /**
        * Apps the client already holds a grant for (the prior `authorized_apps`
        * claim), carried forward on an incremental authorize so the newly-minted
@@ -36023,18 +36319,21 @@ var init_oauth_authorize_flow = __esm({
         const { request } = this.rawInput;
         const rawRedirectUri = request.query["redirect_uri"];
         const rawState = request.query["state"];
-        const targetAppId = request.query["app"];
-        const targetToolId = request.query["tool"];
-        const existingSessionId = request.query["session_id"];
-        const mode = request.query["mode"];
-        const isIncrementalAuth = mode === "incremental" || !!targetAppId;
-        const appsParam = request.query["apps"];
+        const incrementalTicket = this.verifyIncrementalTicket(request.query["ticket"]);
+        const isIncrementalAuth = incrementalTicket !== void 0;
+        const targetAppId = incrementalTicket?.appId;
+        const targetToolId = incrementalTicket?.toolId;
         let priorAuthorizedAppIds;
-        if (appsParam) {
-          const raw = Array.isArray(appsParam) ? appsParam : [appsParam];
-          const ids = raw.flatMap((v) => String(v).split(",")).map((s) => s.trim()).filter(Boolean);
-          priorAuthorizedAppIds = ids.length > 0 ? Array.from(new Set(ids)) : void 0;
+        if (incrementalTicket) {
+          priorAuthorizedAppIds = incrementalTicket.priorAppIds && incrementalTicket.priorAppIds.length > 0 ? Array.from(new Set(incrementalTicket.priorAppIds)) : void 0;
+        } else {
+          const appsParam = request.query["apps"];
+          if (appsParam) {
+            const ids = (Array.isArray(appsParam) ? appsParam : [appsParam]).flatMap((v) => String(v).split(",")).map((v) => v.trim()).filter(Boolean);
+            priorAuthorizedAppIds = ids.length > 0 ? Array.from(new Set(ids)) : void 0;
+          }
         }
+        const existingSessionId = request.query["session_id"];
         const isDefaultAuthProvider = !metadata.auth;
         let requiresFederatedLogin = false;
         if (metadata.auth && isOrchestratedMode(metadata.auth)) {
@@ -36060,6 +36359,7 @@ var init_oauth_authorize_flow = __esm({
           targetToolId,
           existingSessionId,
           priorAuthorizedAppIds,
+          incrementalTicket,
           // Federated Login
           requiresFederatedLogin,
           // Consent Flow
@@ -36185,6 +36485,28 @@ var init_oauth_authorize_flow = __esm({
           }
         }
       }
+      /**
+       * Verify a client-supplied incremental-authorization ticket.
+       *
+       * Returns the verified payload, or `undefined` when the parameter is absent,
+       * malformed, expired, or not signed by this server. Verification is
+       * side-effect free — the ticket is CLAIMED (single use) later, in
+       * {@link prepareAuthorizationRequest}, so a request that fails OAuth
+       * validation does not burn the user's ticket.
+       */
+      verifyIncrementalTicket(raw) {
+        const token = typeof raw === "string" ? raw : Array.isArray(raw) ? raw[0] : void 0;
+        if (typeof token !== "string" || token.length === 0) return void 0;
+        const localAuth = this.scope.auth;
+        const secret = localAuth?.signingSecret;
+        if (!secret) return void 0;
+        const payload = verifyIncrementalAuthTicket(token, secret);
+        if (!payload) {
+          this.logger.warn("Incremental auth ticket failed verification \u2014 treating as an ordinary login");
+          return void 0;
+        }
+        return payload;
+      }
       async checkIfAuthorized() {
       }
       async prepareAuthorizationRequest() {
@@ -36196,7 +36518,8 @@ var init_oauth_authorize_flow = __esm({
           existingSessionId,
           priorAuthorizedAppIds,
           requiresFederatedLogin,
-          requiresConsent
+          requiresConsent,
+          incrementalTicket
         } = this.state;
         const { metadata } = this.scope;
         if (!validatedRequest) {
@@ -36209,6 +36532,25 @@ var init_oauth_authorize_flow = __esm({
         }
         const localAuth = auth;
         const store = localAuth.authorizationStore;
+        let effectiveIncremental = isIncrementalAuth;
+        let effectivePriorAppIds = priorAuthorizedAppIds;
+        if (incrementalTicket) {
+          const claimed = await localAuth.claimIncrementalTicket(
+            incrementalTicket.jti,
+            Math.max(0, incrementalTicket.exp - Date.now())
+          );
+          if (!claimed) {
+            this.logger.warn("Incremental auth ticket already used \u2014 falling back to an ordinary login");
+            effectiveIncremental = false;
+            effectivePriorAppIds = void 0;
+            this.state.set({
+              isIncrementalAuth: false,
+              targetAppId: void 0,
+              targetToolId: void 0,
+              priorAuthorizedAppIds: void 0
+            });
+          }
+        }
         let federatedLogin;
         if (requiresFederatedLogin) {
           const apps = this.scope.apps.getApps();
@@ -36256,12 +36598,16 @@ var init_oauth_authorize_flow = __esm({
           },
           state: validatedRequest.state,
           resource: validatedRequest.resource,
-          // Progressive/Incremental Authorization Fields
-          isIncremental: isIncrementalAuth,
-          targetAppId,
-          targetToolId,
+          // Progressive/Incremental Authorization Fields. `isIncremental` reflects a
+          // CLAIMED, server-signed ticket; `incrementalSub` is the identity that
+          // ticket proved, and is the only subject the callback may mint for when
+          // it skips the credential gate.
+          isIncremental: effectiveIncremental,
+          incrementalSub: effectiveIncremental ? incrementalTicket?.sub : void 0,
+          targetAppId: effectiveIncremental ? targetAppId : void 0,
+          targetToolId: effectiveIncremental ? targetToolId : void 0,
           existingSessionId,
-          priorAuthorizedAppIds,
+          priorAuthorizedAppIds: effectivePriorAppIds,
           // Federated Login State
           federatedLogin,
           // Consent State
@@ -36269,7 +36615,7 @@ var init_oauth_authorize_flow = __esm({
         });
         await localAuth.authorizationStore.storePendingAuthorization(pendingRecord);
         this.logger.info(
-          `Pending authorization created: ${pendingRecord.id}${isIncrementalAuth ? ` (incremental for app: ${targetAppId})` : ""}${requiresFederatedLogin ? " (federated)" : ""}${requiresConsent ? " (consent enabled)" : ""}`
+          `Pending authorization created: ${pendingRecord.id}${effectiveIncremental ? ` (incremental for app: ${targetAppId})` : ""}${requiresFederatedLogin ? " (federated)" : ""}${requiresConsent ? " (consent enabled)" : ""}`
         );
         this.state.set("pendingAuthId", pendingRecord.id);
       }
@@ -36836,8 +37182,6 @@ var init_oauth_callback_flow = __esm({
         const email = request.query["email"];
         const name42 = request.query["name"];
         const loginFields = this.collectLoginFields(request);
-        const isIncremental = request.query["incremental"] === "true";
-        const targetAppId = request.query["app_id"];
         const isFederated = request.query["federated"] === "true";
         const providersParam = request.query["providers"];
         let selectedProviders;
@@ -36856,8 +37200,6 @@ var init_oauth_callback_flow = __esm({
           pendingAuthId,
           email,
           name: name42,
-          isIncremental,
-          targetAppId,
           isFederated,
           selectedProviders,
           selectedTools,
@@ -36865,9 +37207,6 @@ var init_oauth_callback_flow = __esm({
           loginFields,
           csrf
         });
-        if (isIncremental) {
-          this.logger.info(`Incremental auth callback for app: ${targetAppId}`);
-        }
         if (isFederated) {
           this.logger.info(`Federated login callback with ${selectedProviders?.length || 0} selected providers`);
         }
@@ -36876,31 +37215,13 @@ var init_oauth_callback_flow = __esm({
         }
       }
       async validatePendingAuth() {
-        const {
-          pendingAuthId,
-          email,
-          name: name42,
-          isIncremental,
-          isFederated,
-          selectedProviders,
-          selectedTools,
-          consentSubmitted,
-          loginFields
-        } = this.state;
+        const { pendingAuthId, email, name: name42, isFederated, selectedProviders, selectedTools, consentSubmitted, loginFields } = this.state;
         if (!pendingAuthId) {
           this.logger.warn("Missing pending_auth_id in callback");
           this.respond(httpRespond.html(this.renderErrorPage("invalid_request", "Missing pending_auth_id parameter"), 400));
           return;
         }
         const localAuth = this.scope.auth;
-        const localOptions = localAuth.options;
-        const authenticateFn = typeof localOptions.authenticate === "function" ? localOptions.authenticate : void 0;
-        const requireEmail = localOptions.requireEmail ?? true;
-        if (!authenticateFn && !isIncremental && !email && requireEmail) {
-          this.logger.warn("Missing email in callback");
-          this.respond(httpRespond.html(this.renderErrorPage("invalid_request", "Email is required"), 400));
-          return;
-        }
         const pendingAuth = await localAuth.authorizationStore.getPendingAuthorization(pendingAuthId);
         if (!pendingAuth) {
           this.logger.warn(`Pending authorization not found or expired: ${pendingAuthId}`);
@@ -36912,6 +37233,20 @@ var init_oauth_callback_flow = __esm({
           );
           return;
         }
+        const isIncremental = pendingAuth.isIncremental === true && typeof pendingAuth.incrementalSub === "string";
+        const targetAppId = isIncremental ? pendingAuth.targetAppId : void 0;
+        this.state.set({ isIncremental, targetAppId });
+        if (isIncremental) {
+          this.logger.info(`Incremental auth callback for app: ${targetAppId}`);
+        }
+        const localOptions = localAuth.options;
+        const authenticateFn = typeof localOptions.authenticate === "function" ? localOptions.authenticate : void 0;
+        const requireEmail = localOptions.requireEmail ?? true;
+        if (!authenticateFn && !isIncremental && !email && requireEmail) {
+          this.logger.warn("Missing email in callback");
+          this.respond(httpRespond.html(this.renderErrorPage("invalid_request", "Email is required"), 400));
+          return;
+        }
         if (pendingAuth.authUiCsrf) {
           const submitted = this.state.csrf;
           if (!submitted || !timingSafeEqualStr3(pendingAuth.authUiCsrf, submitted)) {
@@ -36926,9 +37261,11 @@ var init_oauth_callback_flow = __esm({
           return;
         }
         let userSub;
-        if (email) {
+        if (isIncremental) {
+          userSub = pendingAuth.incrementalSub;
+        } else if (email) {
           userSub = this.generateUserSub(email);
-        } else if (!requireEmail || isIncremental) {
+        } else if (!requireEmail) {
           const anonymousSubject = localOptions.anonymousSubject ?? "local-operator";
           userSub = this.generateUserSub(anonymousSubject);
         } else {
@@ -37097,10 +37434,13 @@ var init_oauth_callback_flow = __esm({
           originalState: pendingAuth.state,
           resource: pendingAuth.resource,
           userSub,
-          // Progressive/Incremental Authorization from pending record
-          isIncremental: pendingAuth.isIncremental || isIncremental,
-          targetAppId: pendingAuth.targetAppId || this.state.targetAppId,
-          targetToolId: pendingAuth.targetToolId,
+          // Progressive/Incremental Authorization — from the pending record ONLY.
+          // `isIncremental` was derived above from the record plus its proven
+          // subject; OR-ing a client-supplied flag in here is what let a caller
+          // override the server's `false` (GHSA-2c4g-9c8x-6m8g).
+          isIncremental,
+          targetAppId,
+          targetToolId: isIncremental ? pendingAuth.targetToolId : void 0,
           existingSessionId: pendingAuth.existingSessionId,
           existingAuthorizationId: pendingAuth.existingAuthorizationId,
           priorAuthorizedAppIds: pendingAuth.priorAuthorizedAppIds,
@@ -37704,6 +38044,7 @@ var init_oauth_callback_flow = __esm({
       "pending_auth_id",
       "incremental",
       "app_id",
+      "ticket",
       "federated",
       "providers",
       "tools",
@@ -39444,7 +39785,23 @@ import {
   validateAudience
 } from "@frontmcp/auth";
 import { z as z71 } from "@frontmcp/lazy-zod";
-import { getMachineId as getMachineId2, randomUUID as randomUUID20 } from "@frontmcp/utils";
+import { getMachineId as getMachineId2, randomUUID as randomUUID20, sha256, sha256Hex as sha256Hex9, timingSafeEqual as timingSafeEqual2 } from "@frontmcp/utils";
+function constantTimeEquals(a, b) {
+  const encoder5 = new TextEncoder();
+  return timingSafeEqual2(sha256(encoder5.encode(a)), sha256(encoder5.encode(b)));
+}
+function quoteHeaderParam(value) {
+  return value.replace(/[^\x20-\x21\x23-\x7e]/g, "");
+}
+function buildStaticChallenge(options, description) {
+  const scheme = options.scheme.trim();
+  if (!scheme) return "";
+  const parts = [`${quoteHeaderParam(scheme)} realm="${quoteHeaderParam(options.realm)}"`];
+  if (description) {
+    parts.push('error="invalid_token"', `error_description="${quoteHeaderParam(description)}"`);
+  }
+  return parts.join(", ");
+}
 var inputSchema23, stateSchema22, UnauthorizedSchema, AuthorizedSchema, ForbiddenSchema, sessionVerifyOutputSchema, plan22, name22, Stage22, warnedUnpinnedAudience, SessionVerifyFlow;
 var init_session_verify_flow = __esm({
   "libs/sdk/src/auth/flows/session.verify.flow.ts"() {
@@ -39485,7 +39842,14 @@ var init_session_verify_flow = __esm({
     }).describe("403 Forbidden \u2014 token valid but insufficient scope");
     sessionVerifyOutputSchema = z71.union([UnauthorizedSchema, AuthorizedSchema, ForbiddenSchema]);
     plan22 = {
-      pre: ["parseInput", "handlePublicMode", "handleAnonymousFallback", "requireAuthorizationHeader", "verifyIfJwt"],
+      pre: [
+        "parseInput",
+        "handleStaticToken",
+        "handlePublicMode",
+        "handleAnonymousFallback",
+        "requireAuthorizationHeader",
+        "verifyIfJwt"
+      ],
       execute: ["deriveUser", "parseSessionHeader", "buildAuthorizedOutput"]
     };
     name22 = "session:verify";
@@ -39503,14 +39867,20 @@ var init_session_verify_flow = __esm({
        * Encapsulates the shared logic for session creation, payload encryption, and user derivation.
        */
       createAnonymousSession(options) {
-        const { authMode, issuer, scopes = ["anonymous"], sessionIdHeader } = options;
+        const { authMode, issuer, scopes = ["anonymous"], subject, sessionIdHeader } = options;
         this.logger.verbose("createAnonymousSession", { authMode, hasExistingSession: !!sessionIdHeader });
         const machineId = getMachineId2();
+        const authSignature = subject ? `${authMode}:${subject}` : authMode;
         if (sessionIdHeader) {
-          const existingPayload = decryptPublicSession(sessionIdHeader);
+          const existingPayload = decryptPublicSession(sessionIdHeader, authSignature);
           if (existingPayload && existingPayload.nodeId === machineId) {
             const anonId = existingPayload.uuid ?? `${existingPayload.iat * 1e3}`;
-            const user2 = { sub: `anon:${anonId}`, iss: issuer, name: "Anonymous", scope: scopes.join(" ") };
+            const user2 = {
+              sub: subject ?? `anon:${anonId}`,
+              iss: issuer,
+              name: subject ? "Static token" : "Anonymous",
+              scope: scopes.join(" ")
+            };
             this.respond({
               kind: "authorized",
               authorization: {
@@ -39525,9 +39895,9 @@ var init_session_verify_flow = __esm({
         }
         const now = Date.now();
         const user = {
-          sub: `anon:${randomUUID20()}`,
+          sub: subject ?? `anon:${randomUUID20()}`,
           iss: issuer,
-          name: "Anonymous",
+          name: subject ? "Static token" : "Anonymous",
           scope: scopes.join(" ")
         };
         const uuid = randomUUID20();
@@ -39536,7 +39906,7 @@ var init_session_verify_flow = __esm({
         const payload = {
           uuid,
           nodeId: machineId,
-          authSig: authMode,
+          authSig: authSignature,
           iat: Math.floor(now / 1e3),
           isPublic: authMode === "public",
           authMode,
@@ -39586,14 +39956,68 @@ var init_session_verify_flow = __esm({
           prmUrl
         });
       }
+      async handleStaticToken() {
+        const authOptions = this.scope.auth?.options;
+        if (!authOptions || !isStaticMode(authOptions)) return;
+        const options = authOptions;
+        const presented = this.readStaticCredential(options);
+        if (!presented) {
+          this.logger.warn("handleStaticToken: no credential presented, returning 401");
+          this.respond({
+            kind: "unauthorized",
+            prmMetadataHeader: buildStaticChallenge(options)
+          });
+          return;
+        }
+        const matched = options.tokens.reduce(
+          (found, candidate) => constantTimeEquals(candidate, presented) ? candidate : found,
+          void 0
+        );
+        if (!matched) {
+          this.logger.warn("handleStaticToken: credential did not match, returning 401");
+          this.respond({
+            kind: "unauthorized",
+            prmMetadataHeader: buildStaticChallenge(options, "The access token is invalid")
+          });
+          return;
+        }
+        this.logger.verbose("handleStaticToken: credential accepted");
+        this.createAnonymousSession({
+          authMode: "static",
+          issuer: "static",
+          scopes: options.scopes,
+          subject: `static:${sha256Hex9(matched).slice(0, 12)}`,
+          sessionIdHeader: this.state.sessionIdHeader
+        });
+      }
+      /**
+       * Pull the credential out of the configured header, stripping the scheme
+       * prefix when one is configured (case-insensitively, per RFC 7235).
+       */
+      readStaticCredential(options) {
+        const headers = this.rawInput.request.headers ?? {};
+        const raw = headers[options.header.toLowerCase()];
+        const value = (Array.isArray(raw) ? raw[0] : raw)?.trim();
+        if (!value) return void 0;
+        const { scheme } = options;
+        if (!scheme) return value;
+        if (value.slice(0, scheme.length).toLowerCase() !== scheme.toLowerCase()) return void 0;
+        if (value[scheme.length] !== " ") return void 0;
+        return value.slice(scheme.length + 1).trim() || void 0;
+      }
       async handlePublicMode() {
         const authOptions = this.scope.auth?.options;
         if (!authOptions || !isPublicMode(authOptions)) {
           return;
         }
-        if (this.state.token) {
+        if (this.state.token && isJwt(this.state.token)) {
           return;
         }
+        if (this.state.token) {
+          this.logger.verbose(
+            "handlePublicMode: ignoring non-JWT bearer token (public mode has nothing to verify it against)"
+          );
+        }
         this.logger.info("handlePublicMode: allowing anonymous access (public mode)");
         this.createAnonymousSession({
           authMode: "public",
@@ -39767,6 +40191,14 @@ var init_session_verify_flow = __esm({
     __decorateClass([
       Stage22("parseInput")
     ], SessionVerifyFlow.prototype, "parseInput", 1);
+    __decorateClass([
+      Stage22("handleStaticToken", {
+        filter: ({ scope }) => {
+          const authOptions = scope.auth?.options;
+          return !!authOptions && isStaticMode(authOptions);
+        }
+      })
+    ], SessionVerifyFlow.prototype, "handleStaticToken", 1);
     __decorateClass([
       Stage22("handlePublicMode")
     ], SessionVerifyFlow.prototype, "handlePublicMode", 1);
@@ -40261,7 +40693,8 @@ import {
   MemoryStorageAdapter,
   randomBytes as randomBytes6,
   randomUUID as randomUUID21,
-  sha256Hex as sha256Hex9
+  sha256Hex as sha256Hex10,
+  StorageNotSupportedError
 } from "@frontmcp/utils";
 function getDefaultNoAuthSecret() {
   if (!defaultNoAuthSecret) {
@@ -40283,13 +40716,17 @@ function validateAuthorizationIssuer(received, expected) {
   }
   return { ok: true };
 }
-var defaultNoAuthSecret, RESERVED_JWT_CLAIMS, LocalPrimaryAuth;
+function isUnsupportedOperation(error) {
+  return error instanceof StorageNotSupportedError;
+}
+var MIN_HS256_SECRET_BYTES, defaultNoAuthSecret, RESERVED_JWT_CLAIMS, LocalPrimaryAuth;
 var init_instance_local_primary_auth = __esm({
   "libs/sdk/src/auth/instances/instance.local-primary-auth.ts"() {
     "use strict";
     init_common();
     init_auth2();
     init_context_extension();
+    init_errors();
     init_cimd();
     init_credentials();
     init_credentials_context_extension();
@@ -40307,6 +40744,7 @@ var init_instance_local_primary_auth = __esm({
     init_well_known_prm_flow();
     init_secure_store();
     init_secure_store_context_extension();
+    MIN_HS256_SECRET_BYTES = 32;
     RESERVED_JWT_CLAIMS = /* @__PURE__ */ new Set([
       "sub",
       "iss",
@@ -40334,10 +40772,22 @@ var init_instance_local_primary_auth = __esm({
         this.host = getEnv4("FRONTMCP_PUBLIC_HOST")?.trim() || "localhost";
         this.issuer = this.deriveIssuer(options);
         const jwtSecret = getEnv4("JWT_SECRET");
-        if (jwtSecret) {
-          this.secret = new TextEncoder().encode(jwtSecret);
+        const hasJwtSecret = !!jwtSecret?.trim();
+        if (hasJwtSecret && jwtSecret) {
+          const encoded = new TextEncoder().encode(jwtSecret);
+          if (encoded.length < MIN_HS256_SECRET_BYTES) {
+            if (isProduction4()) throw new JwtSecretWeakError(encoded.length);
+            this.logger.warn(
+              `JWT_SECRET is ${encoded.length} bytes; HS256 wants at least ${MIN_HS256_SECRET_BYTES} (RFC 7518). This is refused in production \u2014 generate one with \`openssl rand -hex 32\`.`
+            );
+          }
+          this.secret = encoded;
+        } else if (isProduction4() && isOrchestratedMode(options)) {
+          throw new JwtSecretRequiredError(options.mode);
         } else {
-          this.logger.warn("JWT_SECRET is not set, using default secret");
+          this.logger.warn(
+            "JWT_SECRET is not set; signing with a random per-process secret. Tokens will not survive a restart and will not verify across instances. Set JWT_SECRET for any deployment that mints tokens."
+          );
           this.secret = getDefaultNoAuthSecret();
         }
         this.tokenStorage = this.readTokenStorage(options);
@@ -40394,6 +40844,17 @@ var init_instance_local_primary_auth = __esm({
       dcrClientRegistryImpl;
       /** Storage adapter backing the persistent stores (kept for disposal). */
       storageAdapter;
+      /**
+       * Replay guard for incremental-authorization tickets (GHSA-2c4g-9c8x-6m8g).
+       * Shares the persistent adapter when one is configured so the guard holds
+       * across a distributed deployment; falls back to a dedicated in-memory
+       * adapter, matching how the credential vault selects its backing store.
+       *
+       * Holds the in-flight PROMISE, not the resolved adapter: two concurrent
+       * claims for the same ticket must not each build their own store, or each
+       * would write and read back its own nonce and both would win.
+       */
+      ticketReplayStorage;
       /**
        * Per-session encrypted credential vault (Checkpoint 3b). Backs
        * `this.credentials` in tools and persists `authenticate()` credentials.
@@ -40561,6 +41022,81 @@ var init_instance_local_primary_auth = __esm({
        * (`this.secret`), so resume URLs are framework-signed with the same trust
        * root as the access tokens.
        */
+      /**
+       * The server HMAC signing key, as the string form the `signData`/`verifyData`
+       * helpers take. These are the exact bytes the access tokens are signed with,
+       * so framework-signed URLs share the access tokens' trust root.
+       */
+      get signingSecret() {
+        return new TextDecoder().decode(this.secret);
+      }
+      /**
+       * Claim an incremental-authorization ticket, exactly once.
+       *
+       * A signature check proves a ticket was minted by this server for a verified
+       * subject; it cannot prove the ticket has not already been used. The `auth_url`
+       * carrying the ticket travels through agent transcripts and server logs, so a
+       * leaked ticket must not stay usable for the rest of its TTL.
+       *
+       * The claim is race-free without a transaction: each attempt writes its OWN
+       * nonce under `ifNotExists` and reads the key back. Only the attempt whose
+       * nonce survives won, so concurrent replays all lose.
+       *
+       * @returns true when this caller claimed the ticket, false when it was already used.
+       */
+      async claimIncrementalTicket(jti, ttlMs) {
+        const key = `incremental-ticket:${jti}`;
+        const nonce = randomUUID21();
+        const ttlSeconds = Math.max(1, Math.ceil(ttlMs / 1e3));
+        let storage = await this.getTicketReplayStorage();
+        try {
+          await storage.set(key, nonce, { ifNotExists: true, ttlSeconds });
+        } catch (error) {
+          if (!isUnsupportedOperation(error)) {
+            this.logger.warn(`Incremental ticket replay guard unavailable: ${String(error)}`);
+            return false;
+          }
+          this.logger.warn(
+            "Incremental ticket replay guard: the configured storage has no conditional write; falling back to an in-memory guard (single use holds within this instance only)."
+          );
+          storage = await this.useInMemoryTicketReplayStorage();
+          try {
+            await storage.set(key, nonce, { ifNotExists: true, ttlSeconds });
+          } catch (fallbackError) {
+            this.logger.warn(`Incremental ticket replay guard unavailable: ${String(fallbackError)}`);
+            return false;
+          }
+        }
+        try {
+          return await storage.get(key) === nonce;
+        } catch (error) {
+          this.logger.warn(`Incremental ticket replay guard unavailable: ${String(error)}`);
+          return false;
+        }
+      }
+      getTicketReplayStorage() {
+        if (!this.ticketReplayStorage) {
+          if (this.storageAdapter) {
+            this.ticketReplayStorage = Promise.resolve(this.storageAdapter);
+          } else {
+            this.logger.debug(
+              "Incremental ticket replay guard is in-memory (no persistent tokenStorage configured); single use holds within this instance only."
+            );
+            this.ticketReplayStorage = this.useInMemoryTicketReplayStorage();
+          }
+        }
+        return this.ticketReplayStorage;
+      }
+      /** Replace the replay guard with a fresh in-memory adapter, memoized. */
+      useInMemoryTicketReplayStorage() {
+        const pending = (async () => {
+          const memory = new MemoryStorageAdapter();
+          await memory.connect();
+          return memory;
+        })();
+        this.ticketReplayStorage = pending;
+        return pending;
+      }
       async initializeCredentialVault() {
         if (isPublicMode(this.options)) {
           return;
@@ -40579,7 +41115,7 @@ var init_instance_local_primary_auth = __esm({
           pepper,
           logger: this.logger.child("SessionCredentialVault")
         });
-        const signingSecret = new TextDecoder().decode(this.secret);
+        const signingSecret = this.signingSecret;
         const basePath = this.issuer;
         await this.providers.addDynamicProviders(
           createCredentialsProviders({
@@ -40811,7 +41347,7 @@ var init_instance_local_primary_auth = __esm({
             const pendingAuthId = `pending:${codeRecord.pendingAuthId}`;
             const parts = accessToken.split(".");
             const signature = parts[2] || accessToken;
-            const newAuthId = sha256Hex9(signature).substring(0, 16);
+            const newAuthId = sha256Hex10(signature).substring(0, 16);
             await this.orchestratedTokenStore.migrateTokens(pendingAuthId, newAuthId);
             this.logger.info(`Migrated tokens from ${pendingAuthId} to ${newAuthId}`);
           } catch (err) {
@@ -41523,6 +42059,9 @@ var init_auth_registry = __esm({
         if (isPublicMode(options)) {
           return new LocalPrimaryAuth(scope, providers, options);
         }
+        if (isStaticMode(options)) {
+          return new LocalPrimaryAuth(scope, providers, options);
+        }
         if (isTransparentMode(options)) {
           return new RemotePrimaryAuth(scope, providers, options);
         }
@@ -44884,6 +45423,7 @@ var init_execute_workflow_tool = __esm({
   "libs/sdk/src/workflow/tools/execute-workflow.tool.ts"() {
     "use strict";
     init_common();
+    init_errors();
     ExecuteWorkflowTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -44895,12 +45435,13 @@ var init_execute_workflow_tool = __esm({
         }
         const workflow = workflowRegistry.findByName(input.name);
         if (!workflow) {
-          return this.fail(new Error(`Workflow "${input.name}" not found`));
+          return this.fail(new JobNotAuthorizedError(input.name));
         }
         const result = await executionManager.executeWorkflow(workflow, jobRegistry, {
           background: input.background,
           sessionId: this.authInfo.sessionId,
           authInfo: this.authInfo,
+          authoritiesContextBuilder: this.scope.authoritiesContextBuilder,
           workflowInput: input.input
         });
         return result;
@@ -44925,6 +45466,55 @@ var init_execute_workflow_tool = __esm({
   }
 });
 
+// libs/sdk/src/common/utils/principal.utils.ts
+function toStringArray(value) {
+  if (Array.isArray(value)) return value.filter((v) => typeof v === "string");
+  if (typeof value === "string" && value.length > 0) return value.split(" ").filter(Boolean);
+  return [];
+}
+function asRecord(value) {
+  return value && typeof value === "object" ? value : void 0;
+}
+function firstPresent(sources, convert) {
+  for (const source of sources) {
+    if (source !== void 0 && source !== null) return convert(source);
+  }
+  return [];
+}
+function resolvePrincipal2(authInfo, contextBuilder) {
+  const info = authInfo ?? {};
+  const user = asRecord(info["user"]) ?? {};
+  const extraAuthorization = asRecord(asRecord(info["extra"])?.["authorization"]);
+  const authInfoClaims = asRecord(info["claims"]) ?? {};
+  const authorizationClaims = asRecord(extraAuthorization?.["claims"]) ?? {};
+  const claims = { ...authorizationClaims, ...authInfoClaims, ...user };
+  const scopes = toStringArray(info["scopes"]).length ? toStringArray(info["scopes"]) : firstPresent([extraAuthorization?.["scopes"], claims["scope"], claims["scopes"]], toStringArray);
+  if (contextBuilder) {
+    const ctx = contextBuilder.build(info);
+    return {
+      sub: ctx.user.sub,
+      roles: ctx.user.roles,
+      permissions: ctx.user.permissions,
+      scopes,
+      claims: ctx.user.claims
+    };
+  }
+  const roles = firstPresent([user["roles"], claims["roles"], extraAuthorization?.["scopes"]], toStringArray);
+  const permissions = firstPresent([user["permissions"], claims["permissions"]], toStringArray);
+  return {
+    sub: typeof user["sub"] === "string" ? user["sub"] : "",
+    roles,
+    permissions,
+    scopes,
+    claims
+  };
+}
+var init_principal_utils = __esm({
+  "libs/sdk/src/common/utils/principal.utils.ts"() {
+    "use strict";
+  }
+});
+
 // libs/sdk/src/workflow/tools/get-workflow-status.tool.ts
 import { z as z82 } from "@frontmcp/lazy-zod";
 var GetWorkflowStatusTool;
@@ -44932,6 +45522,7 @@ var init_get_workflow_status_tool = __esm({
   "libs/sdk/src/workflow/tools/get-workflow-status.tool.ts"() {
     "use strict";
     init_common();
+    init_principal_utils();
     GetWorkflowStatusTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -44940,7 +45531,7 @@ var init_get_workflow_status_tool = __esm({
           return this.fail(new Error("Jobs system is not enabled"));
         }
         const record = await executionManager.getStatus(input.runId);
-        if (!record) {
+        if (!record || !this.ownsRun(record)) {
           return this.fail(new Error(`Run "${input.runId}" not found`));
         }
         const workflowRecord = record;
@@ -44953,6 +45544,23 @@ var init_get_workflow_status_tool = __esm({
           completedAt: record.completedAt
         };
       }
+      /**
+       * Match on the owning subject, falling back to the session for runs started
+       * before an owner was recorded (and for anonymous/public servers, where every
+       * caller has an empty subject and the session is the only identity there is).
+       *
+       * A record carrying NEITHER identity is refused. Such a run cannot be
+       * attributed to anyone, and its inputs and results are exactly what this check
+       * exists to protect — anyone holding the id would otherwise be able to read
+       * it. Internal callers that must read unattributed runs should go through the
+       * execution manager directly rather than this tool.
+       */
+      ownsRun(record) {
+        const callerSub = resolvePrincipal2(this.authInfo, this.scope.authoritiesContextBuilder).sub;
+        if (record.ownerSub) return record.ownerSub === callerSub;
+        if (record.sessionId) return record.sessionId === this.authInfo.sessionId;
+        return false;
+      }
     };
     GetWorkflowStatusTool = __decorateClass([
       FrontMcpTool({
@@ -44980,6 +45588,53 @@ var init_get_workflow_status_tool = __esm({
   }
 });
 
+// libs/sdk/src/job/job-permission.guard.ts
+var JobPermissionGuard;
+var init_job_permission_guard = __esm({
+  "libs/sdk/src/job/job-permission.guard.ts"() {
+    "use strict";
+    init_principal_utils();
+    JobPermissionGuard = class _JobPermissionGuard {
+      /**
+       * Check whether the caller may perform `action`.
+       *
+       * @param permissions - the entry's declared rules (undefined = unrestricted).
+       * @param action - the action being attempted.
+       * @param authInfo - the request's AuthInfo.
+       * @param contextBuilder - the scope's authorities context builder, when configured.
+       */
+      static async check(permissions, action, authInfo, contextBuilder) {
+        if (!permissions || permissions.length === 0) {
+          return true;
+        }
+        const relevant = permissions.filter((p) => p.action === action);
+        if (relevant.length === 0) {
+          return true;
+        }
+        const principal = resolvePrincipal2(authInfo, contextBuilder);
+        for (const perm of relevant) {
+          const passed = await _JobPermissionGuard.checkSingle(perm, principal, authInfo);
+          if (!passed) return false;
+        }
+        return true;
+      }
+      static async checkSingle(perm, principal, authInfo) {
+        if (perm.roles && perm.roles.length > 0) {
+          if (!perm.roles.some((role) => principal.roles.includes(role))) return false;
+        }
+        if (perm.scopes && perm.scopes.length > 0) {
+          if (!perm.scopes.some((scope) => principal.scopes.includes(scope))) return false;
+        }
+        if (perm.custom) {
+          const result = await perm.custom(authInfo ?? {});
+          if (!result) return false;
+        }
+        return true;
+      }
+    };
+  }
+});
+
 // libs/sdk/src/workflow/tools/list-workflows.tool.ts
 import { z as z83 } from "@frontmcp/lazy-zod";
 var ListWorkflowsTool;
@@ -44987,6 +45642,7 @@ var init_list_workflows_tool = __esm({
   "libs/sdk/src/workflow/tools/list-workflows.tool.ts"() {
     "use strict";
     init_common();
+    init_job_permission_guard();
     ListWorkflowsTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -44998,7 +45654,11 @@ var init_list_workflows_tool = __esm({
           tags: input.tags,
           labels: input.labels
         });
-        const mapped = workflows.map((w) => ({
+        const visible = [];
+        for (const workflow of workflows) {
+          if (await this.maySee(workflow)) visible.push(workflow);
+        }
+        const mapped = visible.map((w) => ({
           name: w.name,
           description: w.metadata.description,
           trigger: w.getTrigger(),
@@ -45010,6 +45670,12 @@ var init_list_workflows_tool = __esm({
           count: mapped.length
         };
       }
+      async maySee(workflow) {
+        const permissions = workflow.metadata.permissions;
+        const builder = this.scope.authoritiesContextBuilder;
+        if (!await JobPermissionGuard.check(permissions, "list", this.authInfo, builder)) return false;
+        return JobPermissionGuard.check(permissions, "execute", this.authInfo, builder);
+      }
     };
     ListWorkflowsTool = __decorateClass([
       FrontMcpTool({
@@ -45045,6 +45711,7 @@ var init_register_workflow_tool = __esm({
   "libs/sdk/src/workflow/tools/register-workflow.tool.ts"() {
     "use strict";
     init_common();
+    init_errors();
     RegisterWorkflowTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -45052,6 +45719,9 @@ var init_register_workflow_tool = __esm({
         if (!workflowRegistry) {
           return this.fail(new Error("Workflows system is not enabled"));
         }
+        if (!this.dynamicRegistrationEnabled()) {
+          return this.fail(new DynamicJobRegistrationDisabledError("workflow"));
+        }
         const existing = workflowRegistry.findByName(input.name);
         if (existing) {
           return this.fail(new Error(`Workflow "${input.name}" already exists`));
@@ -45073,6 +45743,10 @@ var init_register_workflow_tool = __esm({
         });
         return { success: true, workflowId };
       }
+      dynamicRegistrationEnabled() {
+        const jobs = this.scope.metadata?.jobs;
+        return jobs?.allowDynamicRegistration === true;
+      }
     };
     RegisterWorkflowTool = __decorateClass([
       FrontMcpTool({
@@ -45111,6 +45785,8 @@ var init_remove_workflow_tool = __esm({
   "libs/sdk/src/workflow/tools/remove-workflow.tool.ts"() {
     "use strict";
     init_common();
+    init_errors();
+    init_job_permission_guard();
     RemoveWorkflowTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -45120,7 +45796,16 @@ var init_remove_workflow_tool = __esm({
         }
         const workflow = workflowRegistry.findByName(input.name);
         if (!workflow) {
-          return this.fail(new Error(`Workflow "${input.name}" not found`));
+          return this.fail(new JobNotAuthorizedError(input.name));
+        }
+        const allowed = await JobPermissionGuard.check(
+          workflow.metadata.permissions,
+          "delete",
+          this.authInfo,
+          this.scope.authoritiesContextBuilder
+        );
+        if (!allowed) {
+          return this.fail(new JobNotAuthorizedError(input.name));
         }
         if (!workflow.isDynamic()) {
           return this.fail(new Error(`Workflow "${input.name}" is not dynamic and cannot be removed`));
@@ -45485,7 +46170,9 @@ var init_workflow_step_executor = __esm({
   "libs/sdk/src/workflow/engine/workflow-step.executor.ts"() {
     "use strict";
     init_errors();
+    init_job_errors();
     init_workflow_errors();
+    init_job_permission_guard();
     WorkflowStepExecutor = class {
       jobRegistry;
       logger;
@@ -45500,6 +46187,16 @@ var init_workflow_step_executor = __esm({
         if (!job) {
           throw new InvalidEntityError("job", step.jobName, `a registered job (referenced by step "${step.id}")`);
         }
+        const allowed = await JobPermissionGuard.check(
+          job.metadata.permissions,
+          "execute",
+          this.extra.authInfo,
+          this.extra.authoritiesContextBuilder
+        );
+        if (!allowed) {
+          this.logger.warn(`Step "${step.id}" denied: caller does not satisfy the execute permissions of "${job.name}"`);
+          throw new JobNotAuthorizedError(job.name);
+        }
         const retryConfig = step.retry ?? job.metadata.retry ?? {};
         const maxAttempts = retryConfig.maxAttempts ?? 3;
         const backoffMs = retryConfig.backoffMs ?? 1e3;
@@ -45729,7 +46426,10 @@ var JobExecutionManager;
 var init_job_execution_manager = __esm({
   "libs/sdk/src/job/execution/job-execution.manager.ts"() {
     "use strict";
+    init_principal_utils();
+    init_errors();
     init_workflow_engine();
+    init_job_permission_guard();
     JobExecutionManager = class {
       stateStore;
       logger;
@@ -45743,6 +46443,7 @@ var init_job_execution_manager = __esm({
        * Execute a job inline (synchronous) or in background.
        */
       async executeJob(job, input, opts = {}) {
+        await this.assertMayExecute(job.metadata.permissions, job.name, opts);
         const runId = randomUUID23();
         const retryConfig = job.metadata.retry ?? {};
         const maxAttempts = retryConfig.maxAttempts ?? 1;
@@ -45751,6 +46452,7 @@ var init_job_execution_manager = __esm({
           jobId: job.metadata.id ?? job.name,
           jobName: job.name,
           sessionId: opts.sessionId,
+          ownerSub: resolvePrincipal2(opts.authInfo, opts.authoritiesContextBuilder).sub || void 0,
           state: "pending",
           input,
           startedAt: Date.now(),
@@ -45781,6 +46483,7 @@ var init_job_execution_manager = __esm({
        * Execute a workflow inline or in background.
        */
       async executeWorkflow(workflow, jobRegistry, opts = {}) {
+        await this.assertMayExecute(workflow.metadata.permissions, workflow.name, opts);
         const runId = randomUUID23();
         const runRecord = {
           runId,
@@ -45788,6 +46491,7 @@ var init_job_execution_manager = __esm({
           jobName: workflow.name,
           workflowName: workflow.name,
           sessionId: opts.sessionId,
+          ownerSub: resolvePrincipal2(opts.authInfo, opts.authoritiesContextBuilder).sub || void 0,
           state: "pending",
           input: opts.workflowInput,
           startedAt: Date.now(),
@@ -45815,6 +46519,25 @@ var init_job_execution_manager = __esm({
         }
         return this.executeWorkflowInline(workflow, jobRegistry, runId, opts);
       }
+      /**
+       * Throw unless the caller may execute the entry.
+       *
+       * Uses the same error for "not authorized" as the tools use for "not found",
+       * so a caller cannot enumerate which restricted jobs exist by comparing
+       * responses.
+       */
+      async assertMayExecute(permissions, name42, opts) {
+        const allowed = await JobPermissionGuard.check(
+          permissions,
+          "execute",
+          opts.authInfo,
+          opts.authoritiesContextBuilder
+        );
+        if (!allowed) {
+          this.logger.warn(`Execution of "${name42}" denied: caller does not satisfy its execute permissions`);
+          throw new JobNotAuthorizedError(name42);
+        }
+      }
       /**
        * Get execution status.
        */
@@ -45887,7 +46610,8 @@ var init_job_execution_manager = __esm({
         try {
           const engine = new WorkflowEngine(workflow.metadata, jobRegistry, this.logger, {
             authInfo: opts.authInfo ?? {},
-            contextProviders: opts.contextProviders
+            contextProviders: opts.contextProviders,
+            authoritiesContextBuilder: opts.authoritiesContextBuilder
           });
           const result = await engine.execute(opts.workflowInput);
           await this.stateStore.updateRun(runId, {
@@ -46839,6 +47563,7 @@ var init_execute_job_tool = __esm({
   "libs/sdk/src/job/tools/execute-job.tool.ts"() {
     "use strict";
     init_common();
+    init_errors();
     ExecuteJobTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -46849,12 +47574,13 @@ var init_execute_job_tool = __esm({
         }
         const job = jobRegistry.findByName(input.name);
         if (!job) {
-          return this.fail(new Error(`Job "${input.name}" not found`));
+          return this.fail(new JobNotAuthorizedError(input.name));
         }
         const result = await executionManager.executeJob(job, input.input ?? {}, {
           background: input.background,
           sessionId: this.authInfo.sessionId,
-          authInfo: this.authInfo
+          authInfo: this.authInfo,
+          authoritiesContextBuilder: this.scope.authoritiesContextBuilder
         });
         return result;
       }
@@ -46886,6 +47612,7 @@ var init_get_job_status_tool = __esm({
   "libs/sdk/src/job/tools/get-job-status.tool.ts"() {
     "use strict";
     init_common();
+    init_principal_utils();
     init_errors();
     GetJobStatusTool = class extends ToolContext {
       async execute(input) {
@@ -46895,7 +47622,7 @@ var init_get_job_status_tool = __esm({
           return this.fail(new GenericServerError("Jobs system is not enabled"));
         }
         const record = await executionManager.getStatus(input.runId);
-        if (!record) {
+        if (!record || !this.ownsRun(record)) {
           return this.fail(new InvalidInputError(`Run "${input.runId}" not found`));
         }
         return {
@@ -46910,6 +47637,23 @@ var init_get_job_status_tool = __esm({
           logs: record.logs
         };
       }
+      /**
+       * Match on the owning subject, falling back to the session for runs started
+       * before an owner was recorded (and for anonymous/public servers, where every
+       * caller has an empty subject and the session is the only identity there is).
+       *
+       * A record carrying NEITHER identity is refused. Such a run cannot be
+       * attributed to anyone, and its inputs and results are exactly what this check
+       * exists to protect — anyone holding the id would otherwise be able to read
+       * it. Internal callers that must read unattributed runs should go through the
+       * execution manager directly rather than this tool.
+       */
+      ownsRun(record) {
+        const callerSub = resolvePrincipal2(this.authInfo, this.scope.authoritiesContextBuilder).sub;
+        if (record.ownerSub) return record.ownerSub === callerSub;
+        if (record.sessionId) return record.sessionId === this.authInfo.sessionId;
+        return false;
+      }
     };
     GetJobStatusTool = __decorateClass([
       FrontMcpTool({
@@ -46944,6 +47688,7 @@ var init_list_jobs_tool = __esm({
   "libs/sdk/src/job/tools/list-jobs.tool.ts"() {
     "use strict";
     init_common();
+    init_job_permission_guard();
     ListJobsTool = class extends ToolContext {
       async execute(input) {
         const jobRegistry = this.scope.jobs;
@@ -46954,7 +47699,11 @@ var init_list_jobs_tool = __esm({
           tags: input.tags,
           labels: input.labels
         });
-        const mapped = jobs.map((j) => ({
+        const visible = [];
+        for (const job of jobs) {
+          if (await this.maySee(job)) visible.push(job);
+        }
+        const mapped = visible.map((j) => ({
           name: j.name,
           description: j.metadata.description,
           tags: j.getTags(),
@@ -46966,6 +47715,17 @@ var init_list_jobs_tool = __esm({
           count: mapped.length
         };
       }
+      /**
+       * A job is listable when the caller passes its `list` rules and is not
+       * blocked from executing it. Checking `execute` too keeps the listing honest:
+       * showing a job the caller can never run is the disclosure this closes.
+       */
+      async maySee(job) {
+        const permissions = job.metadata.permissions;
+        const builder = this.scope.authoritiesContextBuilder;
+        if (!await JobPermissionGuard.check(permissions, "list", this.authInfo, builder)) return false;
+        return JobPermissionGuard.check(permissions, "execute", this.authInfo, builder);
+      }
     };
     ListJobsTool = __decorateClass([
       FrontMcpTool({
@@ -47001,6 +47761,7 @@ var init_register_job_tool = __esm({
   "libs/sdk/src/job/tools/register-job.tool.ts"() {
     "use strict";
     init_common();
+    init_errors();
     RegisterJobTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -47008,6 +47769,9 @@ var init_register_job_tool = __esm({
         if (!jobRegistry) {
           return this.fail(new Error("Jobs system is not enabled"));
         }
+        if (!this.dynamicRegistrationEnabled()) {
+          return this.fail(new DynamicJobRegistrationDisabledError("job"));
+        }
         const existing = jobRegistry.findByName(input.name);
         if (existing) {
           return this.fail(new Error(`Job "${input.name}" already exists`));
@@ -47030,6 +47794,10 @@ var init_register_job_tool = __esm({
         });
         return { success: true, jobId };
       }
+      dynamicRegistrationEnabled() {
+        const jobs = this.scope.metadata?.jobs;
+        return jobs?.allowDynamicRegistration === true;
+      }
     };
     RegisterJobTool = __decorateClass([
       FrontMcpTool({
@@ -47060,6 +47828,8 @@ var init_remove_job_tool = __esm({
   "libs/sdk/src/job/tools/remove-job.tool.ts"() {
     "use strict";
     init_common();
+    init_errors();
+    init_job_permission_guard();
     RemoveJobTool = class extends ToolContext {
       async execute(input) {
         const scope = this.scope;
@@ -47069,7 +47839,16 @@ var init_remove_job_tool = __esm({
         }
         const job = jobRegistry.findByName(input.name);
         if (!job) {
-          return this.fail(new Error(`Job "${input.name}" not found`));
+          return this.fail(new JobNotAuthorizedError(input.name));
+        }
+        const allowed = await JobPermissionGuard.check(
+          job.metadata.permissions,
+          "delete",
+          this.authInfo,
+          this.scope.authoritiesContextBuilder
+        );
+        if (!allowed) {
+          return this.fail(new JobNotAuthorizedError(input.name));
         }
         if (!job.isDynamic()) {
           return this.fail(new Error(`Job "${input.name}" is not a dynamic job and cannot be removed`));
@@ -47130,14 +47909,18 @@ async function registerJobCapabilities(args) {
     ListJobsTool,
     ExecuteJobTool,
     GetJobStatusTool,
-    RegisterJobTool,
     RemoveJobTool,
     ListWorkflowsTool,
     ExecuteWorkflowTool,
     GetWorkflowStatusTool,
-    RegisterWorkflowTool,
     RemoveWorkflowTool
   ];
+  if (jobsConfig.allowDynamicRegistration === true) {
+    managementTools.push(RegisterJobTool, RegisterWorkflowTool);
+    logger.warn(
+      "Dynamic job registration is ENABLED: register_job/register_workflow accept a raw script and register it as an executable job."
+    );
+  }
   logger.info(
     `Jobs initialized: ${jobRegistry.getJobs().length} jobs, ${workflowRegistry.getWorkflows().length} workflows`
   );
@@ -48742,7 +49525,7 @@ var init_load_skill_flow = __esm({
 });
 
 // libs/sdk/src/skill/auth/skill-http-auth.ts
-import { timingSafeEqual as timingSafeEqual2 } from "@frontmcp/utils";
+import { timingSafeEqual as timingSafeEqual3 } from "@frontmcp/utils";
 function createSkillHttpAuthValidator(skillsConfig, logger) {
   if (!skillsConfig?.auth || skillsConfig.auth === "public" || skillsConfig.auth === "inherit") {
     return null;
@@ -48829,7 +49612,7 @@ var init_skill_http_auth = __esm({
           const keyBytes = encoder5.encode(key);
           if (keyBytes.length === candidateBytes.length) {
             try {
-              if (timingSafeEqual2(keyBytes, candidateBytes)) {
+              if (timingSafeEqual3(keyBytes, candidateBytes)) {
                 found = true;
               }
             } catch {
@@ -51795,104 +52578,6 @@ var init_decide_request_intent_utils = __esm({
   }
 });
 
-// libs/sdk/src/common/utils/path.utils.ts
-import { joinPath, trimSlashes } from "@frontmcp/utils";
-import { trimSlashes as trimSlashes2, joinPath as joinPath2 } from "@frontmcp/utils";
-function normalizeEntryPrefix(entryPath) {
-  const t = trimSlashes(entryPath ?? "");
-  return t ? `/${t}` : "";
-}
-function normalizeScopeBase(scopeBase) {
-  const t = trimSlashes(scopeBase ?? "");
-  return t ? `/${t}` : "";
-}
-function readPublicUrlPin() {
-  try {
-    if (typeof process !== "undefined" && process.env) {
-      const v = process.env["FRONTMCP_PUBLIC_URL"];
-      if (typeof v === "string" && v.trim()) {
-        return v.trim().replace(/\/+$/, "");
-      }
-    }
-  } catch {
-  }
-  return void 0;
-}
-function isPublicUrlPinned() {
-  return readPublicUrlPin() !== void 0;
-}
-function isProxyTrusted() {
-  try {
-    if (typeof process !== "undefined" && process.env) {
-      const v = process.env["FRONTMCP_TRUST_PROXY"];
-      return typeof v === "string" && /^(1|true|yes|on)$/i.test(v.trim());
-    }
-  } catch {
-  }
-  return false;
-}
-function getRequestBaseUrl(req, entryPath) {
-  const pin = readPublicUrlPin();
-  if (pin) {
-    return `${pin}${entryPath ?? ""}`;
-  }
-  const trustProxy = isProxyTrusted();
-  const fwdProto = trustProxy ? req.headers["x-forwarded-proto"] : void 0;
-  const fwdHost = trustProxy ? req.headers["x-forwarded-host"] : void 0;
-  const proto = fwdProto || req.protocol || "http";
-  const host = fwdHost || req.headers["host"];
-  return `${proto}://${host}${entryPath ?? ""}`;
-}
-function computeIssuer(req, entryPath, scopeBase) {
-  const entryPrefix = normalizeEntryPrefix(entryPath);
-  const scope = normalizeScopeBase(scopeBase);
-  return `${getRequestBaseUrl(req)}${entryPrefix}${scope}`;
-}
-function computeResource(req, entryPath, scopeBase) {
-  const entryPrefix = normalizeEntryPrefix(entryPath);
-  const scope = normalizeScopeBase(scopeBase);
-  return `${getRequestBaseUrl(req)}${entryPrefix}${scope}`;
-}
-function normalizeResourceUri(uri) {
-  try {
-    const url = new URL(uri);
-    let normalized = `${url.protocol}//${url.hostname}`;
-    const isDefaultPort = url.protocol === "https:" && url.port === "443" || url.protocol === "http:" && url.port === "80";
-    if (url.port && !isDefaultPort) {
-      normalized += `:${url.port}`;
-    }
-    let path3 = url.pathname;
-    if (path3.length > 1 && path3.endsWith("/")) {
-      path3 = path3.slice(0, -1);
-    }
-    normalized += path3;
-    return normalized;
-  } catch {
-    return uri;
-  }
-}
-function resourceUriMatches(provided, canonical) {
-  return normalizeResourceUri(provided) === normalizeResourceUri(canonical);
-}
-function urlToSafeId(url) {
-  const u = new URL(url);
-  const raw = (u.host + (u.pathname && u.pathname !== "/" ? u.pathname : "")).replace(/\/+$/, "");
-  return trimSlashes(raw).replace(/[^a-zA-Z0-9_-]/g, "-");
-}
-function makeWellKnownPaths(name42, entryPrefix, scopeBase = "") {
-  const prefix = normalizeEntryPrefix(entryPrefix);
-  const scope = normalizeScopeBase(scopeBase);
-  const reversed = joinPath(".well-known", name42) + `${prefix}${scope}`;
-  const inPrefixRoot = `${prefix}${joinPath(".well-known", name42)}${scope}`;
-  const inPrefixScope = `${prefix}${scope}${joinPath(".well-known", name42)}`;
-  return /* @__PURE__ */ new Set([reversed, inPrefixRoot, inPrefixScope]);
-}
-var init_path_utils = __esm({
-  "libs/sdk/src/common/utils/path.utils.ts"() {
-    "use strict";
-  }
-});
-
 // libs/sdk/src/common/utils/global-config.utils.ts
 function getGlobalStoreConfig(pluginName, config) {
   if (!config.redis) {
@@ -51968,6 +52653,7 @@ var init_utils2 = __esm({
     init_caller_dir_utils();
     init_decide_request_intent_utils();
     init_path_utils();
+    init_principal_utils();
     init_global_config_utils();
     init_primitive_filter();
     init_validate_remote_url();
@@ -52226,7 +52912,7 @@ async function tryResolvedSubFile(instance, kind, tail) {
       return parseSkillMdFrontmatter(inline).body;
     }
     const absolutePath = entry.path;
-    const resolvedPath = resolveEntryPath(instance, kind, absolutePath, filename);
+    const resolvedPath = resolveEntryPath2(instance, kind, absolutePath, filename);
     if (!resolvedPath) continue;
     try {
       const buf = await readFileBuffer(resolvedPath);
@@ -52241,7 +52927,7 @@ async function tryResolvedSubFile(instance, kind, tail) {
   }
   return void 0;
 }
-function resolveEntryPath(instance, kind, absolutePath, filename) {
+function resolveEntryPath2(instance, kind, absolutePath, filename) {
   if (absolutePath && isAbsolute3(absolutePath)) return absolutePath;
   if (!filename) return void 0;
   const baseDir = instance.getBaseDir();
@@ -52913,9 +53599,24 @@ var init_redis_event_store = __esm({
         await client.expire(streamKey, this.ttlSeconds);
         return `${streamId}:${redisId}`;
       }
+      /**
+       * Resolve the stream an event belongs to.
+       *
+       * Optional in the upstream `EventStore` contract, and the transport's
+       * 409-conflict guard (refusing a second live stream for the same id) is dead
+       * code while no store provides it (GHSA-84j6-jc92-77jm).
+       */
+      async getStreamIdForEventId(eventId) {
+        const parsed = this.parseEventId(eventId);
+        return parsed ? parsed[0] : void 0;
+      }
       async replayEventsAfter(lastEventId, { send }) {
+        const parsed = this.parseEventId(lastEventId);
+        if (!parsed) {
+          return "default-stream";
+        }
         const client = await this.getClient();
-        const [streamId, redisId] = this.parseEventId(lastEventId);
+        const [streamId, redisId] = parsed;
         const streamKey = `${this.keyPrefix}${streamId}`;
         const entries = await client.xrange(streamKey, `(${redisId}`, "+");
         for (const [id, fields] of entries) {
@@ -52934,16 +53635,32 @@ var init_redis_event_store = __esm({
        * Event IDs have format: `{streamId}:{redisStreamEntryId}`
        * Redis stream entry IDs have format: `{timestamp}-{sequence}`
        *
+       * The entry-id half is validated because it is interpolated into the `xrange`
+       * range argument (`(${redisId}`), where a malformed value is a protocol error
+       * rather than data.
+       *
+       * The stream-id half is NOT character-filtered. `xadd`/`xrange` take the key
+       * as an exact argument — Redis applies no glob matching there — and ioredis
+       * length-prefixes it, so no character is special. Filtering here would also
+       * make `storeEvent`, which accepts any `StreamId`, able to mint ids this
+       * function then refuses, silently breaking replay for that stream. Ownership
+       * is enforced by the session-scoped facade (GHSA-84j6-jc92-77jm), not by
+       * guessing at the id's characters.
+       *
+       * @returns the pair, or `undefined` when the id is malformed.
+       *
        * @example
        * 'my-stream:1234567890123-0' -> ['my-stream', '1234567890123-0']
        */
       parseEventId(eventId) {
-        const lastColonBeforeDash = eventId.lastIndexOf(":", eventId.lastIndexOf("-"));
-        if (lastColonBeforeDash === -1) {
-          const lastColon = eventId.lastIndexOf(":");
-          return [eventId.slice(0, lastColon), eventId.slice(lastColon + 1)];
-        }
-        return [eventId.slice(0, lastColonBeforeDash), eventId.slice(lastColonBeforeDash + 1)];
+        const value = String(eventId);
+        const lastDash = value.lastIndexOf("-");
+        const separator = lastDash === -1 ? value.lastIndexOf(":") : value.lastIndexOf(":", lastDash);
+        if (separator <= 0 || separator === value.length - 1) return void 0;
+        const streamId = value.slice(0, separator);
+        const redisId = value.slice(separator + 1);
+        if (!/^\d+(-\d+)?$/.test(redisId)) return void 0;
+        return [streamId, redisId];
       }
       /**
        * Close the Redis client connection.
@@ -52989,6 +53706,16 @@ var init_memory_event_store = __esm({
         }
         return id;
       }
+      /**
+       * Resolve the stream an event belongs to.
+       *
+       * Optional in the upstream `EventStore` contract, and the transport's
+       * 409-conflict guard (refusing a second live stream for the same id) is dead
+       * code while no store provides it (GHSA-84j6-jc92-77jm).
+       */
+      async getStreamIdForEventId(eventId) {
+        return this.index.get(eventId)?.streamId;
+      }
       async replayEventsAfter(lastEventId, { send }) {
         const meta = this.index.get(lastEventId);
         if (!meta) {
@@ -53140,6 +53867,50 @@ var init_event_store_factory = __esm({
   }
 });
 
+// libs/sdk/src/transport/event-stores/session-scoped.event-store.ts
+function createSessionScopedEventStore(store, sessionId) {
+  const prefix = `${sessionId}${SCOPE_SEPARATOR}`;
+  const scope = (streamId) => `${prefix}${streamId}`;
+  const unscope = (streamId) => {
+    const value = String(streamId);
+    return value.startsWith(prefix) ? value.slice(prefix.length) : value;
+  };
+  const resolveOwnedStream = async (eventId) => {
+    const lookup = store.getStreamIdForEventId;
+    if (lookup) {
+      const resolved = await lookup.call(store, eventId);
+      return resolved !== void 0 && String(resolved).startsWith(prefix) ? resolved : void 0;
+    }
+    if (!String(eventId).startsWith(prefix)) return void 0;
+    const value = String(eventId);
+    const lastColon = value.lastIndexOf(":");
+    return lastColon === -1 ? void 0 : value.slice(0, lastColon);
+  };
+  return {
+    async storeEvent(streamId, message) {
+      return store.storeEvent(scope(streamId), message);
+    },
+    async getStreamIdForEventId(eventId) {
+      const owned = await resolveOwnedStream(eventId);
+      return owned === void 0 ? void 0 : unscope(owned);
+    },
+    async replayEventsAfter(lastEventId, options) {
+      const owned = await resolveOwnedStream(lastEventId);
+      if (owned === void 0) {
+        return "default-stream";
+      }
+      return unscope(await store.replayEventsAfter(lastEventId, options));
+    }
+  };
+}
+var SCOPE_SEPARATOR;
+var init_session_scoped_event_store = __esm({
+  "libs/sdk/src/transport/event-stores/session-scoped.event-store.ts"() {
+    "use strict";
+    SCOPE_SEPARATOR = " ";
+  }
+});
+
 // libs/sdk/src/transport/event-stores/index.ts
 var init_event_stores = __esm({
   "libs/sdk/src/transport/event-stores/index.ts"() {
@@ -54809,6 +55580,61 @@ var init_transport_error = __esm({
   }
 });
 
+// libs/sdk/src/server/security/host-validation.ts
+function normalizeHost(value) {
+  const host = value.trim().toLowerCase();
+  if (host.length === 0) return host;
+  const portSeparator = host.startsWith("[") ? host.indexOf(":", host.indexOf("]")) : host.lastIndexOf(":");
+  if (portSeparator === -1) return host;
+  const name42 = host.slice(0, portSeparator);
+  const port = host.slice(portSeparator + 1);
+  if (port.length === 0 || !/^\d+$/.test(port)) return host;
+  return DEFAULT_PORTS.has(port) ? name42 : `${name42}:${port}`;
+}
+function normalizeOrigin(value) {
+  const origin = value.trim().toLowerCase();
+  try {
+    return new URL(origin).origin.toLowerCase();
+  } catch {
+    return origin;
+  }
+}
+function compileHostValidation(rules) {
+  return {
+    hosts: rules.allowedHosts ? new Set(rules.allowedHosts.map(normalizeHost)) : void 0,
+    origins: rules.allowedOrigins ? new Set(rules.allowedOrigins.map(normalizeOrigin)) : void 0
+  };
+}
+function validateHostHeaders(headers, compiled) {
+  if (compiled.hosts) {
+    const host = headers.host;
+    if (!host || !compiled.hosts.has(normalizeHost(host))) {
+      return { status: 403, error: "Forbidden", message: "Invalid Host header" };
+    }
+    const forwardedHost = headers.forwardedHost;
+    if (forwardedHost) {
+      const candidates = forwardedHost.split(",").map((h2) => h2.trim()).filter(Boolean);
+      if (candidates.some((h2) => !compiled.hosts?.has(normalizeHost(h2)))) {
+        return { status: 403, error: "Forbidden", message: "Invalid X-Forwarded-Host header" };
+      }
+    }
+  }
+  if (compiled.origins) {
+    const origin = headers.origin;
+    if (origin && !compiled.origins.has(normalizeOrigin(origin))) {
+      return { status: 403, error: "Forbidden", message: "Invalid Origin header" };
+    }
+  }
+  return void 0;
+}
+var DEFAULT_PORTS;
+var init_host_validation = __esm({
+  "libs/sdk/src/server/security/host-validation.ts"() {
+    "use strict";
+    DEFAULT_PORTS = /* @__PURE__ */ new Set(["80", "443"]);
+  }
+});
+
 // libs/sdk/src/transport/adapters/base-sse-transport.ts
 import contentType from "content-type";
 import getRawBody from "raw-body";
@@ -54821,6 +55647,7 @@ var init_base_sse_transport = __esm({
   "libs/sdk/src/transport/adapters/base-sse-transport.ts"() {
     "use strict";
     init_transport_errors();
+    init_host_validation();
     MAXIMUM_MESSAGE_SIZE = "4mb";
     SSEServerTransport = class {
       /**
@@ -54844,25 +55671,31 @@ var init_base_sse_transport = __esm({
       onmessage;
       /**
        * Validates request headers for DNS rebinding protection.
+       *
+       * Since v1.7.2 the primary defence is the adapter-level Host validation, which
+       * runs before routing and therefore already covers `/sse` and `/message`
+       * (GHSA-mc9g-v2cp-vfff). These per-transport options remain for a host that
+       * constructs the transport directly; they delegate to the same rules so the
+       * two can never disagree about what a valid Host looks like.
+       *
        * @returns Error message if validation fails, undefined if validation passes.
        */
       validateRequestHeaders(req) {
         if (!this._options.enableDnsRebindingProtection) {
           return void 0;
         }
-        if (this._options.allowedHosts && this._options.allowedHosts.length > 0) {
-          const hostHeader = req.headers.host;
-          if (!hostHeader || !this._options.allowedHosts.includes(hostHeader)) {
-            return `Invalid Host header: ${hostHeader}`;
-          }
-        }
-        if (this._options.allowedOrigins && this._options.allowedOrigins.length > 0) {
-          const originHeader = req.headers.origin;
-          if (!originHeader || !this._options.allowedOrigins.includes(originHeader)) {
-            return `Invalid Origin header: ${originHeader}`;
-          }
-        }
-        return void 0;
+        const rejection = validateHostHeaders(
+          {
+            host: req.headers.host,
+            forwardedHost: req.headers["x-forwarded-host"],
+            origin: req.headers.origin
+          },
+          compileHostValidation({
+            allowedHosts: this._options.allowedHosts?.length ? this._options.allowedHosts : void 0,
+            allowedOrigins: this._options.allowedOrigins?.length ? this._options.allowedOrigins : void 0
+          })
+        );
+        return rejection?.message;
       }
       /**
        * Handles the initial SSE connection request.
@@ -55364,7 +56197,7 @@ var init_transport_local_adapter = __esm({
         }
       }
       ensureAuthInfo(req, transport) {
-        const { token, user, session } = req[ServerRequestTokens.auth];
+        const { token, user, session, scopes, claims } = req[ServerRequestTokens.auth];
         if (!session?.id) {
           throw new UnauthorizedError(
             "Session could not be reconstructed for the provided token. Re-authenticate to start a new session.",
@@ -55393,7 +56226,16 @@ var init_transport_local_adapter = __esm({
           user,
           sessionId,
           sessionIdPayload: sessionPayload,
-          scopes: [],
+          // Carry the scopes and claims the verified Authorization actually holds.
+          // These used to be dropped (`scopes: []`, no claims), which left every
+          // scope- or claim-based check downstream inert.
+          //
+          // Both are COPIED, not aliased. Tool code receives this object, and a
+          // nested mutation (`authInfo.claims.roles.push('admin')`) on a shared
+          // reference would rewrite the request's own verified authorization — which
+          // the job/workflow permission guard then reads.
+          scopes: Array.isArray(scopes) ? [...scopes] : [],
+          ...claims ? { claims: structuredClone(claims) } : {},
           clientId: user.sub ?? "",
           transport
         };
@@ -55874,6 +56716,7 @@ var init_transport_streamable_http_adapter = __esm({
   "libs/sdk/src/transport/adapters/transport.streamable-http.adapter.ts"() {
     "use strict";
     init_errors();
+    init_session_scoped_event_store();
     init_transport_error();
     init_streamable_http_transport();
     init_transport_local_adapter();
@@ -55883,7 +56726,8 @@ var init_transport_streamable_http_adapter = __esm({
     TransportStreamableHttpAdapter = class extends LocalTransportAdapter {
       createTransport(sessionId, response) {
         const sessionIdGenerator = resolveSessionIdGenerator(this.key.type, sessionId);
-        const eventStore = this.scope.eventStore;
+        const sharedEventStore = this.scope.eventStore;
+        const eventStore = sharedEventStore ? createSessionScopedEventStore(sharedEventStore, sessionId) : void 0;
         const isStateless = this.key.type === "stateless-http";
         return new RecreateableStreamableHTTPServerTransport({
           sessionIdGenerator,
@@ -56224,7 +57068,7 @@ var init_transport_remote = __esm({
 });
 
 // libs/sdk/src/transport/transport.registry.ts
-import { getMachineId as getMachineId5, sha256Hex as sha256Hex10 } from "@frontmcp/utils";
+import { getMachineId as getMachineId5, sha256Hex as sha256Hex11 } from "@frontmcp/utils";
 var TransportService;
 var init_transport_registry = __esm({
   "libs/sdk/src/transport/transport.registry.ts"() {
@@ -56760,7 +57604,7 @@ var init_transport_registry = __esm({
       }
       /* --------------------------------- internals -------------------------------- */
       sha256(value) {
-        return sha256Hex10(value);
+        return sha256Hex11(value);
       }
       /**
        * Create a history key from components.
@@ -57053,13 +57897,28 @@ var init_http_request_flow = __esm({
       }
       async acquireQuota() {
         const manager = this.scope.rateLimitManager;
-        if (!manager?.config?.global) return;
+        if (!manager) return;
         const context = this.tryGetContext();
         const partitionCtx = context ? {
           sessionId: context.sessionId,
           clientIp: context.metadata?.clientIp,
           userId: context.authInfo?.clientId
         } : void 0;
+        const ipResult = manager.checkIpFilter(partitionCtx?.clientIp);
+        if (ipResult && !ipResult.allowed) {
+          this.logger.warn(`[${this.requestId}] request rejected by ipFilter`, { reason: ipResult.reason });
+          this.respond(
+            httpRespond.json(
+              {
+                jsonrpc: "2.0",
+                error: { code: -32001, message: "Forbidden: client IP rejected by ipFilter" }
+              },
+              { status: 403 }
+            )
+          );
+          return;
+        }
+        if (!manager.config?.global) return;
         const result = await manager.checkGlobalRateLimit(partitionCtx);
         if (!result.allowed) {
           const retryAfter = Math.ceil((result.retryAfterMs ?? 6e4) / 1e3);
@@ -57680,6 +58539,7 @@ var init_scope_instance = __esm({
     init_channel_scope_helper();
     init_common();
     init_sqlite();
+    init_path_utils();
     init_complete_flow();
     init_context();
     init_elicitation2();
@@ -57780,7 +58640,7 @@ var init_scope_instance = __esm({
         this.logger = globalProviders.get(FrontMcpLogger).child("FrontMcp.MultiAppScope");
         this.globalProviders = globalProviders;
         this.server = this.globalProviders.get(FrontMcpServer);
-        this.entryPath = rec.metadata.http?.entryPath ?? "";
+        this.entryPath = resolveEntryPath(rec.metadata.http?.entryPath);
         if (rec.kind === "SPLIT_BY_APP") {
           this.routeBase = `/${rec.metadata.id}`;
         } else {
@@ -57884,16 +58744,25 @@ var init_scope_instance = __esm({
         })() : void 0;
         const tasksConfig = this.metadata.tasks;
         const tasksExplicitlyDisabled = tasksConfig?.enabled === false;
+        const tasksExplicitlyEnabled = tasksConfig?.enabled === true;
         const isTaskWorker = !!this.metadata["__taskWorkerMode"];
         const hasPersistentBackend = Boolean(
           tasksConfig?.sqlite || tasksConfig?.redis || this.metadata.redis || this.metadata.sqlite
         );
         const tasksEnabledForCli = this.cliMode && hasPersistentBackend;
-        const shouldInitTasks = !tasksExplicitlyDisabled && (!this.cliMode || tasksEnabledForCli || isTaskWorker);
+        const hasDistributedTaskBackend = Boolean(tasksConfig?.redis ?? this.metadata.redis);
+        const onEdgeRuntime = isEdgeRuntime();
+        const tasksUnavailableOnEdge = onEdgeRuntime && !hasDistributedTaskBackend && !tasksExplicitlyEnabled;
+        if (tasksUnavailableOnEdge) {
+          this.logger.info(
+            "[tasks] Background tasks are unavailable on this edge/serverless runtime: the in-process runner cannot continue past the HTTP response, and an in-memory store is not shared between isolates. Serving without tasks. Configure `tasks.redis` (Upstash Redis over HTTP works on Workers) to enable them."
+          );
+        }
+        const shouldInitTasks = !tasksExplicitlyDisabled && !tasksUnavailableOnEdge && (!this.cliMode || tasksEnabledForCli || isTaskWorker);
         const tasksPromise = shouldInitTasks ? (async () => {
           const tasksRedis = tasksConfig?.redis ?? this.metadata.redis;
           const tasksSqlite = tasksConfig?.sqlite ?? (tasksRedis ? void 0 : resolvedTopLevelSqlite);
-          const onEdge = isEdgeRuntime();
+          const onEdge = onEdgeRuntime;
           if (onEdge) {
             const msg = "[tasks] Background tasks are enabled on an edge/serverless runtime. The in-process runner cannot continue past the HTTP response on this platform \u2014 task bodies will not execute. Run on a long-lived Node process, or set `tasks.enabled: false`.";
             if (tasksConfig?.strict) {
@@ -59775,7 +60644,13 @@ function normalizeAppScope(appItem, metadata) {
       ...metadata,
       id: scopeId,
       apps: [appItem],
-      auth: appMetadata.auth,
+      // An app that declares no `auth` INHERITS the server's policy. Writing
+      // `appMetadata.auth` unconditionally set the key to `undefined`, which
+      // overrode the spread above and dropped the server's auth entirely — so a
+      // standalone app silently became public (GHSA-rgxj-434m-vxh3, where the
+      // dashboard's own scope was the case in point). Declaring
+      // `auth: { mode: 'public' }` explicitly is still honoured.
+      auth: appMetadata.auth ?? metadata.auth,
       // For a splitByApp scope, auth (and any auth.ui paths) come from `@App`, so
       // anchor on the App's captured source dir. Fall back to the server's.
       // `__sourceDir` lives on LocalAppMetadata only; read it defensively.
@@ -60033,10 +60908,15 @@ function createWebFetchHandler(scope, options = {}) {
     while (end > 1 && withSlash.charCodeAt(end - 1) === 47) end--;
     return withSlash.slice(0, end);
   };
-  const rawEntry = options.entryPath ?? (normalizeEntryPrefix(httpConfig?.entryPath) || "/");
+  const rawEntry = options.entryPath ?? (normalizeEntryPrefix(resolveEntryPath(httpConfig?.entryPath)) || "/");
   const entryPaths = new Set((Array.isArray(rawEntry) ? rawEntry : [rawEntry]).map(normalizePath));
   const cors2 = options.cors ?? mapHttpCors(httpConfig?.cors, scope);
   const corsEnabled = cors2?.origin !== void 0 && cors2.origin !== false;
+  const rebinding = httpConfig?.security?.dnsRebindingProtection;
+  const hostValidation = rebinding?.enabled === false || !rebinding?.allowedHosts?.length && !rebinding?.allowedOrigins?.length ? void 0 : compileHostValidation({
+    allowedHosts: rebinding.allowedHosts,
+    allowedOrigins: rebinding.allowedOrigins
+  });
   const corsHeadersFor = (request) => {
     if (!corsEnabled) return {};
     const reqOrigin = request.headers.get("origin") ?? "";
@@ -60067,6 +60947,19 @@ function createWebFetchHandler(scope, options = {}) {
   };
   return async function handle(request, ctx, env) {
     const url = new URL(request.url);
+    if (hostValidation) {
+      const rejection = validateHostHeaders(
+        {
+          host: request.headers.get("host") ?? url.host,
+          forwardedHost: request.headers.get("x-forwarded-host") ?? void 0,
+          origin: request.headers.get("origin") ?? void 0
+        },
+        hostValidation
+      );
+      if (rejection) {
+        return Response.json({ error: rejection.error, message: rejection.message }, { status: rejection.status });
+      }
+    }
     if (corsEnabled && request.method === "OPTIONS") {
       return new Response(null, { status: 204, headers: corsHeadersFor(request) });
     }
@@ -60080,7 +60973,7 @@ function createWebFetchHandler(scope, options = {}) {
       );
     }
     if (!entryPaths.has(normalizePath(url.pathname))) {
-      const authResponse = await runMatchingHttpFlowWeb(scope, request);
+      const authResponse = await runMatchingHttpFlowWeb(scope, request, { ctx, env });
       if (authResponse) return withCors(authResponse, request);
       return withCors(Response.json({ error: "Not Found", entryPaths: [...entryPaths] }, { status: 404 }), request);
     }
@@ -60088,13 +60981,13 @@ function createWebFetchHandler(scope, options = {}) {
       const routed = await options.sessionRouter(request, env, ctx);
       if (routed) return withCors(routed, request);
     }
-    const rendered = await runHttpRequestFlowWeb(scope, request, { ctx });
+    const rendered = await runHttpRequestFlowWeb(scope, request, { ctx, env });
     return withCors(rendered ?? Response.json({ error: "Not Found" }, { status: 404 }), request);
   };
 }
 async function runHttpRequestFlowWeb(scope, request, opts = {}) {
   const url = new URL(request.url);
-  const serverRequest = await toServerRequest(request, url, opts.ctx, opts.persistent);
+  const serverRequest = await toServerRequest(request, url, opts.ctx, opts.persistent, opts.env);
   let output;
   try {
     output = await scope.runFlow("http:request", {
@@ -60106,9 +60999,9 @@ async function runHttpRequestFlowWeb(scope, request, opts = {}) {
   }
   return output ? renderHttpOutputToWebResponse(output) : void 0;
 }
-async function runMatchingHttpFlowWeb(scope, request) {
+async function runMatchingHttpFlowWeb(scope, request, opts = {}) {
   const url = new URL(request.url);
-  const serverRequest = await toServerRequest(request, url);
+  const serverRequest = await toServerRequest(request, url, opts.ctx, void 0, opts.env);
   const flowName = await scope.findHttpFlowName(serverRequest);
   if (!flowName) return void 0;
   let output;
@@ -60122,7 +61015,7 @@ async function runMatchingHttpFlowWeb(scope, request) {
   }
   return output ? renderHttpOutputToWebResponse(output) : void 0;
 }
-async function toServerRequest(request, url, ctx, persistent) {
+async function toServerRequest(request, url, ctx, persistent, env) {
   const headers = {};
   request.headers.forEach((v, k) => {
     headers[k] = v;
@@ -60166,10 +61059,39 @@ async function toServerRequest(request, url, ctx, persistent) {
   const tokenized = serverRequest;
   tokenized[ServerRequestTokens.webRequest] = webRequest;
   tokenized[ServerRequestTokens.webCtx] = ctx;
+  tokenized[ServerRequestTokens.webEnv] = env;
   if (persistent) tokenized[ServerRequestTokens.webTransport] = persistent;
   return serverRequest;
 }
+function misconfigurationResponse(error) {
+  const misconfiguration = findMisconfiguration(error);
+  if (!misconfiguration) return void 0;
+  return Response.json(
+    { error: "server_misconfigured", code: misconfiguration.code, message: misconfiguration.remedy },
+    { status: 500 }
+  );
+}
+function findMisconfiguration(error) {
+  let current = error;
+  for (let depth = 0; current instanceof Error && depth < 5; depth++) {
+    const code = current.code;
+    if (typeof code === "string" && MISCONFIGURATION_REMEDIES[code]) {
+      return { code, remedy: MISCONFIGURATION_REMEDIES[code] };
+    }
+    current = current.cause;
+  }
+  return void 0;
+}
 function flowErrorToHttpOutput(error) {
+  const misconfiguration = findMisconfiguration(error);
+  if (misconfiguration) {
+    return {
+      kind: "json",
+      status: 500,
+      contentType: "application/json; charset=utf-8",
+      body: { error: "server_misconfigured", code: misconfiguration.code, message: misconfiguration.remedy }
+    };
+  }
   if (error instanceof FlowControl) {
     switch (error.type) {
       case "respond":
@@ -60193,6 +61115,7 @@ function flowErrorToHttpOutput(error) {
   }
   return { kind: "text", status: 500, body: "Internal Server Error", contentType: "text/plain; charset=utf-8" };
 }
+var MISCONFIGURATION_REMEDIES;
 var init_web_fetch_handler = __esm({
   "libs/sdk/src/transport/web-fetch-handler.ts"() {
     "use strict";
@@ -60200,7 +61123,13 @@ var init_web_fetch_handler = __esm({
     init_server_tokens();
     init_path_utils();
     init_errors();
+    init_host_validation();
     init_web_response_renderer();
+    MISCONFIGURATION_REMEDIES = {
+      SESSION_SECRET_REQUIRED: "Set MCP_SESSION_SECRET in the deployment environment (e.g. `wrangler secret put MCP_SESSION_SECRET`). Session IDs are encrypted with it, and production refuses the development machine-id fallback.",
+      JWT_SECRET_INVALID: "JWT_SECRET is present but too weak: HS256 requires at least 32 bytes (RFC 7518). Replace it with `openssl rand -hex 32`.",
+      JWT_SECRET_REQUIRED: "Set JWT_SECRET in the deployment environment (e.g. `wrangler secret put JWT_SECRET`). Tokens are signed with it; production refuses the random per-process fallback because tokens would not survive a restart or verify across instances."
+    };
   }
 });
 
@@ -60352,39 +61281,22 @@ function createHostValidationMiddleware(options) {
   if (!options.enabled) {
     return (_req, _res, next) => next();
   }
-  const allowedHostsSet = options.allowedHosts ? new Set(options.allowedHosts) : void 0;
-  const allowedOriginsSet = options.allowedOrigins ? new Set(options.allowedOrigins) : void 0;
+  const compiled = compileHostValidation({
+    allowedHosts: options.allowedHosts,
+    allowedOrigins: options.allowedOrigins
+  });
   return (req, res, next) => {
-    if (allowedHostsSet) {
-      const host = req.headers?.["host"];
-      if (!host || !allowedHostsSet.has(host)) {
-        res.status(403).json({
-          error: "Forbidden",
-          message: "Invalid Host header"
-        });
-        return;
-      }
-      const forwardedHost = req.headers?.["x-forwarded-host"];
-      if (forwardedHost) {
-        const candidates = forwardedHost.split(",").map((h2) => h2.trim()).filter(Boolean);
-        if (candidates.some((h2) => !allowedHostsSet.has(h2))) {
-          res.status(403).json({
-            error: "Forbidden",
-            message: "Invalid X-Forwarded-Host header"
-          });
-          return;
-        }
-      }
-    }
-    if (allowedOriginsSet) {
-      const origin = req.headers?.["origin"];
-      if (origin && !allowedOriginsSet.has(origin)) {
-        res.status(403).json({
-          error: "Forbidden",
-          message: "Invalid Origin header"
-        });
-        return;
-      }
+    const rejection = validateHostHeaders(
+      {
+        host: req.headers?.["host"],
+        forwardedHost: req.headers?.["x-forwarded-host"],
+        origin: req.headers?.["origin"]
+      },
+      compiled
+    );
+    if (rejection) {
+      res.status(rejection.status).json({ error: rejection.error, message: rejection.message });
+      return;
     }
     next();
   };
@@ -60392,6 +61304,82 @@ function createHostValidationMiddleware(options) {
 var init_host_validation_middleware = __esm({
   "libs/sdk/src/server/middleware/host-validation.middleware.ts"() {
     "use strict";
+    init_host_validation();
+  }
+});
+
+// libs/sdk/src/server/security/resolve-allowed-hosts.ts
+function canonicalizeAddress(address) {
+  const bare = address.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  if (!bare.includes(":")) return bare;
+  try {
+    return new URL(`http://[${bare}]`).hostname.replace(/^\[|\]$/g, "");
+  } catch {
+    return bare;
+  }
+}
+function isLoopbackAddress(address) {
+  if (!address) return false;
+  const normalized = canonicalizeAddress(address);
+  return normalized === "::1" || normalized === "localhost" || normalized.startsWith("127.") || // IPv4-mapped IPv6 loopback, which `URL` renders as `::ffff:7f00:1`.
+  normalized === "::ffff:7f00:1" || normalized.startsWith("::ffff:127.");
+}
+function withAndWithoutPort(host, port) {
+  return port ? [host, `${host}:${port}`] : [host];
+}
+function hostFromUrl(url) {
+  if (!url) return void 0;
+  try {
+    return new URL(url).host || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isRoutableBind(address) {
+  if (!address) return false;
+  return !isLoopbackAddress(address);
+}
+function deriveAllowedHosts(input) {
+  const hosts = /* @__PURE__ */ new Set();
+  if (input.socketPath) return [];
+  for (const name42 of LOOPBACK_NAMES) {
+    for (const value of withAndWithoutPort(name42, input.port)) hosts.add(value);
+  }
+  const bindAddress = input.bindAddress?.trim();
+  if (bindAddress && !isLoopbackAddress(bindAddress) && bindAddress !== "0.0.0.0" && bindAddress !== "::") {
+    const literal = bindAddress.includes(":") && !bindAddress.startsWith("[") ? `[${bindAddress}]` : bindAddress;
+    for (const value of withAndWithoutPort(literal, input.port)) hosts.add(value);
+  }
+  const issuerHost = hostFromUrl(input.issuer);
+  if (issuerHost) {
+    hosts.add(issuerHost);
+    const [name42] = issuerHost.split(":");
+    if (!issuerHost.includes(":") && input.port) hosts.add(`${name42}:${input.port}`);
+  }
+  for (const extra of input.extraHosts ?? []) {
+    const trimmed = extra.trim();
+    if (trimmed) hosts.add(trimmed);
+  }
+  return [...hosts];
+}
+function shouldEnforceDerivedHosts(input) {
+  if (input.socketPath) return false;
+  const hasExplicitName = hostFromUrl(input.issuer) !== void 0 || (input.extraHosts ?? []).some((h2) => h2.trim());
+  if (hasExplicitName) return true;
+  if (input.port === void 0) return false;
+  return !isRoutableBind(input.bindAddress);
+}
+function allowedHostsFromEnv(env = process.env) {
+  const raw = env["FRONTMCP_ALLOWED_HOSTS"]?.trim();
+  if (!raw) return void 0;
+  const hosts = raw.split(",").map((h2) => h2.trim()).filter(Boolean);
+  return hosts.length > 0 ? hosts : void 0;
+}
+var LOOPBACK_NAMES;
+var init_resolve_allowed_hosts = __esm({
+  "libs/sdk/src/server/security/resolve-allowed-hosts.ts"() {
+    "use strict";
+    LOOPBACK_NAMES = ["localhost", "127.0.0.1", "[::1]"];
   }
 });
 
@@ -60417,12 +61405,17 @@ var init_express_host_adapter = __esm({
     "use strict";
     init_mcp_error();
     init_host_validation_middleware();
+    init_resolve_allowed_hosts();
     init_base_host_adapter();
     DEFAULT_EXPRESS_BODY_LIMIT = "4mb";
     ExpressHostAdapter = class extends HostServerAdapter {
       app = express();
       router = express.Router();
       prepared = false;
+      /** Active host-validation middleware, or undefined while nothing is enforced. */
+      hostValidation;
+      /** Builds the derived allow-list, once this process commits to listening. */
+      deriveHostValidation;
       constructor(options) {
         super();
         const corsOptions = options?.cors;
@@ -60436,6 +61429,7 @@ var init_express_host_adapter = __esm({
             })
           );
         }
+        this.installHostValidation(options);
         const jsonLimit = options?.bodyLimit ?? DEFAULT_EXPRESS_BODY_LIMIT;
         const formLimit = options?.urlencodedLimit ?? jsonLimit;
         const headerContains = (req, needle) => (req.headers["content-type"] ?? "").toLowerCase().includes(needle);
@@ -60456,23 +61450,6 @@ var init_express_host_adapter = __esm({
           }
           next(err);
         });
-        const securityOpts = options?.security;
-        if (securityOpts?.dnsRebindingProtection?.enabled || securityOpts?.strict) {
-          const allowedHosts = securityOpts.dnsRebindingProtection?.allowedHosts;
-          const allowedOrigins = securityOpts.dnsRebindingProtection?.allowedOrigins;
-          const effectiveHosts = allowedHosts ?? (securityOpts.strict ? ["localhost", "127.0.0.1"] : void 0);
-          if (!effectiveHosts?.length && !allowedOrigins?.length) {
-            throw new Error(
-              "security.dnsRebindingProtection is enabled but no allowedHosts or allowedOrigins are configured. Provide at least one allowedHosts entry or disable dnsRebindingProtection."
-            );
-          }
-          const hostValidation = createHostValidationMiddleware({
-            enabled: true,
-            allowedHosts: effectiveHosts,
-            allowedOrigins
-          });
-          this.app.use(hostValidation);
-        }
         this.app.use((req, res, next) => {
           if (corsEnabled) {
             res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate, Mcp-Session-Id");
@@ -60482,6 +61459,63 @@ var init_express_host_adapter = __esm({
           next();
         });
       }
+      /**
+       * Install DNS-rebinding protection.
+       *
+       * ON by default since v1.7.2 (BC-035). `allowedHosts` falls back to the names
+       * this process actually answers to — the loopback aliases with and without
+       * the bound port, the bound NIC address, and the configured issuer host.
+       *
+       * Escape hatches, in precedence order: explicit
+       * `security.dnsRebindingProtection.allowedHosts`, the
+       * `FRONTMCP_ALLOWED_HOSTS` env var, or `enabled: false` to turn it off.
+       */
+      installHostValidation(options) {
+        const protection = options?.security?.dnsRebindingProtection;
+        if (protection?.enabled === false) return;
+        const allowedOrigins = protection?.allowedOrigins;
+        const explicitHosts = protection?.allowedHosts ?? allowedHostsFromEnv();
+        if (explicitHosts?.length || allowedOrigins?.length) {
+          this.hostValidation = createHostValidationMiddleware({
+            enabled: true,
+            allowedHosts: explicitHosts?.length ? explicitHosts : void 0,
+            allowedOrigins
+          });
+        } else {
+          this.deriveHostValidation = (portOrSocketPath, bindAddress) => {
+            if (typeof portOrSocketPath === "string") return void 0;
+            const derivation = {
+              // `start()` binds `bindAddress ?? '0.0.0.0'`; mirror that exactly.
+              bindAddress: bindAddress ?? "0.0.0.0",
+              port: portOrSocketPath,
+              issuer: options?.listen?.issuer
+            };
+            if (!shouldEnforceDerivedHosts(derivation)) {
+              console.warn(
+                `[frontmcp] DNS-rebinding protection is not enforcing a Host allow-list: the server binds a routable address (${derivation.bindAddress}) and no allowed hosts are configured. Set security.dnsRebindingProtection.allowedHosts (or FRONTMCP_ALLOWED_HOSTS) to your public hostname(s).`
+              );
+              return void 0;
+            }
+            const allowedHosts = deriveAllowedHosts(derivation);
+            if (!allowedHosts.length) return void 0;
+            return createHostValidationMiddleware({ enabled: true, allowedHosts });
+          };
+        }
+        this.app.use(((req, res, next) => {
+          const validate = this.hostValidation;
+          if (!validate) return next();
+          return validate(req, res, next);
+        }));
+      }
+      /**
+       * Enable the DERIVED host allow-list. Called from `start()` only — see
+       * `installHostValidation`.
+       */
+      enableDerivedHostValidation(portOrSocketPath, bindAddress) {
+        if (this.hostValidation || !this.deriveHostValidation) return;
+        this.hostValidation = this.deriveHostValidation(portOrSocketPath, bindAddress);
+        this.deriveHostValidation = void 0;
+      }
       registerRoute(method, path3, handler) {
         this.router[method.toLowerCase()](path3, this.enhancedHandler(handler));
       }
@@ -60521,6 +61555,7 @@ var init_express_host_adapter = __esm({
         server.keepAliveTimeout = 75e3;
         if (typeof portOrSocketPath === "string") {
           await this.cleanupStaleSocket(portOrSocketPath);
+          this.enableDerivedHostValidation(portOrSocketPath);
           await new Promise((resolve, reject) => {
             server.on("error", reject);
             server.listen(portOrSocketPath, () => {
@@ -60538,7 +61573,11 @@ var init_express_host_adapter = __esm({
           await new Promise((resolve, reject) => {
             server.on("error", reject);
             server.listen(portOrSocketPath, host, () => {
-              console.log(`MCP HTTP (Express) on ${host}:${portOrSocketPath}`);
+              const bound = server.address();
+              const boundPort = typeof bound === "object" && bound ? bound.port : portOrSocketPath;
+              const boundAddress = typeof bound === "object" && bound ? bound.address : host;
+              this.enableDerivedHostValidation(boundPort, boundAddress);
+              console.log(`MCP HTTP (Express) on ${host}:${boundPort}`);
               resolve();
             });
           });
@@ -60940,7 +61979,7 @@ var init_front_mcp = __esm({
           frontMcp.log?.info("FrontMCP fetch handler created (web-standard transport)");
           return createWebFetchHandler(scope);
         };
-        return async (request) => {
+        return async (request, ctx, env) => {
           if (!inner) {
             if (!building) {
               building = build().catch((err) => {
@@ -60948,9 +61987,15 @@ var init_front_mcp = __esm({
                 throw err;
               });
             }
-            inner = await building;
+            try {
+              inner = await building;
+            } catch (err) {
+              const misconfigured = misconfigurationResponse(err);
+              if (misconfigured) return misconfigured;
+              throw err;
+            }
           }
-          return inner(request);
+          return inner(request, ctx, env);
         };
       }
       /**
@@ -63372,49 +64417,7 @@ init_job_registry();
 init_job_instance();
 init_job_events();
 init_job_utils();
-
-// libs/sdk/src/job/job-permission.guard.ts
-var JobPermissionGuard = class _JobPermissionGuard {
-  /**
-   * Check if the given auth info is allowed to perform the action.
-   * Returns true if no permissions are defined (permissive by default).
-   */
-  static async check(permissions, action, authInfo) {
-    if (!permissions || permissions.length === 0) {
-      return true;
-    }
-    const relevant = permissions.filter((p) => p.action === action);
-    if (relevant.length === 0) {
-      return true;
-    }
-    for (const perm of relevant) {
-      const passed = await _JobPermissionGuard.checkSingle(perm, authInfo);
-      if (!passed) return false;
-    }
-    return true;
-  }
-  static async checkSingle(perm, authInfo) {
-    if (perm.roles && perm.roles.length > 0) {
-      const userRoles = authInfo["roles"];
-      if (!Array.isArray(userRoles)) return false;
-      const hasRole = perm.roles.some((r) => userRoles.includes(r));
-      if (!hasRole) return false;
-    }
-    if (perm.scopes && perm.scopes.length > 0) {
-      const userScopes = authInfo["scopes"] ?? authInfo["scope"];
-      const scopeArr = typeof userScopes === "string" ? userScopes.split(" ") : Array.isArray(userScopes) ? userScopes : [];
-      const hasScope = perm.scopes.some((s) => scopeArr.includes(s));
-      if (!hasScope) return false;
-    }
-    if (perm.custom) {
-      const result = await perm.custom(authInfo);
-      if (!result) return false;
-    }
-    return true;
-  }
-};
-
-// libs/sdk/src/job/index.ts
+init_job_permission_guard();
 init_job_scope_helper();
 
 // libs/sdk/src/job/execution/index.ts
@@ -63816,6 +64819,7 @@ export {
   DynamicAdapter,
   DynamicAdapterNameError,
   DynamicJobDirectExecutionError,
+  DynamicJobRegistrationDisabledError,
   DynamicPlugin,
   ELICITATION_FALLBACK_JSON_SCHEMA,
   ESM_SH_BASE_URL,
@@ -63970,8 +64974,11 @@ export {
   JobExecutionManager,
   JobInstance,
   JobKind,
+  JobNotAuthorizedError,
   JobPermissionGuard,
   JobRegistry,
+  JwtSecretRequiredError,
+  JwtSecretWeakError,
   LLM_ADAPTER,
   LazyZodSchema,
   ListJobsTool,
@@ -64399,6 +65406,7 @@ export {
   isOrchestratedMode,
   isOrchestratedRemote,
   isPackageSpecifier,
+  isProxyTrusted,
   isPublicError,
   isPublicMode,
   isPublicUrlPinned,
@@ -64407,6 +65415,7 @@ export {
   isRemoteMode,
   isSkillDecorated,
   isSkillRecord,
+  isStaticMode,
   isTaskWorkerProcess,
   isTerminal,
   isToolRefWithClass,
@@ -64484,9 +65493,11 @@ export {
   remoteAuthSchema,
   remoteProviderConfigSchema,
   resolveDefaultSqlitePath,
+  resolveEntryPath,
   resolveNameConflicts,
   resolveOutputSchemaMode,
   resolvePendingTC39HooksForClass,
+  resolvePrincipal2 as resolvePrincipal,
   resolveRegistryToken,
   resolveSchemaDescriptionFormat,
   resolveToolVisibility,
@@ -64525,6 +65536,7 @@ export {
   skillsConfigOptionsSchema,
   skippedAppBehaviorSchema,
   sqliteOptionsSchema,
+  staticAuthOptionsSchema,
   storageProviderSchema,
   supportsStreaming,
   toJSONSchema9 as toJSONSchema,