@synapsor/runner 1.5.0 → 1.5.4

package/dist/runtime.mjs

@@ -11,9 +11,11 @@ import fs2 from "node:fs";
 import { createServer } from "node:http";
 import { createServer as createHttpsServer } from "node:https";
 import path2 from "node:path";
+import { createSecureContext } from "node:tls";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { OAuthProtectedResourceMetadataSchema } from "@modelcontextprotocol/sdk/shared/auth.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 
 // node_modules/.pnpm/@modelcontextprotocol+ext-apps@1.7.4_@modelcontextprotocol+sdk@1.29.0_zod@3.25.76__zod@3.25.76/node_modules/@modelcontextprotocol/ext-apps/dist/src/server/index.js
@@ -118,7 +120,7 @@ function N3(Z, $, J, X, V) {
 }
 
 // packages/config/src/index.ts
-var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set(["version", "mode", "storage", "sources", "trusted_context", "contexts", "executors", "capabilities", "contracts", "policies", "approvals", "operator_identity", "session_auth", "rate_limits", "metrics", "graduated_trust", "cloud", "governance", "strict", "result_format"]);
+var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set(["version", "mode", "storage", "sources", "trusted_context", "contexts", "executors", "capabilities", "contracts", "policies", "approvals", "operator_identity", "session_auth", "http_security", "rate_limits", "metrics", "graduated_trust", "cloud", "governance", "strict", "result_format"]);
 var STORAGE_KEYS = /* @__PURE__ */ new Set(["sqlite_path", "shared_postgres"]);
 var SHARED_POSTGRES_STORAGE_KEYS = /* @__PURE__ */ new Set(["mode", "url_env", "schema", "lock_timeout_ms", "max_entries"]);
 var APPROVALS_KEYS = /* @__PURE__ */ new Set(["disable_auto_approval"]);
@@ -180,6 +182,26 @@ var SESSION_AUTH_KEYS = /* @__PURE__ */ new Set([
   "fetch_timeout_ms",
   "max_response_bytes"
 ]);
+var HTTP_SECURITY_KEYS = /* @__PURE__ */ new Set(["deployment", "channel", "static_token", "oauth_resource", "allowed_origins", "allowed_hosts", "limits"]);
+var HTTP_STATIC_TOKEN_KEYS = /* @__PURE__ */ new Set(["active_env", "previous_env"]);
+var HTTP_OAUTH_RESOURCE_KEYS = /* @__PURE__ */ new Set([
+  "resource",
+  "authorization_servers",
+  "scopes_supported",
+  "required_scopes",
+  "resource_name",
+  "resource_documentation"
+]);
+var HTTP_LIMIT_KEYS = /* @__PURE__ */ new Set([
+  "max_request_bytes",
+  "max_header_bytes",
+  "max_sessions",
+  "session_idle_timeout_seconds",
+  "request_timeout_ms",
+  "headers_timeout_ms",
+  "keep_alive_timeout_ms",
+  "max_connections"
+]);
 var RATE_LIMITS_KEYS = /* @__PURE__ */ new Set(["enabled", "default", "capabilities"]);
 var RATE_LIMIT_RULE_KEYS = /* @__PURE__ */ new Set(["requests", "window_seconds"]);
 var CLOUD_KEYS = /* @__PURE__ */ new Set(["base_url_env", "runner_token_env", "runner_id", "runner_version", "project_id", "adapter_id", "source_id", "engines", "capabilities", "session"]);
@@ -337,6 +359,7 @@ function validateRunnerCapabilityConfig(input) {
   validatePolicies(input.policies, strict, errors);
   validateOperatorIdentity(input.operator_identity, strict, errors);
   validateSessionAuth(input.session_auth, input.trusted_context, input.contexts, strict, errors);
+  validateHttpSecurity(input.http_security, input.session_auth, input.trusted_context, input.contexts, strict, errors, warnings);
   validateRateLimits(input.rate_limits, strict, errors);
   validateMetrics(input.metrics, strict, errors);
   validateGraduatedTrust(input.graduated_trust, strict, errors);
@@ -347,6 +370,169 @@ function validateRunnerCapabilityConfig(input) {
   scanForForbiddenFields(input, "$", errors);
   return { ok: errors.length === 0, errors, warnings };
 }
+function validateHttpSecurity(value, sessionAuth, trustedContext, contexts, strict, errors, warnings) {
+  if (value === void 0) return;
+  if (!isRecord(value)) {
+    errors.push({ path: "$.http_security", code: "HTTP_SECURITY_NOT_OBJECT", message: "http_security must be a Runner deployment configuration object." });
+    return;
+  }
+  if (strict) checkUnknownKeys(value, HTTP_SECURITY_KEYS, "$.http_security", errors);
+  const deployment = value.deployment;
+  if (deployment !== void 0 && deployment !== "loopback" && deployment !== "single_tenant" && deployment !== "shared") {
+    errors.push({ path: "$.http_security.deployment", code: "INVALID_HTTP_DEPLOYMENT", message: "http_security.deployment must be loopback, single_tenant, or shared." });
+  }
+  const channel = value.channel;
+  if (channel !== void 0 && channel !== "direct_tls" && channel !== "trusted_tls_proxy" && channel !== "insecure_http_break_glass") {
+    errors.push({ path: "$.http_security.channel", code: "INVALID_HTTP_CHANNEL", message: "http_security.channel must be direct_tls, trusted_tls_proxy, or insecure_http_break_glass." });
+  }
+  validateHttpStaticToken(value.static_token, strict, errors);
+  validateHttpOauthResource(value.oauth_resource, strict, errors);
+  validateExactOrigins(value.allowed_origins, errors);
+  validateAllowedHosts(value.allowed_hosts, errors);
+  validateHttpLimits(value.limits, strict, errors);
+  const contextsUseClaims = isRecord(trustedContext) && trustedContext.provider === "http_claims" || isRecord(contexts) && Object.values(contexts).some((context) => isRecord(context) && context.provider === "http_claims");
+  if (deployment === "shared") {
+    if (!contextsUseClaims) {
+      errors.push({ path: "$.http_security.deployment", code: "SHARED_HTTP_CLAIMS_REQUIRED", message: "shared HTTP deployment requires http_claims trusted context so tenant and principal come from verified per-session identity." });
+    }
+    if (!isRecord(sessionAuth)) {
+      errors.push({ path: "$.session_auth", code: "SHARED_HTTP_SESSION_AUTH_REQUIRED", message: "shared HTTP deployment requires signed session_auth." });
+    } else {
+      if (!isNonEmptyString(sessionAuth.issuer)) errors.push({ path: "$.session_auth.issuer", code: "SHARED_HTTP_ISSUER_REQUIRED", message: "shared HTTP deployment requires an exact JWT issuer." });
+      if (!isNonEmptyString(sessionAuth.audience)) errors.push({ path: "$.session_auth.audience", code: "SHARED_HTTP_AUDIENCE_REQUIRED", message: "shared HTTP deployment requires an exact JWT audience/resource." });
+      if (sessionAuth.provider === "jwt_hs256") {
+        warnings.push({ path: "$.session_auth.provider", code: "SHARED_HTTP_HS256_WARNING", message: "Shared HTTP uses a symmetric JWT verification key. Prefer jwt_asymmetric with RS256/ES256 and JWKS for production." });
+      }
+    }
+    if (!isRecord(value.oauth_resource)) {
+      errors.push({ path: "$.http_security.oauth_resource", code: "SHARED_HTTP_OAUTH_RESOURCE_REQUIRED", message: "shared HTTP deployment requires RFC 9728 protected-resource metadata for an external authorization server." });
+    } else if (isRecord(sessionAuth) && isNonEmptyString(sessionAuth.audience) && value.oauth_resource.resource !== sessionAuth.audience) {
+      errors.push({ path: "$.http_security.oauth_resource.resource", code: "HTTP_RESOURCE_AUDIENCE_MISMATCH", message: "oauth_resource.resource must exactly match session_auth.audience so tokens are bound to this Runner resource." });
+    }
+  }
+  if (deployment !== "shared" && value.oauth_resource !== void 0 && !contextsUseClaims) {
+    errors.push({ path: "$.http_security.oauth_resource", code: "HTTP_OAUTH_CLAIMS_REQUIRED", message: "OAuth protected-resource metadata requires signed http_claims session identity." });
+  }
+}
+function validateHttpStaticToken(value, strict, errors) {
+  if (value === void 0) return;
+  if (!isRecord(value)) {
+    errors.push({ path: "$.http_security.static_token", code: "HTTP_STATIC_TOKEN_NOT_OBJECT", message: "http_security.static_token must contain environment-variable names only." });
+    return;
+  }
+  if (strict) checkUnknownKeys(value, HTTP_STATIC_TOKEN_KEYS, "$.http_security.static_token", errors);
+  if (value.active_env !== void 0 && !isEnvName(value.active_env)) {
+    errors.push({ path: "$.http_security.static_token.active_env", code: "INVALID_HTTP_TOKEN_ENV", message: "active_env must name the environment variable containing the opaque endpoint token." });
+  }
+  if (value.previous_env !== void 0 && !isEnvName(value.previous_env)) {
+    errors.push({ path: "$.http_security.static_token.previous_env", code: "INVALID_HTTP_PREVIOUS_TOKEN_ENV", message: "previous_env must name the one previous token accepted during an operator-controlled rotation window." });
+  }
+  if (value.active_env !== void 0 && value.active_env === value.previous_env) {
+    errors.push({ path: "$.http_security.static_token.previous_env", code: "HTTP_TOKEN_ENV_REUSED", message: "active_env and previous_env must be different environment variables." });
+  }
+}
+function validateHttpOauthResource(value, strict, errors) {
+  if (value === void 0) return;
+  if (!isRecord(value)) {
+    errors.push({ path: "$.http_security.oauth_resource", code: "HTTP_OAUTH_RESOURCE_NOT_OBJECT", message: "oauth_resource must describe this Runner protected resource and its external authorization server." });
+    return;
+  }
+  if (strict) checkUnknownKeys(value, HTTP_OAUTH_RESOURCE_KEYS, "$.http_security.oauth_resource", errors);
+  if (!isHttpsUrl(value.resource)) {
+    errors.push({ path: "$.http_security.oauth_resource.resource", code: "INVALID_HTTP_OAUTH_RESOURCE", message: "oauth_resource.resource must be an HTTPS URL for the exact public MCP endpoint." });
+  }
+  if (!Array.isArray(value.authorization_servers) || value.authorization_servers.length < 1 || value.authorization_servers.length > 8) {
+    errors.push({ path: "$.http_security.oauth_resource.authorization_servers", code: "HTTP_AUTHORIZATION_SERVERS_REQUIRED", message: "oauth_resource.authorization_servers must contain 1 through 8 external authorization-server HTTPS issuer URLs." });
+  } else {
+    value.authorization_servers.forEach((server, index) => {
+      if (!isHttpsUrl(server)) errors.push({ path: `$.http_security.oauth_resource.authorization_servers[${index}]`, code: "INVALID_HTTP_AUTHORIZATION_SERVER", message: "authorization server URLs must use HTTPS and contain no credentials, query, or fragment." });
+    });
+  }
+  for (const key of ["scopes_supported", "required_scopes"]) {
+    const scopes = value[key];
+    if (scopes !== void 0 && (!Array.isArray(scopes) || scopes.length < 1 || scopes.length > 64 || scopes.some((scope) => !isOAuthScope(scope)))) {
+      errors.push({ path: `$.http_security.oauth_resource.${key}`, code: "INVALID_HTTP_OAUTH_SCOPES", message: `${key} must contain 1 through 64 unique, visible OAuth scope strings.` });
+    } else if (Array.isArray(scopes) && new Set(scopes).size !== scopes.length) {
+      errors.push({ path: `$.http_security.oauth_resource.${key}`, code: "DUPLICATE_HTTP_OAUTH_SCOPE", message: `${key} must not contain duplicate scopes.` });
+    }
+  }
+  if (Array.isArray(value.required_scopes) && Array.isArray(value.scopes_supported)) {
+    for (const scope of value.required_scopes) {
+      if (!value.scopes_supported.includes(scope)) errors.push({ path: "$.http_security.oauth_resource.required_scopes", code: "UNSUPPORTED_HTTP_OAUTH_SCOPE", message: `Required scope ${String(scope)} is not listed in scopes_supported.` });
+    }
+  }
+  if (value.resource_name !== void 0 && (!isNonEmptyString(value.resource_name) || value.resource_name.trim().length > 128)) {
+    errors.push({ path: "$.http_security.oauth_resource.resource_name", code: "INVALID_HTTP_RESOURCE_NAME", message: "resource_name must be 1 through 128 characters." });
+  }
+  if (value.resource_documentation !== void 0 && !isHttpsUrl(value.resource_documentation)) {
+    errors.push({ path: "$.http_security.oauth_resource.resource_documentation", code: "INVALID_HTTP_RESOURCE_DOCUMENTATION", message: "resource_documentation must be an HTTPS URL without credentials, query, or fragment." });
+  }
+}
+function validateExactOrigins(value, errors) {
+  if (value === void 0) return;
+  if (!Array.isArray(value) || value.length > 32) {
+    errors.push({ path: "$.http_security.allowed_origins", code: "INVALID_HTTP_ALLOWED_ORIGINS", message: "allowed_origins must be an array of at most 32 exact origins." });
+    return;
+  }
+  value.forEach((origin, index) => {
+    if (!isExactHttpOrigin(origin)) errors.push({ path: `$.http_security.allowed_origins[${index}]`, code: "INVALID_HTTP_ALLOWED_ORIGIN", message: "Each allowed origin must be an exact HTTP(S) origin; wildcards, credentials, paths, query strings, and fragments are forbidden." });
+  });
+  if (new Set(value).size !== value.length) errors.push({ path: "$.http_security.allowed_origins", code: "DUPLICATE_HTTP_ALLOWED_ORIGIN", message: "allowed_origins must not contain duplicates." });
+}
+function validateAllowedHosts(value, errors) {
+  if (value === void 0) return;
+  if (!Array.isArray(value) || value.length < 1 || value.length > 32 || value.some((host) => !isAllowedHost(host))) {
+    errors.push({ path: "$.http_security.allowed_hosts", code: "INVALID_HTTP_ALLOWED_HOSTS", message: "allowed_hosts must contain 1 through 32 exact host or host:port authorities; wildcards and forwarded-host syntax are forbidden." });
+  } else if (new Set(value.map((host) => String(host).toLowerCase())).size !== value.length) {
+    errors.push({ path: "$.http_security.allowed_hosts", code: "DUPLICATE_HTTP_ALLOWED_HOST", message: "allowed_hosts must not contain duplicates." });
+  }
+}
+function validateHttpLimits(value, strict, errors) {
+  if (value === void 0) return;
+  if (!isRecord(value)) {
+    errors.push({ path: "$.http_security.limits", code: "HTTP_LIMITS_NOT_OBJECT", message: "http_security.limits must be an object." });
+    return;
+  }
+  if (strict) checkUnknownKeys(value, HTTP_LIMIT_KEYS, "$.http_security.limits", errors);
+  for (const [key, minimum, maximum] of [
+    ["max_request_bytes", 1024, 16 * 1024 * 1024],
+    ["max_header_bytes", 4096, 64 * 1024],
+    ["max_sessions", 1, 1e5],
+    ["session_idle_timeout_seconds", 10, 86400],
+    ["request_timeout_ms", 1e3, 3e5],
+    ["headers_timeout_ms", 1e3, 12e4],
+    ["keep_alive_timeout_ms", 1e3, 12e4],
+    ["max_connections", 1, 1e5]
+  ]) {
+    if (value[key] !== void 0 && (!Number.isSafeInteger(value[key]) || Number(value[key]) < minimum || Number(value[key]) > maximum)) {
+      errors.push({ path: `$.http_security.limits.${key}`, code: "INVALID_HTTP_LIMIT", message: `${key} must be an integer from ${minimum} through ${maximum}.` });
+    }
+  }
+}
+function isHttpsUrl(value) {
+  if (typeof value !== "string") return false;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash;
+  } catch {
+    return false;
+  }
+}
+function isExactHttpOrigin(value) {
+  if (typeof value !== "string" || value === "*" || value === "null") return false;
+  try {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password && url.pathname === "/" && !url.search && !url.hash && url.origin === value;
+  } catch {
+    return false;
+  }
+}
+function isAllowedHost(value) {
+  return typeof value === "string" && value.length <= 255 && value === value.trim() && !/[\s,/*\\?#]/.test(value) && !value.includes("://") && /^(?:\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9.-]+)(?::\d{1,5})?$/.test(value);
+}
+function isOAuthScope(value) {
+  return typeof value === "string" && value.length >= 1 && value.length <= 128 && /^[\x21\x23-\x5b\x5d-\x7e]+$/.test(value);
+}
 function validateGovernance(value, strict, errors) {
   if (value === void 0) return;
   if (!isRecord(value)) {
@@ -4557,6 +4743,11 @@ var ProposalStore = class {
     const rows = this.db.prepare(query.sql).all(...query.params);
     return rows.map((row) => rowToProposal(row)).filter((proposal) => proposal !== void 0);
   }
+  countProposals(filters = {}) {
+    const query = buildProposalCountQuery(filters);
+    const row = this.db.prepare(query.sql).get(...query.params);
+    return isRecord2(row) ? Number(row.count ?? 0) : 0;
+  }
   listEvidenceBundles(filters = {}) {
     const query = buildEvidenceQuery(filters);
     const rows = this.db.prepare(query.sql).all(...query.params);
@@ -4583,6 +4774,19 @@ var ProposalStore = class {
     const proposalId = replayId.startsWith(prefix) ? replayId.slice(prefix.length) : replayId;
     return this.replay(proposalId);
   }
+  getStoredReplay(replayId) {
+    const row = this.db.prepare("SELECT * FROM replay_records WHERE replay_id = ?").get(replayId);
+    return rowToStoredReplay(row);
+  }
+  getStoredReplayForProposal(proposalId) {
+    const row = this.db.prepare(`
+      SELECT * FROM replay_records
+      WHERE proposal_id = ?
+      ORDER BY created_at DESC, replay_id DESC
+      LIMIT 1
+    `).get(proposalId);
+    return rowToStoredReplay(row);
+  }
   proposalIdForEvidence(evidenceBundleId) {
     const evidence = this.getEvidenceBundle(evidenceBundleId);
     if (evidence?.proposal_id) return evidence.proposal_id;
@@ -4885,6 +5089,19 @@ var ProposalStore = class {
     });
     return job;
   }
+  getWritebackJob(writebackJobId) {
+    return rowToWritebackJob(this.db.prepare("SELECT * FROM writeback_jobs WHERE writeback_job_id = ?").get(writebackJobId));
+  }
+  listWritebackJobs(options = {}) {
+    const clauses = [];
+    const values = [];
+    if (options.proposal_id) {
+      clauses.push("proposal_id = ?");
+      values.push(options.proposal_id);
+    }
+    const limit = Math.min(Math.max(options.limit ?? 100, 1), 1e3);
+    return this.db.prepare(`SELECT * FROM writeback_jobs${clauses.length ? ` WHERE ${clauses.join(" AND ")}` : ""} ORDER BY created_at ASC, writeback_job_id ASC LIMIT ?`).all(...values, limit).map(rowToWritebackJob).filter((job) => Boolean(job));
+  }
   claimWritebackIntent(jobInput, runnerId) {
     const job = parseWritebackJob(jobInput);
     const proposal = this.requireProposal(job.proposal_id);
@@ -6327,6 +6544,7 @@ var ProposalStore = class {
     const highestRisk = comparisons.filter((item) => item.status === "disagreement" || item.status === "partial_agreement" || item.status === "invalid_or_unsafe_scope_attempt").sort(
       (left, right) => (right.risk_score ?? 0) - (left.risk_score ?? 0) || (right.amount_value ?? 0) - (left.amount_value ?? 0) || left.case_id.localeCompare(right.case_id)
     ).slice(0, 10);
+    const suggestedPolicies = suggestedShadowPolicies(comparisons);
     return {
       study,
       total_tasks_observed: comparisons.length,
@@ -6345,7 +6563,8 @@ var ProposalStore = class {
       by_capability: byCapability,
       by_decision_reason: byDecisionReason,
       highest_risk_disagreements: highestRisk,
-      suggested_policies: suggestedShadowPolicies(comparisons),
+      suggested_policies: suggestedPolicies,
+      trust_progression: shadowTrustProgression(comparisons, suggestedPolicies),
       comparisons,
       generated_at: latestIsoTimestamp([
         study.updated_at,
@@ -6706,6 +6925,19 @@ function inWhere(column, values) {
   };
 }
 function buildProposalQuery(filters) {
+  const { clauses, params } = proposalQueryParts(filters);
+  const where = clauses.length ? ` WHERE ${clauses.join(" AND ")}` : "";
+  return {
+    sql: `SELECT * FROM proposals${where} ORDER BY created_at DESC, proposal_id DESC${filters.limit ? " LIMIT ?" : ""}`,
+    params: filters.limit ? [...params, filters.limit] : params
+  };
+}
+function buildProposalCountQuery(filters) {
+  const { clauses, params } = proposalQueryParts(filters);
+  const where = clauses.length ? ` WHERE ${clauses.join(" AND ")}` : "";
+  return { sql: `SELECT COUNT(*) AS count FROM proposals${where}`, params };
+}
+function proposalQueryParts(filters) {
   const clauses = [];
   const params = [];
   addEqual(clauses, params, "proposal_id", filters.proposal);
@@ -6717,7 +6949,7 @@ function buildProposalQuery(filters) {
   addEqual(clauses, params, "action", filters.capability ?? filters.action);
   addObjectFilter(clauses, params, "business_object", "source_table", "object_id", filters.objectType, filters.objectId);
   addTimeRange(clauses, params, "created_at", filters.from, filters.to);
-  return finishQuery("SELECT * FROM proposals", clauses, params, filters.limit);
+  return { clauses, params };
 }
 function buildEvidenceQuery(filters) {
   const clauses = [];
@@ -7299,6 +7531,62 @@ function rowToReceipt(row) {
     source_table: row.source_table == null ? void 0 : String(row.source_table)
   };
 }
+function rowToWritebackJob(row) {
+  if (!isRecord2(row)) return void 0;
+  let payload;
+  try {
+    payload = JSON.parse(String(row.job_json));
+  } catch {
+    throw new ProposalStoreError("WRITEBACK_JOB_CORRUPT", `writeback job ${String(row.writeback_job_id)} payload is not valid JSON`);
+  }
+  if (!isRecord2(payload)) {
+    throw new ProposalStoreError("WRITEBACK_JOB_CORRUPT", `writeback job ${String(row.writeback_job_id)} payload is not an object`);
+  }
+  const handler = payload.schema_version === "synapsor.handler-writeback.v1";
+  let normalizedJob;
+  if (!handler) {
+    try {
+      normalizedJob = parseWritebackJob(payload);
+    } catch {
+      throw new ProposalStoreError("WRITEBACK_JOB_CORRUPT", `writeback job ${String(row.writeback_job_id)} payload is not a supported writeback protocol`);
+    }
+  }
+  const payloadJobId = handler ? payload.writeback_job_id : normalizedJob?.job_id;
+  const payloadProposalId = handler ? payload.proposal_id : normalizedJob?.proposal_id;
+  const payloadProposalHash = handler ? payload.proposal_hash : normalizedJob?.approval_id;
+  if (payloadJobId !== String(row.writeback_job_id) || payloadProposalId !== String(row.proposal_id) || payloadProposalHash !== String(row.proposal_hash)) {
+    throw new ProposalStoreError("WRITEBACK_JOB_CORRUPT", `writeback job ${String(row.writeback_job_id)} index fields do not match its payload`);
+  }
+  return {
+    writeback_job_id: String(row.writeback_job_id),
+    proposal_id: String(row.proposal_id),
+    proposal_hash: String(row.proposal_hash),
+    status: String(row.status),
+    kind: handler ? "app_handler" : "direct_sql",
+    payload,
+    ...normalizedJob ? { normalized_job: normalizedJob } : {},
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at)
+  };
+}
+function rowToStoredReplay(row) {
+  if (!isRecord2(row)) return void 0;
+  let payload;
+  try {
+    payload = JSON.parse(String(row.payload_json));
+  } catch {
+    throw new ProposalStoreError("REPLAY_RECORD_CORRUPT", `replay ${String(row.replay_id)} payload is not valid JSON`);
+  }
+  if (!isRecord2(payload) || !isRecord2(payload.proposal)) {
+    throw new ProposalStoreError("REPLAY_RECORD_CORRUPT", `replay ${String(row.replay_id)} payload is not a supported replay record`);
+  }
+  const replayId = String(row.replay_id);
+  const proposalId = String(row.proposal_id);
+  if (payload.replay_id !== replayId || payload.proposal.proposal_id !== proposalId || !Array.isArray(payload.approvals) || !Array.isArray(payload.events) || !Array.isArray(payload.receipts) || !Array.isArray(payload.query_audit) || !Array.isArray(payload.evidence) || typeof payload.generated_at !== "string") {
+    throw new ProposalStoreError("REPLAY_RECORD_CORRUPT", `replay ${replayId} index fields do not match its payload`);
+  }
+  return payload;
+}
 function rowToWritebackIntent(row) {
   if (!isRecord2(row)) return void 0;
   const status = String(row.status);
@@ -7829,6 +8117,32 @@ function suggestedShadowPolicies(comparisons) {
   }
   return suggestions;
 }
+function shadowTrustProgression(comparisons, suggestions) {
+  const outcomes = comparisons.filter((item) => item.outcome !== void 0).length;
+  const comparable = comparisons.filter((item) => item.comparable).length;
+  const exact = comparisons.filter((item) => item.status === "exact_agreement").length;
+  const currentStage = comparisons.length === 0 ? "observe" : outcomes === 0 ? "compare" : suggestions.length === 0 ? "manual_review" : "suggested_bounded_policy";
+  const stageOrder = ["observe", "compare", "manual_review", "suggested_bounded_policy"];
+  const currentIndex = stageOrder.indexOf(currentStage);
+  const details = {
+    observe: `${comparisons.length} task${comparisons.length === 1 ? "" : "s"} observed without source mutation.`,
+    compare: `${outcomes} authoritative outcome${outcomes === 1 ? "" : "s"}; ${comparisons.length - outcomes} unmatched.`,
+    manual_review: `${comparable} comparable task${comparable === 1 ? "" : "s"}; ${exact} exact agreement${exact === 1 ? "" : "s"}. At least 5 exact numeric examples are required before a bounded-policy suggestion.`,
+    suggested_bounded_policy: suggestions.length > 0 ? `${suggestions.length} inactive bounded-policy suggestion${suggestions.length === 1 ? "" : "s"}; a human must review and activate any contract change separately.` : "No policy suggestion is available."
+  };
+  const labels = ["Observe", "Compare", "Manual review", "Suggested bounded policy"];
+  return {
+    current_stage: currentStage,
+    minimum_policy_sample_size: 5,
+    insufficient_sample_size: suggestions.length === 0,
+    stages: stageOrder.map((stage, index) => ({
+      name: labels[index],
+      status: index < currentIndex ? "complete" : index === currentIndex ? "current" : "locked",
+      detail: details[stage]
+    })),
+    automatic_activation: false
+  };
+}
 function safeSqliteFailure(_error, fallback) {
   return fallback;
 }
@@ -10811,8 +11125,30 @@ async function boundedJwksFetch(resource, init, maxBytes) {
     body.set(chunk, offset);
     offset += chunk.byteLength;
   }
+  if (response.ok) validatePublicJwks(body);
   return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
 }
+function validatePublicJwks(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(body));
+  } catch {
+    throw new Error("JWKS response is not valid JSON");
+  }
+  if (!isRecord4(parsed) || !Array.isArray(parsed.keys) || parsed.keys.length > 128) {
+    throw new Error("JWKS response must contain a bounded keys array");
+  }
+  const privateMembers = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth", "k"]);
+  for (const key of parsed.keys) {
+    if (!isRecord4(key) || typeof key.kty !== "string") throw new Error("JWKS contains an invalid key");
+    if (key.kty === "oct" || Object.keys(key).some((member) => privateMembers.has(member))) {
+      throw new Error("JWKS must contain public verification keys only");
+    }
+  }
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function trimmedEnv(env, name) {
   const value = env[name]?.trim();
   return value || void 0;
@@ -11355,8 +11691,8 @@ function loadCloudLinkedConnection(config, env = process.env) {
   } catch (error) {
     throw new McpRuntimeError("CLOUD_CONNECTION_INVALID", `Unable to read the reviewed Cloud connection file: ${error instanceof Error ? error.message : String(error)}`);
   }
-  const root = isRecord4(parsed) ? parsed : {};
-  const cloud = isRecord4(root.cloud) ? root.cloud : void 0;
+  const root = isRecord5(parsed) ? parsed : {};
+  const cloud = isRecord5(root.cloud) ? root.cloud : void 0;
   if (!cloud) throw new McpRuntimeError("CLOUD_CONNECTION_INVALID", "Cloud connection file must contain a cloud object.");
   const baseUrlEnv = nonEmptyString(cloud.base_url_env) ?? "SYNAPSOR_CLOUD_BASE_URL";
   const runnerTokenEnv = nonEmptyString(cloud.runner_token_env) ?? "SYNAPSOR_RUNNER_TOKEN";
@@ -11547,13 +11883,13 @@ function cloudSafeChangeSet(changeSet) {
 }
 function stripCloudPrincipalColumn(changeSet, column) {
   const strip = (value) => {
-    if (isRecord4(value)) delete value[column];
+    if (isRecord5(value)) delete value[column];
   };
   strip(changeSet.before);
   strip(changeSet.after);
-  if ("frozen_set" in changeSet && isRecord4(changeSet.frozen_set) && Array.isArray(changeSet.frozen_set.members)) {
+  if ("frozen_set" in changeSet && isRecord5(changeSet.frozen_set) && Array.isArray(changeSet.frozen_set.members)) {
     for (const member of changeSet.frozen_set.members) {
-      if (!isRecord4(member)) continue;
+      if (!isRecord5(member)) continue;
       strip(member.before);
       strip(member.after);
     }
@@ -11740,7 +12076,7 @@ var CloudLinkedSynchronizer = class {
     if (item.kind === "proposal") return this.client.submitProposal(item.payload);
     if (item.kind === "activity") return this.client.submitActivity(item.payload);
     if (item.kind === "result") {
-      const result = isRecord4(item.payload.result) ? item.payload.result : void 0;
+      const result = isRecord5(item.payload.result) ? item.payload.result : void 0;
       const leaseId = nonEmptyString(item.payload.lease_id);
       if (!result || !leaseId) throw new McpRuntimeError("CLOUD_RESULT_OUTBOX_INVALID", "Cloud result outbox entry is missing a result or lease identity.");
       return this.client.result(result, leaseId);
@@ -11749,9 +12085,9 @@ var CloudLinkedSynchronizer = class {
   }
 };
 function cloudGovernanceStatusPayload(response) {
-  const decision = isRecord4(response.decision) ? response.decision : void 0;
-  const job = isRecord4(response.job) ? response.job : void 0;
-  const result = isRecord4(response.result) ? response.result : void 0;
+  const decision = isRecord5(response.decision) ? response.decision : void 0;
+  const job = isRecord5(response.job) ? response.job : void 0;
+  const result = isRecord5(response.result) ? response.result : void 0;
   const actor = nonEmptyString(decision?.actor);
   return JSON.parse(JSON.stringify({
     contract_id: nonEmptyString(response.contract_id),
@@ -11844,9 +12180,17 @@ function mergeContractIntoRuntimeConfig(config, contract, origin, seenCapabiliti
   }
 }
 function runtimeContextFromSpec(context) {
+  const unsupportedSessionBinding = context.bindings.find((binding) => binding.source === "session");
+  if (unsupportedSessionBinding) {
+    throw new Error(
+      `SESSION_BINDING_UNSUPPORTED: context ${context.name} binding ${unsupportedSessionBinding.name} uses canonical SESSION source, but Synapsor Runner has no generic web-session trust provider. Use ENVIRONMENT for local stdio, HTTP_CLAIM for verified HTTP JWT claims, or CLOUD_SESSION for verified Cloud-linked identity.`
+    );
+  }
   const tenantBinding = context.bindings.find((binding) => binding.name === context.tenant_binding) ?? context.bindings.find((binding) => binding.name === "tenant_id");
   const principalBinding = context.bindings.find((binding) => binding.name === context.principal_binding) ?? context.bindings.find((binding) => binding.name === "principal");
-  const provider = context.bindings.some((binding) => binding.source === "environment") ? "environment" : context.bindings.some((binding) => binding.source === "cloud_session") ? "cloud_session" : context.bindings.some((binding) => binding.source === "http_claim") ? "http_claims" : context.bindings.some((binding) => binding.source === "static_dev") ? "static_dev" : "environment";
+  const provider = context.bindings.some((binding) => binding.source === "environment") ? "environment" : context.bindings.some((binding) => binding.source === "cloud_session") ? "cloud_session" : context.bindings.some((binding) => binding.source === "http_claim") ? "http_claims" : context.bindings.some((binding) => binding.source === "static_dev") ? "static_dev" : (() => {
+    throw new Error(`TRUSTED_CONTEXT_BINDING_UNSUPPORTED: context ${context.name} has no binding source supported by Synapsor Runner.`);
+  })();
   return {
     provider,
     tenant_binding: context.tenant_binding,
@@ -12258,24 +12602,253 @@ async function serveStdio(options = {}) {
     process.once("SIGTERM", close);
   });
 }
+function resolveHttpSecurity(config, options, host, env, usesSessionAuth) {
+  const configured = config.http_security;
+  const loopback = isLoopbackHost(host);
+  if (options.devNoAuth && !loopback) {
+    throw new McpRuntimeError("HTTP_DEV_NO_AUTH_UNSAFE_HOST", "--dev-no-auth is only allowed with localhost or 127.0.0.1.");
+  }
+  const deployment = configured?.deployment ?? (loopback ? "loopback" : void 0);
+  if (!deployment) {
+    throw new McpRuntimeError(
+      "HTTP_REMOTE_DEPLOYMENT_REQUIRED",
+      "A non-loopback listener requires http_security.deployment single_tenant or shared."
+    );
+  }
+  if (!loopback && deployment === "loopback") {
+    throw new McpRuntimeError("HTTP_LOOPBACK_PROFILE_REMOTE", "http_security.deployment loopback cannot bind a non-loopback listener.");
+  }
+  if (deployment === "shared" && !usesSessionAuth) {
+    throw new McpRuntimeError("HTTP_SHARED_SESSION_AUTH_REQUIRED", "Shared HTTP deployment requires signed per-session http_claims identity.");
+  }
+  if (deployment !== "shared" && usesSessionAuth && !loopback) {
+    throw new McpRuntimeError("HTTP_SHARED_DEPLOYMENT_REQUIRED", "Remote http_claims identity requires http_security.deployment shared.");
+  }
+  const optionChannels = [
+    options.trustedTlsProxy ? "trusted_tls_proxy" : void 0,
+    options.unsafeAllowCleartextHttp ? "insecure_http_break_glass" : void 0
+  ].filter((value) => Boolean(value));
+  if (optionChannels.length > 1) {
+    throw new McpRuntimeError("HTTP_CHANNEL_CONFLICT", "Choose only one of trusted TLS proxy or unsafe cleartext break-glass mode.");
+  }
+  const requestedChannel = optionChannels[0] ?? configured?.channel;
+  if (options.tls && requestedChannel && requestedChannel !== "direct_tls") {
+    throw new McpRuntimeError("HTTP_CHANNEL_CONFLICT", "Runner-owned TLS cannot be combined with trusted-proxy or insecure-cleartext channel declarations.");
+  }
+  let channel;
+  if (options.tls) channel = "direct_tls";
+  else if (requestedChannel === "direct_tls") {
+    throw new McpRuntimeError("HTTP_TLS_MATERIAL_REQUIRED", "http_security.channel direct_tls requires Runner TLS certificate and key material.");
+  } else if (requestedChannel === "trusted_tls_proxy") channel = "trusted_tls_proxy";
+  else if (requestedChannel === "insecure_http_break_glass") channel = "insecure_http_break_glass";
+  else if (loopback) channel = "loopback_cleartext";
+  else {
+    throw new McpRuntimeError(
+      "HTTP_REMOTE_CLEARTEXT_REFUSED",
+      "Refusing non-loopback cleartext HTTP. Configure Runner-owned TLS, an explicit trusted TLS proxy, or --unsafe-allow-cleartext-http break glass."
+    );
+  }
+  if (options.devNoAuth && channel === "insecure_http_break_glass") {
+    throw new McpRuntimeError("HTTP_BREAK_GLASS_AUTH_REQUIRED", "Unsafe cleartext break-glass mode never disables authentication.");
+  }
+  if (options.devNoAuth && deployment !== "loopback") {
+    throw new McpRuntimeError("HTTP_DEV_NO_AUTH_PROFILE_INVALID", "--dev-no-auth is valid only for a loopback development deployment.");
+  }
+  const activeTokenEnv = options.authTokenEnv ?? configured?.static_token?.active_env ?? "SYNAPSOR_RUNNER_HTTP_TOKEN";
+  const previousTokenEnv = options.previousAuthTokenEnv ?? configured?.static_token?.previous_env;
+  if (previousTokenEnv && previousTokenEnv === activeTokenEnv) {
+    throw new McpRuntimeError("HTTP_TOKEN_ENV_REUSED", "Active and previous HTTP token environment variables must be different.");
+  }
+  const activeToken = options.devNoAuth || usesSessionAuth ? void 0 : envValue(env, activeTokenEnv);
+  const previousToken = options.devNoAuth || usesSessionAuth || !previousTokenEnv ? void 0 : envValue(env, previousTokenEnv);
+  if (!options.devNoAuth && !usesSessionAuth && !activeToken) {
+    throw new McpRuntimeError("HTTP_AUTH_TOKEN_MISSING", `${activeTokenEnv} is not set. HTTP MCP requires bearer auth by default.`);
+  }
+  if (previousTokenEnv && !usesSessionAuth && !options.devNoAuth && !previousToken) {
+    throw new McpRuntimeError("HTTP_PREVIOUS_AUTH_TOKEN_MISSING", `${previousTokenEnv} is configured for rotation but is not set.`);
+  }
+  if (activeToken && previousToken && constantTimeTokenEquals(activeToken, previousToken)) {
+    throw new McpRuntimeError("HTTP_TOKEN_ROTATION_DUPLICATE", "Active and previous HTTP endpoint tokens must differ.");
+  }
+  const weakStaticToken = Boolean(activeToken && !strongOpaqueToken(activeToken)) || Boolean(previousToken && !strongOpaqueToken(previousToken));
+  if (!loopback && !usesSessionAuth && weakStaticToken) {
+    throw new McpRuntimeError("HTTP_AUTH_TOKEN_WEAK", "Non-loopback static endpoint tokens must contain at least 32 bytes of high-entropy secret material.");
+  }
+  const configuredOrigins = configured?.allowed_origins ?? [];
+  const allowedOrigins = new Set(configuredOrigins);
+  if (options.corsOrigin) {
+    if (!isExactHttpOrigin2(options.corsOrigin)) {
+      throw new McpRuntimeError("HTTP_CORS_ORIGIN_INVALID", "--cors-origin must be one exact HTTP(S) origin; wildcards, paths, credentials, query, and fragments are forbidden.");
+    }
+    allowedOrigins.add(options.corsOrigin);
+  }
+  const allowedHosts = configured?.allowed_hosts?.map((value) => value.toLowerCase()) ?? defaultAllowedHosts(host);
+  if (!loopback && allowedHosts.length === 0) {
+    throw new McpRuntimeError("HTTP_ALLOWED_HOSTS_REQUIRED", "Non-loopback HTTP requires http_security.allowed_hosts with exact public/direct Host authorities.");
+  }
+  const rawLimits = configured?.limits;
+  const limits = {
+    maxRequestBytes: rawLimits?.max_request_bytes ?? 1048576,
+    maxHeaderBytes: rawLimits?.max_header_bytes ?? 16384,
+    maxSessions: rawLimits?.max_sessions ?? 1024,
+    sessionIdleTimeoutMs: (rawLimits?.session_idle_timeout_seconds ?? 900) * 1e3,
+    requestTimeoutMs: rawLimits?.request_timeout_ms ?? 3e4,
+    headersTimeoutMs: rawLimits?.headers_timeout_ms ?? 1e4,
+    keepAliveTimeoutMs: rawLimits?.keep_alive_timeout_ms ?? 5e3,
+    maxConnections: rawLimits?.max_connections ?? 2048
+  };
+  const oauth = configured?.oauth_resource ? resolveOauthResource(configured.oauth_resource) : void 0;
+  if (deployment === "shared") {
+    if (!oauth) throw new McpRuntimeError("HTTP_OAUTH_RESOURCE_REQUIRED", "Shared HTTP deployment requires RFC 9728 protected-resource metadata.");
+    const auth = config.session_auth;
+    if (!auth?.issuer || !auth.audience) {
+      throw new McpRuntimeError("HTTP_JWT_ISSUER_AUDIENCE_REQUIRED", "Shared HTTP deployment requires exact session_auth issuer and audience/resource.");
+    }
+    if (auth.audience !== configured?.oauth_resource?.resource) {
+      throw new McpRuntimeError("HTTP_RESOURCE_AUDIENCE_MISMATCH", "session_auth.audience must exactly match http_security.oauth_resource.resource.");
+    }
+  }
+  return {
+    deployment,
+    channel,
+    activeToken,
+    previousToken,
+    activeTokenEnv,
+    previousTokenEnv,
+    weakStaticToken,
+    allowedOrigins,
+    allowedHosts,
+    limits,
+    oauth
+  };
+}
+function resolveOauthResource(input) {
+  const resource = new URL(input.resource);
+  const pathname = resource.pathname === "/" ? "" : resource.pathname.replace(/\/$/, "");
+  const metadataPath = `/.well-known/oauth-protected-resource${pathname}`;
+  const metadataUrl = new URL(metadataPath || "/.well-known/oauth-protected-resource", resource.origin).toString();
+  const metadata = OAuthProtectedResourceMetadataSchema.parse({
+    resource: input.resource,
+    authorization_servers: input.authorization_servers,
+    ...input.scopes_supported ? { scopes_supported: input.scopes_supported } : {},
+    bearer_methods_supported: ["header"],
+    ...input.resource_name ? { resource_name: input.resource_name } : {},
+    ...input.resource_documentation ? { resource_documentation: input.resource_documentation } : {}
+  });
+  return { metadata, metadataUrl, metadataPath, requiredScopes: input.required_scopes ?? [] };
+}
+function defaultAllowedHosts(host) {
+  if (!isLoopbackHost(host)) {
+    return host === "0.0.0.0" || host === "::" ? [] : [host.toLowerCase()];
+  }
+  return ["localhost", "127.0.0.1", "[::1]", host.toLowerCase()];
+}
+function applyHttpServerLimits(server, limits) {
+  server.requestTimeout = limits.requestTimeoutMs;
+  server.headersTimeout = limits.headersTimeoutMs;
+  server.keepAliveTimeout = limits.keepAliveTimeoutMs;
+  server.maxConnections = limits.maxConnections;
+}
+function validateTlsMaterial(tls) {
+  if (!tls) return;
+  try {
+    createSecureContext({ cert: tls.cert, key: tls.key, ca: tls.ca });
+  } catch {
+    throw new McpRuntimeError("HTTP_TLS_MATERIAL_INVALID", "HTTP TLS certificate, private key, or CA material is invalid.");
+  }
+}
+function validateHttpRequestSecurity(request, response, security) {
+  if ((request.url?.length ?? 0) > 8192) {
+    writeJson(response, 414, { ok: false, error: "uri_too_long" });
+    return false;
+  }
+  const host = headerValue(request.headers.host);
+  if (!host || !hostAllowed(host, security.allowedHosts)) {
+    writeJson(response, 403, { ok: false, error: "host_forbidden" });
+    return false;
+  }
+  const origin = headerValue(request.headers.origin);
+  if (origin && !security.allowedOrigins.has(origin)) {
+    writeJson(response, 403, { ok: false, error: "origin_forbidden" });
+    return false;
+  }
+  setHttpSecurityHeaders(response);
+  if (origin) setCorsHeaders(response, origin);
+  return true;
+}
+function hostAllowed(rawHost, allowedHosts) {
+  const actual = parseHostAuthority(rawHost);
+  if (!actual) return false;
+  return allowedHosts.some((allowed) => {
+    const expected = parseHostAuthority(allowed);
+    if (!expected || expected.hostname !== actual.hostname) return false;
+    return expected.port ? expected.port === actual.port : true;
+  });
+}
+function parseHostAuthority(value) {
+  if (!value || value !== value.trim() || /[\s,/?#\\]/.test(value)) return void 0;
+  try {
+    const parsed = new URL(`http://${value}`);
+    if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) return void 0;
+    return { hostname: parsed.hostname.toLowerCase(), port: parsed.port };
+  } catch {
+    return void 0;
+  }
+}
+function isExactHttpOrigin2(value) {
+  if (value === "*" || value === "null") return false;
+  try {
+    const origin = new URL(value);
+    return (origin.protocol === "http:" || origin.protocol === "https:") && !origin.username && !origin.password && origin.pathname === "/" && !origin.search && !origin.hash && origin.origin === value;
+  } catch {
+    return false;
+  }
+}
+function setHttpSecurityHeaders(response) {
+  response.setHeader("cache-control", "no-store");
+  response.setHeader("x-content-type-options", "nosniff");
+  response.setHeader("referrer-policy", "no-referrer");
+}
+function strongOpaqueToken(token) {
+  if (Buffer.byteLength(token, "utf8") < 32) return false;
+  if (new Set(token).size < 12) return false;
+  return !/^(.)\1+$/.test(token) && !/(?:password|secret|token|changeme|example|development)/i.test(token);
+}
+function httpAuthChallenge(security, insufficientScope = false) {
+  const parts = ["Bearer"];
+  if (insufficientScope) parts.push('error="insufficient_scope"');
+  if (security.oauth) {
+    parts.push(`resource_metadata="${security.oauth.metadataUrl}"`);
+    if (security.oauth.requiredScopes.length) parts.push(`scope="${security.oauth.requiredScopes.join(" ")}"`);
+  }
+  return parts.join(" ");
+}
+function maybeServeOauthMetadata(request, response, security, pathname) {
+  if (!security.oauth || request.method !== "GET") return false;
+  if (pathname !== security.oauth.metadataPath && pathname !== "/.well-known/oauth-protected-resource") return false;
+  writeJson(response, 200, security.oauth.metadata);
+  return true;
+}
+function writeAuthenticationFailure(response, security, status, error) {
+  response.setHeader("www-authenticate", httpAuthChallenge(security, status === 403));
+  writeJson(response, status, { ok: false, error });
+}
 async function startHttpMcpServer(options = {}) {
   const host = options.host ?? "127.0.0.1";
   const port = options.port ?? 8765;
-  const authTokenEnv = options.authTokenEnv ?? "SYNAPSOR_RUNNER_HTTP_TOKEN";
   const env = options.env ?? process.env;
   const devNoAuth = options.devNoAuth === true;
   const config = resolveRuntimeConfig(options.config ?? loadRuntimeConfigFromFile(options.configPath));
-  const metricsAccess = resolveMetricsEndpointAccess(config, env, host);
-  if (devNoAuth && !isLoopbackHost(host)) {
-    throw new McpRuntimeError("HTTP_DEV_NO_AUTH_UNSAFE_HOST", "--dev-no-auth is only allowed with localhost or 127.0.0.1.");
-  }
+  assertValidRunnerCapabilityConfig(config);
   if (configUsesHttpClaims(config)) {
     throw new McpRuntimeError("HTTP_CLAIMS_REQUIRES_STREAMABLE", "http_claims trusted context requires spec MCP Streamable HTTP sessions; the legacy JSON-RPC bridge cannot bind per-session context.");
   }
-  const authToken = devNoAuth ? void 0 : envValue(env, authTokenEnv);
-  if (!devNoAuth && !authToken) {
-    throw new McpRuntimeError("HTTP_AUTH_TOKEN_MISSING", `${authTokenEnv} is not set. HTTP MCP requires bearer auth by default.`);
+  const security = resolveHttpSecurity(config, options, host, env, false);
+  const metricsAccess = resolveMetricsEndpointAccess(config, env, host);
+  if (options.tls?.requestClientCert && !options.tls.ca) {
+    throw new McpRuntimeError("MTLS_CA_REQUIRED", "HTTP mTLS requires a CA bundle when client certificates are required.");
   }
+  validateTlsMaterial(options.tls);
   const cloudTools = config.mode === "cloud" ? await fetchCloudToolMetadata(config, env) : void 0;
   if (options.readRow && Object.values(config.sources ?? {}).some((source) => source.database_scope?.mode === "postgres_rls")) {
     throw new McpRuntimeError("POSTGRES_RLS_CUSTOM_READER_UNVERIFIED", "Hardened postgres_rls mode requires Runner's verified PostgreSQL reader; a custom readRow cannot be attested by the stock server.");
@@ -12290,19 +12863,27 @@ async function startHttpMcpServer(options = {}) {
     cloudTools
   });
   const readinessCheck = options.readinessCheck ?? (() => checkRunnerReadiness(config, env));
-  const server = createServer((request, response) => {
+  const requestHandler = (request, response) => {
     void handleHttpMcpRequest({
       request,
       response,
       runtime,
-      authToken,
       devNoAuth,
-      corsOrigin: options.corsOrigin,
+      security,
       readinessCheck,
       metricsAccess,
       metricsProvider: () => renderRuntimeMetrics(runtime.store, runtime.poolMetrics(), runtime.rateLimitMetrics(), readinessCheck)
     });
-  });
+  };
+  const server = options.tls ? createHttpsServer({
+    cert: options.tls.cert,
+    key: options.tls.key,
+    ca: options.tls.ca,
+    requestCert: options.tls.requestClientCert === true,
+    rejectUnauthorized: options.tls.requestClientCert === true,
+    maxHeaderSize: security.limits.maxHeaderBytes
+  }, requestHandler) : createServer({ maxHeaderSize: security.limits.maxHeaderBytes }, requestHandler);
+  applyHttpServerLimits(server, security.limits);
   try {
     await new Promise((resolve2, reject) => {
       server.once("error", reject);
@@ -12318,13 +12899,19 @@ async function startHttpMcpServer(options = {}) {
   const address = server.address();
   const actualHost = address.address === "::" ? host : address.address;
   const actualPort = address.port;
-  const url = `http://${actualHost}:${actualPort}/mcp`;
+  const scheme = options.tls ? "https" : "http";
+  const url = `${scheme}://${actualHost}:${actualPort}/mcp`;
   if (options.log !== false) {
     const log = options.log ?? process.stderr;
     log.write(`Synapsor Runner HTTP MCP listening on ${url}
 `);
-    log.write(devNoAuth ? "Auth: disabled for localhost development only\n" : `Auth: bearer token from ${authTokenEnv}
+    log.write(`Channel: ${security.channel}; deployment: ${security.deployment}
+`);
+    if (options.tls) log.write(options.tls.requestClientCert ? "TLS: enabled, client certificates required in addition to Bearer auth\n" : "TLS: enabled\n");
+    log.write(devNoAuth ? "Auth: disabled for loopback development only\n" : `Auth: opaque Bearer endpoint token from ${security.activeTokenEnv}${security.previousTokenEnv ? `; previous rotation token from ${security.previousTokenEnv}` : ""}
 `);
+    if (security.weakStaticToken) log.write("Auth warning: loopback endpoint token is shorter or more predictable than the production requirement; generate at least 32 random bytes.\n");
+    if (security.channel === "insecure_http_break_glass") log.write("SECURITY WARNING: remote Bearer traffic is using explicit insecure cleartext break glass. Credentials and data can be intercepted.\n");
     log.write(`Config: ${options.configPath ?? "synapsor.runner.json"}
 `);
     log.write(`Store: ${options.storePath ?? config.storage?.sqlite_path ?? "./.synapsor/local.db"}
@@ -12340,29 +12927,23 @@ async function startHttpMcpServer(options = {}) {
 async function startStreamableHttpMcpServer(options = {}) {
   const host = options.host ?? "127.0.0.1";
   const port = options.port ?? 8766;
-  const authTokenEnv = options.authTokenEnv ?? "SYNAPSOR_RUNNER_HTTP_TOKEN";
   const env = options.env ?? process.env;
   const devNoAuth = options.devNoAuth === true;
   const config = resolveRuntimeConfig(options.config ?? loadRuntimeConfigFromFile(options.configPath));
   assertValidRunnerCapabilityConfig(config);
   const usesSessionAuth = configUsesHttpClaims(config);
+  const security = resolveHttpSecurity(config, options, host, env, usesSessionAuth);
   const metricsAccess = resolveMetricsEndpointAccess(config, env, host);
-  if (devNoAuth && !isLoopbackHost(host)) {
-    throw new McpRuntimeError("HTTP_DEV_NO_AUTH_UNSAFE_HOST", "--dev-no-auth is only allowed with localhost or 127.0.0.1.");
-  }
   if (devNoAuth && usesSessionAuth) {
     throw new McpRuntimeError("HTTP_CLAIMS_AUTH_REQUIRED", "http_claims trusted context cannot run with --dev-no-auth.");
   }
-  const authToken = devNoAuth || usesSessionAuth ? void 0 : envValue(env, authTokenEnv);
-  if (!devNoAuth && !usesSessionAuth && !authToken) {
-    throw new McpRuntimeError("HTTP_AUTH_TOKEN_MISSING", `${authTokenEnv} is not set. Streamable HTTP MCP requires bearer auth by default.`);
-  }
   assertRuntimeStoreStartupReady(config, env);
   const sessionVerifier = usesSessionAuth ? sessionAuthVerifier(config, env, options.configPath ? path2.dirname(path2.resolve(options.configPath)) : process.cwd()) : void 0;
   const readinessCheck = options.readinessCheck ?? (() => checkRunnerReadiness(config, env));
   if (options.tls?.requestClientCert && !options.tls.ca) {
     throw new McpRuntimeError("MTLS_CA_REQUIRED", "Streamable HTTP mTLS requires a CA bundle when client certificates are required.");
   }
+  validateTlsMaterial(options.tls);
   const cloudTools = config.mode === "cloud" ? await fetchCloudToolMetadata(config, env) : void 0;
   if (options.readRow && Object.values(config.sources ?? {}).some((source) => source.database_scope?.mode === "postgres_rls")) {
     throw new McpRuntimeError("POSTGRES_RLS_CUSTOM_READER_UNVERIFIED", "Hardened postgres_rls mode requires Runner's verified PostgreSQL reader; a custom readRow cannot be attested by the stock server.");
@@ -12375,6 +12956,7 @@ async function startStreamableHttpMcpServer(options = {}) {
   const sharedResources = createMcpRuntimeSharedResources(config, env, options.readRow, Date.now, options.credentialResolver);
   const sessions = /* @__PURE__ */ new Map();
   const openSessions = /* @__PURE__ */ new Set();
+  const initializingSessions = { count: 0 };
   const requestHandler = (request, response) => {
     void handleStreamableHttpMcpRequest({
       request,
@@ -12387,12 +12969,12 @@ async function startStreamableHttpMcpServer(options = {}) {
       env,
       toolNameStyle: options.toolNameStyle,
       resultFormat: options.resultFormat,
-      authToken,
       sessionVerifier,
       devNoAuth,
-      corsOrigin: options.corsOrigin,
+      security,
       sessions,
       openSessions,
+      initializingSessions,
       readinessCheck,
       metricsAccess,
       metricsProvider: () => renderRuntimeMetrics(sharedStore, sharedResources.poolMetrics(), sharedResources.rateLimitMetrics(), readinessCheck)
@@ -12403,8 +12985,14 @@ async function startStreamableHttpMcpServer(options = {}) {
     key: options.tls.key,
     ca: options.tls.ca,
     requestCert: options.tls.requestClientCert === true,
-    rejectUnauthorized: options.tls.requestClientCert === true
-  }, requestHandler) : createServer(requestHandler);
+    rejectUnauthorized: options.tls.requestClientCert === true,
+    maxHeaderSize: security.limits.maxHeaderBytes
+  }, requestHandler) : createServer({ maxHeaderSize: security.limits.maxHeaderBytes }, requestHandler);
+  applyHttpServerLimits(server, security.limits);
+  const sessionReaper = setInterval(() => {
+    void pruneExpiredStreamableSessions(sessions, openSessions, security.limits.sessionIdleTimeoutMs, Date.now());
+  }, Math.min(3e4, Math.max(1e3, Math.floor(security.limits.sessionIdleTimeoutMs / 2))));
+  sessionReaper.unref?.();
   try {
     await new Promise((resolve2, reject) => {
       server.once("error", reject);
@@ -12414,6 +13002,7 @@ async function startStreamableHttpMcpServer(options = {}) {
       });
     });
   } catch (error) {
+    clearInterval(sessionReaper);
     await cloudSynchronizer?.stop();
     await closeStreamableSessions(openSessions);
     await sharedResources.close();
@@ -12429,10 +13018,16 @@ async function startStreamableHttpMcpServer(options = {}) {
     const log = options.log ?? process.stderr;
     log.write(`Synapsor Runner Streamable HTTP MCP listening on ${url}
 `);
-    if (options.tls) log.write(options.tls.requestClientCert ? "TLS: enabled, client certificates required\n" : "TLS: enabled\n");
-    log.write(devNoAuth ? "Auth: disabled for localhost development only\n" : usesSessionAuth ? `Auth: signed per-session JWT (${config.session_auth?.provider})
-` : `Auth: bearer token from ${authTokenEnv}
+    log.write(`Channel: ${security.channel}; deployment: ${security.deployment}
+`);
+    if (options.tls) log.write(options.tls.requestClientCert ? "TLS: enabled, client certificates required in addition to Bearer auth\n" : "TLS: enabled\n");
+    log.write(devNoAuth ? "Auth: disabled for localhost development only\n" : usesSessionAuth ? `Auth: signed per-session JWT (${config.session_auth?.provider}); issuer and resource checked on every request
+` : `Auth: opaque Bearer endpoint token from ${security.activeTokenEnv}${security.previousTokenEnv ? `; previous rotation token from ${security.previousTokenEnv}` : ""}
 `);
+    if (security.oauth) log.write(`OAuth resource metadata: ${security.oauth.metadataUrl}
+`);
+    if (security.weakStaticToken) log.write("Auth warning: loopback endpoint token is shorter or more predictable than the production requirement; generate at least 32 random bytes.\n");
+    if (security.channel === "insecure_http_break_glass") log.write("SECURITY WARNING: remote Bearer traffic is using explicit insecure cleartext break glass. Credentials and data can be intercepted.\n");
     for (const assurance of describeIsolationAssurance(config)) {
       log.write(`Isolation ${assurance.source}: ${assurance.mode}; trusted context: ${assurance.trusted_context.request_binding}
 `);
@@ -12448,19 +13043,23 @@ async function startStreamableHttpMcpServer(options = {}) {
     host: actualHost,
     port: actualPort,
     url,
-    close: () => closeStreamableHttpServer(server, openSessions, sharedResources, sharedStore, cloudSynchronizer)
+    close: () => {
+      clearInterval(sessionReaper);
+      return closeStreamableHttpServer(server, openSessions, sharedResources, sharedStore, cloudSynchronizer);
+    }
   };
 }
 async function handleStreamableHttpMcpRequest(input) {
-  const { request, response, config, storePath, sharedStore, sharedResources, cloudTools, env, toolNameStyle, resultFormat, authToken, sessionVerifier, devNoAuth, corsOrigin, sessions, openSessions, readinessCheck, metricsAccess, metricsProvider } = input;
+  const { request, response, config, storePath, sharedStore, sharedResources, cloudTools, env, toolNameStyle, resultFormat, sessionVerifier, devNoAuth, security, sessions, openSessions, initializingSessions, readinessCheck, metricsAccess, metricsProvider } = input;
   try {
-    setCorsHeaders(response, corsOrigin);
-    if (request.method === "OPTIONS" && corsOrigin) {
+    if (!validateHttpRequestSecurity(request, response, security)) return;
+    if (request.method === "OPTIONS" && request.headers.origin) {
       response.statusCode = 204;
       response.end();
       return;
     }
     const url = new URL(request.url ?? "/", "http://localhost");
+    if (maybeServeOauthMetadata(request, response, security, url.pathname)) return;
     if (request.method === "GET" && url.pathname === "/healthz") {
       writeJson(response, 200, {
         ok: true,
@@ -12482,11 +13081,13 @@ async function handleStreamableHttpMcpRequest(input) {
       writeJson(response, 404, { ok: false, error: "not_found" });
       return;
     }
-    const authentication = await authenticateStreamableRequest(config, request.headers.authorization, sessionVerifier, authToken, devNoAuth);
-    if (!authentication) {
-      writeJson(response, 401, { ok: false, error: "unauthorized" });
+    const authResult = await authenticateStreamableRequest(config, request.headers.authorization, sessionVerifier, security, devNoAuth);
+    if (!authResult.ok) {
+      writeAuthenticationFailure(response, security, authResult.status, authResult.error);
       return;
     }
+    const authentication = authResult.authentication;
+    await pruneExpiredStreamableSessions(sessions, openSessions, security.limits.sessionIdleTimeoutMs, Date.now());
     const sessionId = headerValue(request.headers["mcp-session-id"]);
     if (sessionId) {
       const existing = sessions.get(sessionId);
@@ -12495,9 +13096,10 @@ async function handleStreamableHttpMcpRequest(input) {
         return;
       }
       if (existing.authFingerprint !== authentication.fingerprint) {
-        writeJson(response, 401, { ok: false, error: "session_auth_mismatch" });
+        writeAuthenticationFailure(response, security, 401, "unauthorized");
         return;
       }
+      existing.lastSeenAt = Date.now();
       await existing.transport.handleRequest(request, response);
       return;
     }
@@ -12505,54 +13107,73 @@ async function handleStreamableHttpMcpRequest(input) {
       writeJson(response, 400, jsonRpcError(null, -32e3, "MCP initialize request is required before using this Streamable HTTP session."));
       return;
     }
-    const parsedBody = JSON.parse(await readRequestBody(request));
-    if (!containsInitializeRequest(parsedBody)) {
-      writeJson(response, 400, jsonRpcError(requestIdFromPayload(parsedBody), -32e3, "First Streamable HTTP MCP request must be initialize."));
+    if (openSessions.size + initializingSessions.count >= security.limits.maxSessions) {
+      response.setHeader("retry-after", "1");
+      writeJson(response, 503, { ok: false, error: "session_capacity_exhausted", retryable: true, retry_after_ms: 1e3 });
       return;
     }
-    let session;
-    const transport = new StreamableHTTPServerTransport({
-      sessionIdGenerator: () => crypto3.randomUUID(),
-      onsessioninitialized: (newSessionId) => {
-        if (session) {
-          session.sessionId = newSessionId;
-          sessions.set(newSessionId, session);
-        }
-      },
-      onsessionclosed: (closedSessionId) => {
-        const closed = sessions.get(closedSessionId);
-        if (closed) {
-          disposeStreamableSession(closed, sessions, openSessions);
+    initializingSessions.count += 1;
+    let initializingSession;
+    try {
+      const parsedBody = JSON.parse(await readRequestBody(request, security.limits.maxRequestBytes));
+      if (!containsInitializeRequest(parsedBody)) {
+        writeJson(response, 400, jsonRpcError(requestIdFromPayload(parsedBody), -32e3, "First Streamable HTTP MCP request must be initialize."));
+        return;
+      }
+      const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: () => crypto3.randomUUID(),
+        onsessioninitialized: (newSessionId) => {
+          if (initializingSession) {
+            initializingSession.sessionId = newSessionId;
+            sessions.set(newSessionId, initializingSession);
+          }
+        },
+        onsessionclosed: (closedSessionId) => {
+          const closed = sessions.get(closedSessionId);
+          if (closed) {
+            disposeStreamableSession(closed, sessions, openSessions);
+          }
         }
+      });
+      const runtime = createMcpRuntime(config, {
+        env,
+        storePath,
+        store: sharedStore,
+        sharedResources,
+        resultFormat,
+        cloudTools,
+        trustedContext: authentication.context
+      });
+      initializingSession = { transport, runtime, authFingerprint: authentication.fingerprint, lastSeenAt: Date.now() };
+      openSessions.add(initializingSession);
+      transport.onclose = () => {
+        if (initializingSession) disposeStreamableSession(initializingSession, sessions, openSessions);
+      };
+      await createSynapsorMcpServer(runtime, { toolNameStyle }).connect(transport);
+      await transport.handleRequest(request, response, parsedBody);
+    } catch (error) {
+      if (initializingSession) {
+        disposeStreamableSession(initializingSession, sessions, openSessions);
+        await initializingSession.transport.close().catch(() => void 0);
       }
-    });
-    const runtime = createMcpRuntime(config, {
-      env,
-      storePath,
-      store: sharedStore,
-      sharedResources,
-      resultFormat,
-      cloudTools,
-      trustedContext: authentication.context
-    });
-    session = { transport, runtime, authFingerprint: authentication.fingerprint };
-    openSessions.add(session);
-    transport.onclose = () => {
-      if (session) disposeStreamableSession(session, sessions, openSessions);
-    };
-    await createSynapsorMcpServer(runtime, { toolNameStyle }).connect(transport);
-    await transport.handleRequest(request, response, parsedBody);
+      throw error;
+    } finally {
+      initializingSessions.count -= 1;
+    }
   } catch (error) {
-    const message2 = sanitizeHttpError(error, authToken);
-    if (!response.headersSent) writeJson(response, 200, jsonRpcError(null, -32e3, message2));
+    const message2 = sanitizeHttpError(error, security.activeToken, security.previousToken);
+    if (!response.headersSent && error instanceof McpRuntimeError && error.code === "HTTP_BODY_TOO_LARGE") {
+      writeJson(response, 413, { ok: false, error: "request_too_large" });
+    } else if (!response.headersSent) writeJson(response, 200, jsonRpcError(null, -32e3, message2));
     else response.end();
   }
 }
 async function handleHttpMcpRequest(input) {
-  const { request, response, runtime, authToken, devNoAuth, corsOrigin, readinessCheck, metricsAccess, metricsProvider } = input;
+  const { request, response, runtime, devNoAuth, security, readinessCheck, metricsAccess, metricsProvider } = input;
   try {
-    setCommonHttpHeaders(response, corsOrigin);
-    if (request.method === "OPTIONS" && corsOrigin) {
+    setCommonHttpHeaders(response);
+    if (!validateHttpRequestSecurity(request, response, security)) return;
+    if (request.method === "OPTIONS" && request.headers.origin) {
       response.statusCode = 204;
       response.end();
       return;
@@ -12583,13 +13204,13 @@ async function handleHttpMcpRequest(input) {
       writeJson(response, 405, { ok: false, error: "method_not_allowed" });
       return;
     }
-    if (!devNoAuth && !validBearerToken(request.headers.authorization, authToken ?? "")) {
-      writeJson(response, 401, { ok: false, error: "unauthorized" });
+    if (!devNoAuth && !validBearerTokens(request.headers.authorization, [security.activeToken, security.previousToken])) {
+      writeAuthenticationFailure(response, security, 401, "unauthorized");
       return;
     }
-    const body = await readRequestBody(request);
+    const body = await readRequestBody(request, security.limits.maxRequestBytes);
     const payload = JSON.parse(body);
-    if (!isRecord4(payload)) {
+    if (!isRecord5(payload)) {
       writeJson(response, 400, jsonRpcError(null, -32600, "JSON-RPC request must be an object."));
       return;
     }
@@ -12599,15 +13220,18 @@ async function handleHttpMcpRequest(input) {
       writeJson(response, 400, jsonRpcError(id, -32600, "JSON-RPC method is required."));
       return;
     }
-    const result = await handleHttpJsonRpcMethod(runtime, method, isRecord4(payload.params) ? payload.params : {});
+    const result = await handleHttpJsonRpcMethod(runtime, method, isRecord5(payload.params) ? payload.params : {});
     writeJson(response, 200, {
       jsonrpc: "2.0",
       id,
-      result: sanitizeHttpPayload(result, authToken)
+      result: sanitizeHttpPayload(result, security.activeToken, security.previousToken)
     });
   } catch (error) {
-    const message2 = sanitizeHttpError(error, authToken);
-    writeJson(response, 200, jsonRpcError(null, -32e3, message2));
+    const message2 = sanitizeHttpError(error, security.activeToken, security.previousToken);
+    if (!response.headersSent && error instanceof McpRuntimeError && error.code === "HTTP_BODY_TOO_LARGE") {
+      writeJson(response, 413, { ok: false, error: "request_too_large" });
+    } else if (!response.headersSent) writeJson(response, 200, jsonRpcError(null, -32e3, message2));
+    else response.end();
   }
 }
 async function handleHttpJsonRpcMethod(runtime, method, params) {
@@ -12619,7 +13243,7 @@ async function handleHttpJsonRpcMethod(runtime, method, params) {
   if (method === "tools/call") {
     const name = typeof params.name === "string" ? params.name : void 0;
     if (!name) throw new McpRuntimeError("HTTP_TOOL_NAME_REQUIRED", "tools/call requires params.name.");
-    const args = isRecord4(params.arguments) ? params.arguments : isRecord4(params.args) ? params.args : {};
+    const args = isRecord5(params.arguments) ? params.arguments : isRecord5(params.args) ? params.args : {};
     return await toolCallResult(runtime, name, args);
   }
   if (method === "resources/read") {
@@ -12649,11 +13273,21 @@ function httpToolMetadata(tool) {
   };
 }
 function validBearerToken(header, expected) {
-  if (!header?.startsWith("Bearer ")) return false;
-  const actual = header.slice("Bearer ".length);
-  const actualBuffer = Buffer.from(actual);
-  const expectedBuffer = Buffer.from(expected);
-  return actualBuffer.length === expectedBuffer.length && crypto3.timingSafeEqual(actualBuffer, expectedBuffer);
+  return validBearerTokens(header, [expected]);
+}
+function validBearerTokens(header, expected) {
+  const actual = bearerToken(header);
+  if (!actual) return false;
+  let matched = 0;
+  for (const candidate of expected.filter((value) => Boolean(value))) {
+    matched |= Number(constantTimeTokenEquals(actual, candidate));
+  }
+  return matched === 1;
+}
+function constantTimeTokenEquals(actual, expected) {
+  const actualDigest = crypto3.createHash("sha256").update(actual, "utf8").digest();
+  const expectedDigest = crypto3.createHash("sha256").update(expected, "utf8").digest();
+  return crypto3.timingSafeEqual(actualDigest, expectedDigest);
 }
 function resolveMetricsEndpointAccess(config, env, host) {
   if (config.metrics?.enabled !== true) return { enabled: false };
@@ -12760,12 +13394,12 @@ async function checkRunnerReadiness(config, env = process.env, timeoutMs = 3e3)
       if (!executorName || checkedExecutors.has(executorName)) continue;
       checkedExecutors.add(executorName);
       components.push(await readinessComponent(`executor:${executorName}`, "EXECUTOR_READY", "EXECUTOR_UNAVAILABLE", timeoutMs, async () => {
-        const executor = isRecord4(config.executors?.[executorName]) ? config.executors?.[executorName] : void 0;
+        const executor = isRecord5(config.executors?.[executorName]) ? config.executors?.[executorName] : void 0;
         if (!executor) throw new Error("executor missing");
         if (executor.type === "http_handler") {
           if (typeof executor.url_env !== "string" || !envValue(env, executor.url_env)) throw new Error("handler URL unavailable");
           const handlerUrl = envValue(env, executor.url_env);
-          const auth = isRecord4(executor.auth) ? executor.auth : void 0;
+          const auth = isRecord5(executor.auth) ? executor.auth : void 0;
           if (auth?.type === "bearer_env" && (typeof auth.token_env !== "string" || !envValue(env, auth.token_env))) throw new Error("handler token unavailable");
           const response = await fetch(handlerUrl, {
             method: "HEAD",
@@ -12858,20 +13492,25 @@ function sessionAuthVerifier(config, env, baseDir) {
     throw new McpRuntimeError("SESSION_AUTH_INVALID", message2);
   }
 }
-async function authenticateStreamableRequest(config, authorization, sessionVerifier, staticToken, devNoAuth) {
-  if (devNoAuth) return { fingerprint: "dev-no-auth" };
+async function authenticateStreamableRequest(config, authorization, sessionVerifier, security, devNoAuth) {
+  if (devNoAuth) return { ok: true, authentication: { fingerprint: "dev-no-auth" } };
   const token = bearerToken(authorization);
-  if (!token) return void 0;
+  if (!token) return { ok: false, status: 401, error: "unauthorized" };
   if (!configUsesHttpClaims(config)) {
-    if (!staticToken || !validBearerToken(authorization, staticToken)) return void 0;
-    return { fingerprint: tokenFingerprint(token) };
+    if (!validBearerTokens(authorization, [security.activeToken, security.previousToken])) {
+      return { ok: false, status: 401, error: "unauthorized" };
+    }
+    return { ok: true, authentication: { fingerprint: tokenFingerprint(token) } };
   }
   try {
-    if (!sessionVerifier) return void 0;
+    if (!sessionVerifier) return { ok: false, status: 401, error: "unauthorized" };
     const context = await verifySessionJwt(config, token, sessionVerifier);
-    return { fingerprint: tokenFingerprint(token), context };
-  } catch {
-    return void 0;
+    return { ok: true, authentication: { fingerprint: tokenFingerprint(token), context } };
+  } catch (error) {
+    if (error instanceof McpRuntimeError && error.code === "HTTP_INSUFFICIENT_SCOPE") {
+      return { ok: false, status: 403, error: "insufficient_scope" };
+    }
+    return { ok: false, status: 401, error: "unauthorized" };
   }
 }
 async function verifySessionJwt(config, token, verifier) {
@@ -12881,12 +13520,34 @@ async function verifySessionJwt(config, token, verifier) {
   const tenant = safeSessionClaim(claims[auth.tenant_claim ?? "tenant_id"]);
   const principal = safeSessionClaim(claims[auth.principal_claim ?? "sub"]);
   if (!tenant || !principal) throw new Error("JWT trusted context claims are missing or unsafe");
+  const requiredScopes = config.http_security?.oauth_resource?.required_scopes ?? [];
+  if (requiredScopes.length > 0) {
+    const granted = safeJwtScopes(claims.scope, claims.scp);
+    if (!requiredScopes.every((scope) => granted.has(scope))) {
+      throw new McpRuntimeError("HTTP_INSUFFICIENT_SCOPE", "JWT does not grant the required MCP resource scope.");
+    }
+  }
   return { tenant_id: tenant, principal, provenance: "http_claims" };
 }
 function bearerToken(header) {
-  if (!header?.startsWith("Bearer ")) return void 0;
-  const token = header.slice("Bearer ".length).trim();
-  return token || void 0;
+  const match = /^Bearer[ \t]+([^\s,]+)$/i.exec(header ?? "");
+  const token = match?.[1];
+  return token && token.length <= 16384 ? token : void 0;
+}
+function safeJwtScopes(scope, scp) {
+  const values = [];
+  if (typeof scope === "string" && scope.length <= 8192 && !/[\u0000-\u001f\u007f]/.test(scope)) {
+    values.push(...scope.split(/\s+/).filter(Boolean));
+  } else if (scope !== void 0) {
+    throw new Error("JWT scope claim is unsafe");
+  }
+  if (Array.isArray(scp) && scp.length <= 64 && scp.every((value) => typeof value === "string" && value.length <= 128 && !/[\s\u0000-\u001f\u007f]/.test(value))) {
+    values.push(...scp);
+  } else if (scp !== void 0) {
+    throw new Error("JWT scp claim is unsafe");
+  }
+  if (values.length > 128 || values.some((value) => value.length > 128)) throw new Error("JWT scope claim is unsafe");
+  return new Set(values);
 }
 function tokenFingerprint(token) {
   return `sha256:${crypto3.createHash("sha256").update(token).digest("hex")}`;
@@ -12906,10 +13567,10 @@ function containsInitializeRequest(payload) {
 }
 function requestIdFromPayload(payload) {
   if (Array.isArray(payload)) {
-    const request = payload.find((message2) => isRecord4(message2) && "id" in message2);
-    return isRecord4(request) ? request.id ?? null : null;
+    const request = payload.find((message2) => isRecord5(message2) && "id" in message2);
+    return isRecord5(request) ? request.id ?? null : null;
   }
-  return isRecord4(payload) ? payload.id ?? null : null;
+  return isRecord5(payload) ? payload.id ?? null : null;
 }
 function openaiToolNameAlias(canonicalName) {
   const sanitized = canonicalName.replace(/[^A-Za-z0-9_-]+/g, "__").replace(/_{3,}/g, "__").replace(/^_+|_+$/g, "");
@@ -12964,14 +13625,14 @@ function writeJson(response, statusCode, payload) {
   response.end(`${JSON.stringify(payload, null, 2)}
 `);
 }
-async function readRequestBody(request) {
+async function readRequestBody(request, maxBytes = 1048576) {
   const chunks = [];
   let bytes = 0;
   for await (const chunk of request) {
     const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
     bytes += buffer.length;
-    if (bytes > 1024 * 1024) {
-      throw new McpRuntimeError("HTTP_BODY_TOO_LARGE", "HTTP MCP request body exceeds 1 MiB.");
+    if (bytes > maxBytes) {
+      throw new McpRuntimeError("HTTP_BODY_TOO_LARGE", `HTTP MCP request body exceeds the configured ${maxBytes}-byte limit.`);
     }
     chunks.push(buffer);
   }
@@ -12984,21 +13645,21 @@ function jsonRpcError(id, code, message2) {
     error: { code, message: message2 }
   };
 }
-function sanitizeHttpError(error, authToken) {
+function sanitizeHttpError(error, ...authTokens) {
   const raw = error instanceof Error ? error.message : String(error);
-  return sanitizeHttpString(raw, authToken);
+  return sanitizeHttpString(raw, ...authTokens);
 }
-function sanitizeHttpPayload(value, authToken) {
-  if (typeof value === "string") return sanitizeHttpString(value, authToken);
-  if (Array.isArray(value)) return value.map((item) => sanitizeHttpPayload(item, authToken));
-  if (isRecord4(value)) {
-    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, sanitizeHttpPayload(item, authToken)]));
+function sanitizeHttpPayload(value, ...authTokens) {
+  if (typeof value === "string") return sanitizeHttpString(value, ...authTokens);
+  if (Array.isArray(value)) return value.map((item) => sanitizeHttpPayload(item, ...authTokens));
+  if (isRecord5(value)) {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, sanitizeHttpPayload(item, ...authTokens)]));
   }
   return value;
 }
-function sanitizeHttpString(value, authToken) {
+function sanitizeHttpString(value, ...authTokens) {
   let redacted = value.replace(/(?:postgres(?:ql)?|mysql):\/\/[^\s"']+/gi, "[redacted-database-url]");
-  if (authToken) redacted = redacted.split(authToken).join("[redacted-token]");
+  for (const authToken of authTokens) if (authToken) redacted = redacted.split(authToken).join("[redacted-token]");
   return redacted;
 }
 function isLoopbackHost(host) {
@@ -13032,6 +13693,13 @@ async function closeStreamableSessions(sessions) {
     disposeStreamableSession(session);
   }
 }
+async function pruneExpiredStreamableSessions(sessions, openSessions, idleTimeoutMs, now) {
+  const expired = [...openSessions].filter((session) => now - session.lastSeenAt >= idleTimeoutMs);
+  for (const session of expired) {
+    disposeStreamableSession(session, sessions, openSessions);
+    await session.transport.close().catch(() => void 0);
+  }
+}
 function disposeStreamableSession(session, sessionMap, openSessions) {
   if (session.closed) return;
   session.closed = true;
@@ -13058,7 +13726,7 @@ async function toolCallResult(runtime, toolName, args) {
 }
 async function withProposalReviewPresentation(runtime, result) {
   const directId = typeof result.proposal_id === "string" ? result.proposal_id : void 0;
-  const nested = isRecord4(result.proposal) ? result.proposal : void 0;
+  const nested = isRecord5(result.proposal) ? result.proposal : void 0;
   const proposalId = directId ?? (typeof nested?.id === "string" ? nested.id : void 0);
   if (!proposalId || proposalId === "wrp_unknown") return result;
   try {
@@ -13139,11 +13807,11 @@ function toolDescriptionWithCanonical(description, canonicalName, exposedName) {
 ${description}`;
 }
 function zodInputShapeFromJsonSchema(schema) {
-  const properties = isRecord4(schema.properties) ? schema.properties : {};
+  const properties = isRecord5(schema.properties) ? schema.properties : {};
   const required = Array.isArray(schema.required) ? new Set(schema.required.map(String)) : /* @__PURE__ */ new Set();
   const shape = {};
   for (const [name, rawProperty] of Object.entries(properties)) {
-    const property = isRecord4(rawProperty) ? rawProperty : {};
+    const property = isRecord5(rawProperty) ? rawProperty : {};
     let valueSchema;
     if (Array.isArray(property.enum)) {
       const allowed = property.enum.map((item) => scalar2(item));
@@ -13546,13 +14214,13 @@ function resultEnvelopeFromLegacy(legacy, capability, canonicalName) {
   const kind = capability?.kind ?? (typeof legacy.proposal_id === "string" ? "proposal" : "read");
   const evidenceBundleId = typeof legacy.evidence_bundle_id === "string" ? legacy.evidence_bundle_id : void 0;
   const sourceChanged = Boolean(legacy.source_database_changed ?? legacy.source_database_mutated ?? false);
-  const context = isRecord4(legacy.trusted_context) ? legacy.trusted_context : void 0;
-  const target = isRecord4(legacy.target) ? legacy.target : void 0;
+  const context = isRecord5(legacy.trusted_context) ? legacy.trusted_context : void 0;
+  const target = isRecord5(legacy.target) ? legacy.target : void 0;
   if (kind === "proposal") {
     const proposalId = typeof legacy.proposal_id === "string" ? legacy.proposal_id : "wrp_unknown";
     const targetType = typeof target?.type === "string" ? target.type : capability?.target.table ?? "object";
     const targetId = target?.id !== void 0 ? String(target.id) : "unknown";
-    const approval = isRecord4(legacy.approval) ? legacy.approval : void 0;
+    const approval = isRecord5(legacy.approval) ? legacy.approval : void 0;
     const state = typeof legacy.status === "string" ? legacy.status : "review_required";
     const approvalRequired = legacy.approval_required !== false;
     const executor = writebackExecutorName(legacy.writeback);
@@ -13568,7 +14236,7 @@ function resultEnvelopeFromLegacy(legacy, capability, canonicalName) {
         id: proposalId,
         state,
         target: `${targetType}:${targetId}`,
-        diff: isRecord4(legacy.diff) ? legacy.diff : {},
+        diff: isRecord5(legacy.diff) ? legacy.diff : {},
         approval_required: approvalRequired,
         ...approval ? { approval } : {},
         writeback: {
@@ -13589,7 +14257,7 @@ function resultEnvelopeFromLegacy(legacy, capability, canonicalName) {
       }
     };
   }
-  const businessObject = isRecord4(legacy.business_object) ? legacy.business_object : void 0;
+  const businessObject = isRecord5(legacy.business_object) ? legacy.business_object : void 0;
   const objectType = typeof businessObject?.type === "string" ? businessObject.type : capability?.target.table ?? "record";
   const objectId = businessObject?.id !== void 0 ? String(businessObject.id) : String(legacy.action ?? action);
   return {
@@ -13597,7 +14265,7 @@ function resultEnvelopeFromLegacy(legacy, capability, canonicalName) {
     summary: kind === "aggregate_read" ? `Read one reviewed aggregate through ${action}. Source member rows exposed: no. Source database changed: no.` : `Read ${objectType} ${objectId} through ${action}. Source database changed: no.`,
     action,
     kind,
-    data: isRecord4(legacy.data) ? legacy.data : {},
+    data: isRecord5(legacy.data) ? legacy.data : {},
     proposal: null,
     error: null,
     evidence: evidenceBundleId ? evidenceHandle(evidenceBundleId) : null,
@@ -13611,7 +14279,7 @@ function resultEnvelopeFromLegacy(legacy, capability, canonicalName) {
   };
 }
 function writebackExecutorName(value) {
-  if (!isRecord4(value)) return void 0;
+  if (!isRecord5(value)) return void 0;
   return typeof value.executor === "string" ? value.executor : typeof value.mode === "string" ? value.mode : void 0;
 }
 function capabilityWritebackMode2(capability) {
@@ -13645,7 +14313,7 @@ function assertProposalWritebackResolvable(config, capability) {
     throw new McpRuntimeError("WRITEBACK_UNRESOLVED", `capability ${capability.name} declares HANDLER writeback but has no executor name.`);
   }
   const executor = config.executors?.[executorName];
-  if (!isRecord4(executor)) {
+  if (!isRecord5(executor)) {
     throw new McpRuntimeError("WRITEBACK_UNRESOLVED", `capability ${capability.name} declares HANDLER writeback but executor ${executorName} is not configured.`);
   }
   if (executor.type !== "http_handler" && executor.type !== "command_handler") {
@@ -13912,26 +14580,26 @@ function errorChain(error) {
   while (current !== void 0 && current !== null && chain.length < 6 && !seen.has(current)) {
     chain.push(current);
     seen.add(current);
-    current = isRecord4(current) ? current.cause : void 0;
+    current = isRecord5(current) ? current.cause : void 0;
   }
   return chain;
 }
 function errorStringProperty(error, property) {
-  if (!isRecord4(error)) return void 0;
+  if (!isRecord5(error)) return void 0;
   const value = error[property];
   if (typeof value !== "string" && typeof value !== "number") return void 0;
   const normalized = String(value).trim().toUpperCase();
   return normalized || void 0;
 }
 function errorNumberProperty(error, property) {
-  if (!isRecord4(error)) return void 0;
+  if (!isRecord5(error)) return void 0;
   const value = error[property];
   const normalized = typeof value === "number" ? value : typeof value === "string" ? Number(value) : Number.NaN;
   return Number.isInteger(normalized) ? normalized : void 0;
 }
 function errorMessage(error) {
   if (error instanceof Error) return error.message;
-  if (isRecord4(error) && typeof error.message === "string") return error.message;
+  if (isRecord5(error) && typeof error.message === "string") return error.message;
   return typeof error === "string" ? error : "";
 }
 function effectivePrincipalScope(config, capability, context) {
@@ -14680,7 +15348,7 @@ function validateToolArgs(capability, args) {
       if (!Array.isArray(value)) throw new McpRuntimeError("ARGUMENT_TYPE_INVALID", `${name} must be an array of reviewed objects.`);
       if (value.length < 1 || value.length > spec.max_items) throw new McpRuntimeError("ARGUMENT_ITEM_COUNT_INVALID", `${name} must contain 1 through ${spec.max_items} items.`);
       for (const [index, item] of value.entries()) {
-        if (!isRecord4(item)) throw new McpRuntimeError("ARGUMENT_ITEM_TYPE_INVALID", `${name}[${index}] must be an object.`);
+        if (!isRecord5(item)) throw new McpRuntimeError("ARGUMENT_ITEM_TYPE_INVALID", `${name}[${index}] must be an object.`);
         for (const key of Object.keys(item)) if (!Object.prototype.hasOwnProperty.call(spec.fields, key)) throw new McpRuntimeError("ARGUMENT_ITEM_FIELD_NOT_ALLOWED", `${name}[${index}].${key} is not a reviewed item field.`);
         for (const [fieldName, fieldSpec] of Object.entries(spec.fields)) validateScalarArg(`${name}[${index}].${fieldName}`, fieldSpec, item[fieldName]);
       }
@@ -14782,7 +15450,7 @@ function buildPatch(capability, args) {
 function batchItemsFromArgs(capability, args) {
   const argumentName = capability.operation?.batch?.items_from_arg;
   const value = argumentName ? args[argumentName] : void 0;
-  if (!argumentName || !Array.isArray(value) || value.some((item) => !isRecord4(item))) {
+  if (!argumentName || !Array.isArray(value) || value.some((item) => !isRecord5(item))) {
     throw new McpRuntimeError("BATCH_ITEMS_REQUIRED", `Bounded INSERT capability ${capability.name} requires its reviewed object-array argument.`);
   }
   return value;
@@ -15020,7 +15688,7 @@ function stableId(prefix, input) {
 function hashJson(input) {
   return `sha256:${crypto3.createHash("sha256").update(JSON.stringify(input)).digest("hex")}`;
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function toolErrorPayload(error) {