@productbrain/mcp 0.0.1-beta.124 → 0.0.1-beta.12402

package/dist/http.js

@@ -1,28 +1,400 @@
 import {
+  PRODUCT_NAME,
   SERVER_VERSION,
   createProductBrainServer
-} from "./chunk-SDLQPEK6.js";
+} from "./chunk-V2WCCCRI.js";
 import {
+  DEFAULT_CLOUD_URL,
+  PASTE_NOW,
+  apiKeysUrl,
   bootstrapHttp,
-  initFeatureFlags,
+  checkKeyAgainstCandidates,
+  forgetStreamLifecycle,
+  getKeyState,
+  hashKey,
+  isApiKeyShaped,
+  parseFallbackUrls,
   runWithAuth
-} from "./chunk-UUI7P743.js";
-import {
-  getPostHogClient,
-  initAnalytics,
-  shutdownAnalytics
-} from "./chunk-2ZWGQ6PK.js";
+} from "./chunk-3U2ECUFG.js";
 
 // src/http.ts
 import { createHash, randomUUID } from "crypto";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import rateLimit2 from "express-rate-limit";
+
+// src/brand/logo-markup.ts
+var SIZE_CLASSES = {
+  sm: "pb-logo--sm",
+  md: "pb-logo--md"
+};
+var appLogoStyles = `
+.pb-logo{display:inline-flex;align-items:center;gap:8px;color:inherit}
+.pb-logo__mark{
+  border-radius:4px;background:#1c1e24;
+  border:1px solid rgba(255,255,255,0.06);
+  display:inline-grid;place-items:center;flex-shrink:0;
+}
+.pb-logo__core{border-radius:50%;background:var(--accent,#c9b99a)}
+.pb-logo__name{
+  font-family:var(--font-mono,"IBM Plex Mono",ui-monospace,monospace);
+  font-weight:500;text-transform:uppercase;
+  letter-spacing:0.22em;color:var(--fg4,#6a6560);
+}
+.pb-logo--sm .pb-logo__mark{width:16px;height:16px}
+.pb-logo--sm .pb-logo__core{width:5px;height:5px}
+.pb-logo--sm .pb-logo__name{font-size:10.5px}
+.pb-logo--md .pb-logo__mark{width:24px;height:24px;border-radius:6px}
+.pb-logo--md .pb-logo__core{width:8px;height:8px}
+.pb-logo--md .pb-logo__name{font-size:13px}
+`;
+function appLogoMarkup(opts = {}) {
+  const size = opts.size ?? "sm";
+  const showWordmark = opts.showWordmark ?? true;
+  const cls = ["pb-logo", SIZE_CLASSES[size], opts.className].filter(Boolean).join(" ");
+  const wordmark = showWordmark ? `<span class="pb-logo__name">${PRODUCT_NAME}</span>` : "";
+  return `<span class="${cls}"><span class="pb-logo__mark"><span class="pb-logo__core"></span></span>${wordmark}</span>`;
+}
+
+// src/sessionCap.ts
+function planKeyAdmission(sessions2, keyHash, cap, now, opts) {
+  if (cap < 1) {
+    throw new RangeError(`cap must be >= 1, got ${cap}`);
+  }
+  const { ttlMs, graceMs } = opts;
+  const isProtected = (s) => s.inFlight > 0 || now - s.lastAccess < graceMs;
+  const keyEntries = [];
+  for (const [id, session] of sessions2) {
+    if (session.keyHash === keyHash) {
+      keyEntries.push([id, session]);
+    }
+  }
+  const evictSet = /* @__PURE__ */ new Set();
+  for (const [id, session] of keyEntries) {
+    if (!isProtected(session) && now - session.lastAccess >= ttlMs) {
+      evictSet.add(id);
+    }
+  }
+  let survivors = keyEntries.filter(([id]) => !evictSet.has(id));
+  if (survivors.length >= cap) {
+    const idleSurvivors = survivors.filter(([, s]) => !isProtected(s)).sort(([, a], [, b]) => a.lastAccess - b.lastAccess);
+    for (const [id] of idleSurvivors) {
+      if (survivors.length < cap) break;
+      evictSet.add(id);
+      survivors = survivors.filter(([sid]) => sid !== id);
+    }
+  }
+  const evict = Array.from(evictSet);
+  const admit = survivors.length < cap;
+  let retryAfterSeconds = 0;
+  let retryIsPoll = false;
+  if (!admit) {
+    const graceBlockers = survivors.filter(([, s]) => s.inFlight === 0);
+    if (graceBlockers.length > 0) {
+      const minLastAccess = Math.min(...graceBlockers.map(([, s]) => s.lastAccess));
+      const msRemaining = graceMs - (now - minLastAccess);
+      retryAfterSeconds = Math.max(1, Math.ceil(msRemaining / 1e3));
+    } else {
+      retryAfterSeconds = 5;
+      retryIsPoll = true;
+    }
+  }
+  return { evict, admit, retryAfterSeconds, retryIsPoll };
+}
+function countKeySessions(sessions2, keyHash) {
+  let count = 0;
+  for (const session of sessions2.values()) {
+    if (session.keyHash === keyHash) count++;
+  }
+  return count;
+}
+
+// src/httpErrors.ts
+function clampSeconds(s) {
+  return Math.max(0, Math.round(s));
+}
+function build(reason, message, p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return {
+    status: 429,
+    headers: { "Retry-After": String(seconds) },
+    body: {
+      jsonrpc: "2.0",
+      id: p.id ?? null,
+      error: {
+        code: -32e3,
+        message,
+        data: {
+          reason,
+          retryAfterSeconds: seconds,
+          limit: p.limit,
+          current: p.current
+        }
+      }
+    }
+  };
+}
+function buildRateLimitError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return build(
+    "rate_limited",
+    `Too many requests \u2014 retry after ${seconds} s.`,
+    p
+  );
+}
+function buildAuthLockoutError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return build(
+    "auth_lockout",
+    `Too many failed auth attempts \u2014 locked out, retry after ${seconds} s.`,
+    p
+  );
+}
+function buildSessionCapError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  const message = p.poll ? "Server busy \u2014 all sessions active; retry shortly." : `Too many active sessions for this key \u2014 retry after ${seconds} s.`;
+  return build("session_cap", message, p);
+}
+function send429(res, built) {
+  if (res.headersSent) return;
+  for (const [k, v] of Object.entries(built.headers)) {
+    res.setHeader(k, v);
+  }
+  res.status(built.status).json(built.body);
+}
+
+// src/mcpRateLimit.ts
 import rateLimit from "express-rate-limit";
+
+// src/authLockout.ts
+var AUTH_FAILURE_MAX = 10;
+var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
+var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
+var MAX_AUTH_FAILURE_ENTRIES = 1e4;
+function rejected(presented) {
+  return { status: "rejected", credentialId: hashKey(presented) };
+}
+function resolveBearerAuth(authorizationHeader) {
+  if (typeof authorizationHeader !== "string" || authorizationHeader.trim() === "") {
+    return { status: "absent" };
+  }
+  if (!authorizationHeader.startsWith("Bearer ")) {
+    return rejected(authorizationHeader.trim());
+  }
+  const token = authorizationHeader.slice(7).trim();
+  if (!isApiKeyShaped(token)) return rejected(token);
+  return { status: "ok", apiKey: token, credentialId: hashKey(token) };
+}
+function resolvePastedKey(apiKey) {
+  if (apiKey === "") return { status: "absent" };
+  if (!isApiKeyShaped(apiKey)) return rejected(apiKey);
+  return { status: "ok", apiKey, credentialId: hashKey(apiKey) };
+}
+function isCrossSiteFormPost(origin, secFetchSite, ownOrigin) {
+  if (secFetchSite === "cross-site") return true;
+  if (typeof origin !== "string" || origin === "") return false;
+  try {
+    return new URL(origin).origin !== new URL(ownOrigin).origin;
+  } catch {
+    return true;
+  }
+}
+function checkAuthBlock(failures, credentialId, now) {
+  const rec = failures.get(credentialId);
+  if (!rec) return false;
+  return rec.blockedUntil > now;
+}
+function authLockoutError(failures, auth, now, id = null) {
+  if (auth.status === "absent") return null;
+  const rec = failures.get(auth.credentialId);
+  if (!rec || !checkAuthBlock(failures, auth.credentialId, now)) return null;
+  const retryAfterSeconds = Math.max(0, Math.ceil((rec.blockedUntil - now) / 1e3));
+  return buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec.count, id });
+}
+function recordAuthFailure(failures, credentialId, now) {
+  const rec = failures.get(credentialId);
+  if (!rec) {
+    if (failures.size >= MAX_AUTH_FAILURE_ENTRIES) {
+      const oldest = failures.keys().next().value;
+      if (oldest !== void 0) failures.delete(oldest);
+    }
+    failures.set(credentialId, { count: 1, firstFailure: now, blockedUntil: 0 });
+    return;
+  }
+  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
+    rec.count = 1;
+    rec.firstFailure = now;
+    rec.blockedUntil = 0;
+  } else {
+    rec.count++;
+    if (rec.count >= AUTH_FAILURE_MAX) {
+      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
+    }
+  }
+}
+function keyVerdictGate(verdict, failures, credentialId, now) {
+  if (verdict === "ok" || verdict === "rate_limited") return "admit";
+  if (verdict === "rejected") {
+    recordAuthFailure(failures, credentialId, now);
+    return "unauthorized";
+  }
+  return "unavailable";
+}
+
+// src/mcpRateLimit.ts
+var MCP_KEY_LIMIT = 120;
+var MCP_IP_CEILING = 1200;
+function mcpRateKey(req) {
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  return auth.status === "absent" ? `ip:${req.ip ?? ""}` : `key:${auth.credentialId}`;
+}
+function limiter(max, windowMs, keyGenerator) {
+  return rateLimit({
+    windowMs,
+    max,
+    standardHeaders: true,
+    legacyHeaders: false,
+    ...keyGenerator ? { keyGenerator } : {},
+    handler: (req, res) => {
+      const r = req.rateLimit;
+      const reset = r?.resetTime?.getTime?.() ?? Date.now() + windowMs;
+      send429(res, buildRateLimitError({
+        retryAfterSeconds: Math.max(1, Math.ceil((reset - Date.now()) / 1e3)),
+        limit: r?.limit ?? max,
+        current: r?.used ?? 0,
+        id: req.body?.id ?? null
+        // mirror the JSON-RPC id when a POST body is present
+      }));
+    }
+  });
+}
+function mcpLimiters(opts = {}) {
+  const windowMs = opts.windowMs ?? 6e4;
+  return [
+    limiter(opts.ipCeiling ?? MCP_IP_CEILING, windowMs),
+    limiter(opts.keyLimit ?? MCP_KEY_LIMIT, windowMs, mcpRateKey)
+  ];
+}
+
+// src/lib/oauthRedirectAllowlist.ts
+var DEFAULT_OAUTH_REDIRECT_URIS = [
+  "https://claude.ai/api/mcp/auth_callback",
+  "https://claude.com/api/mcp/auth_callback",
+  "https://chatgpt.com/connector_platform_oauth_redirect",
+  "https://www.cursor.com/agents/mcp/oauth/callback"
+];
+var CHATGPT_CONNECTOR_CALLBACK = /^https:\/\/chatgpt\.com\/connector\/oauth\/[A-Za-z0-9_-]+$/;
+var LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+var MAX_REDIRECT_URI_LENGTH = 2048;
+var MAX_REGISTRATION_REDIRECTS = 10;
+var OPERATOR_ENTRY_FORM = "OAUTH_REDIRECT_HOST_ALLOWLIST entries must be full https redirect URIs such as https://partner.example/oauth/callback (no bare host, no query, no fragment)";
+function exactForm(url) {
+  return `${url.origin}${url.pathname}`;
+}
+function parseRedirectUriAllowlist(raw) {
+  if (!raw) return { uris: [], configError: null };
+  const uris = [];
+  for (const part of raw.split(",")) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    let url = null;
+    try {
+      url = trimmed.includes("://") ? new URL(trimmed) : null;
+    } catch {
+      url = null;
+    }
+    const valid = url !== null && url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash && (url.port === "" || url.port === "443") && url.pathname !== "/";
+    if (!valid || url === null) {
+      return { uris: [], configError: `${OPERATOR_ENTRY_FORM}; got "${trimmed}"` };
+    }
+    uris.push(exactForm(url));
+  }
+  return { uris, configError: null };
+}
+function resolveOAuthRedirectAllowlist(opts = {}) {
+  const parsed = parseRedirectUriAllowlist(opts.explicitAllowlist);
+  return {
+    uris: [.../* @__PURE__ */ new Set([...DEFAULT_OAUTH_REDIRECT_URIS, ...parsed.uris])],
+    configError: parsed.configError
+  };
+}
+function checkRedirectUri(redirectUri, allowlist) {
+  if (allowlist.configError) return `OAuth is misconfigured: ${allowlist.configError}`;
+  if (typeof redirectUri !== "string" || redirectUri.length === 0) {
+    return "redirect_uri is required";
+  }
+  if (redirectUri.length > MAX_REDIRECT_URI_LENGTH) {
+    return `redirect_uri is longer than ${MAX_REDIRECT_URI_LENGTH} characters`;
+  }
+  let url;
+  try {
+    url = new URL(redirectUri);
+  } catch {
+    return "redirect_uri is not a valid absolute URL";
+  }
+  if (url.username || url.password) return "redirect_uri must not contain credentials";
+  if (url.hash) return "redirect_uri must not contain a fragment";
+  const host = url.hostname.toLowerCase();
+  if (url.protocol === "http:") {
+    return LOOPBACK_HOSTS.includes(host) ? null : "redirect_uri must use https (http is allowed only for localhost, 127.0.0.1 or [::1])";
+  }
+  if (url.protocol === "https:") {
+    if (url.port && url.port !== "443") return "redirect_uri must use the default https port (443)";
+    if (url.search) return "redirect_uri must not contain a query";
+    const exact = exactForm(url);
+    return allowlist.uris.includes(exact) || CHATGPT_CONNECTOR_CALLBACK.test(exact) ? null : "redirect_uri is not an allowed callback (an operator can add the full URI with OAUTH_REDIRECT_HOST_ALLOWLIST)";
+  }
+  return "redirect_uri scheme is not allowed (use https, or http on loopback)";
+}
+function checkRegistrationRedirects(redirectUris, allowlist) {
+  const refused = (refusal) => ({ refusal, allowed: [], dropped: [] });
+  if (!Array.isArray(redirectUris) || redirectUris.length === 0) return refused("redirect_uris is required");
+  if (redirectUris.length > MAX_REGISTRATION_REDIRECTS) {
+    return refused(`redirect_uris may hold at most ${MAX_REGISTRATION_REDIRECTS} entries`);
+  }
+  const allowed = [];
+  const dropped = [];
+  for (const uri of redirectUris) {
+    const reason = checkRedirectUri(uri, allowlist);
+    if (reason) dropped.push({ uri, reason });
+    else allowed.push(uri);
+  }
+  return { refusal: allowed.length === 0 ? dropped[0].reason : null, allowed, dropped };
+}
+
+// src/lib/oauthAuthCode.ts
+function normalisePastedKey(raw) {
+  if (typeof raw !== "string") return "";
+  const trimmed = raw.trim();
+  const first = trimmed[0];
+  if (trimmed.length >= 2 && (first === '"' || first === "'" || first === "`") && trimmed.endsWith(first)) {
+    return trimmed.slice(1, -1).trim();
+  }
+  return trimmed;
+}
+function pendingCodeRefusal(pending, redirectUri, now) {
+  if (!pending) return "unknown_code";
+  if (pending.redirectUri !== redirectUri) return "redirect_mismatch";
+  if (now > pending.expiresAt) return "expired";
+  return null;
+}
+function tokenResponse(apiKey) {
+  return {
+    access_token: apiKey,
+    token_type: "Bearer",
+    // 1 year: validity is enforced by Convex on every call, not by this clock.
+    expires_in: 365 * 24 * 3600
+  };
+}
+
+// src/http.ts
 bootstrapHttp();
-initAnalytics();
-initFeatureFlags(getPostHogClient());
 var PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? "3002", 10);
+function keyCheckCandidates() {
+  const primaryUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_CLOUD_URL).replace(/\/$/, "");
+  return [primaryUrl, ...parseFallbackUrls(process.env.CONVEX_FALLBACK_URLS).map((u) => u.replace(/\/$/, ""))];
+}
 function baseUrl(req) {
   const proto = req.headers["x-forwarded-proto"] ?? req.protocol ?? "http";
   const host = req.headers.host ?? `localhost:${PORT}`;
@@ -31,10 +403,11 @@ function baseUrl(req) {
 var app = express();
 app.set("trust proxy", 1);
 app.use(express.json());
-var ALLOWED_ORIGINS = process.env.CORS_ORIGINS?.split(",").map((o) => o.trim()).filter(Boolean);
+var ALLOWED_ORIGINS = (process.env.CORS_ORIGINS ?? "https://claude.ai").split(",").map((o) => o.trim()).filter(Boolean);
+var OAUTH_REDIRECT_ALLOWLIST = resolveOAuthRedirectAllowlist({ explicitAllowlist: process.env.OAUTH_REDIRECT_HOST_ALLOWLIST });
 app.use((_req, res, next) => {
   const origin = _req.headers.origin;
-  if (ALLOWED_ORIGINS && origin && ALLOWED_ORIGINS.includes(origin)) {
+  if (origin && ALLOWED_ORIGINS.includes(origin)) {
     res.setHeader("Access-Control-Allow-Origin", origin);
   }
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
@@ -42,7 +415,7 @@ app.use((_req, res, next) => {
     "Access-Control-Allow-Headers",
     "Content-Type, Authorization, Mcp-Session-Id, Last-Event-Id"
   );
-  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
+  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id, Retry-After");
   if (_req.method === "OPTIONS") {
     res.status(204).end();
     return;
@@ -66,37 +439,46 @@ app.get("/.well-known/oauth-authorization-server", (req, res) => {
     token_endpoint: `${base}/oauth/token`,
     registration_endpoint: `${base}/register`,
     response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code", "refresh_token"],
+    grant_types_supported: ["authorization_code"],
+    // TEN-4548: no refresh grant (lib/oauthAuthCode.ts tokenResponse)
     code_challenge_methods_supported: ["S256"],
     token_endpoint_auth_methods_supported: ["none"],
     scopes_supported: ["mcp:tools", "mcp:resources"]
   });
 });
-var registeredClients = /* @__PURE__ */ new Map();
+function logOAuthDoor(door, status, reason, uris) {
+  const list = uris === void 0 ? "" : ` uris=${JSON.stringify(uris.map(String)).slice(0, 600)}`;
+  process.stderr.write(`[oauth] door=${door} status=${status} reason=${JSON.stringify(reason)}${list}
+`);
+}
+var authLimiter = rateLimit2({
+  windowMs: 6e4,
+  max: 20,
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: (req, res) => {
+    logOAuthDoor(`${req.method} /authorize`, 429, "rate_limited_per_ip");
+    res.status(429).json({ error: "Too many auth requests. Try again later." });
+  }
+});
 app.post(
   "/register",
   express.json(),
   (req, res) => {
-    const { redirect_uris, client_name } = req.body;
-    if (!Array.isArray(redirect_uris) || redirect_uris.length === 0) {
-      res.status(400).json({
-        error: "invalid_client_metadata",
-        error_description: "redirect_uris is required"
-      });
+    const { redirect_uris, client_name } = req.body ?? {};
+    const { refusal, allowed, dropped } = checkRegistrationRedirects(redirect_uris, OAUTH_REDIRECT_ALLOWLIST);
+    if (refusal) {
+      logOAuthDoor("POST /register", 400, refusal, Array.isArray(redirect_uris) ? redirect_uris : [redirect_uris]);
+      res.status(400).json({ error: "invalid_redirect_uri", error_description: refusal });
       return;
     }
     const clientId = `pb_client_${randomUUID()}`;
-    const client = {
-      client_id: clientId,
-      redirect_uris,
-      client_name,
-      registeredAt: Date.now()
-    };
-    registeredClients.set(clientId, client);
+    const droppedUris = dropped.length > 0 ? dropped.map((d) => d.uri) : void 0;
+    logOAuthDoor("POST /register", 201, droppedUris ? "dropped_redirects" : "registered", droppedUris);
     res.status(201).json({
       client_id: clientId,
       client_name: client_name ?? "MCP Client",
-      redirect_uris,
+      redirect_uris: allowed,
       grant_types: ["authorization_code"],
       response_types: ["code"],
       token_endpoint_auth_method: "none"
@@ -104,76 +486,654 @@ app.post(
   }
 );
 var pendingCodes = /* @__PURE__ */ new Map();
-var ACCESS_TOKEN_TTL = 3600;
-var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
-var refreshTokens = /* @__PURE__ */ new Map();
 setInterval(() => {
   const now = Date.now();
   for (const [code, auth] of pendingCodes) {
     if (now > auth.expiresAt) pendingCodes.delete(code);
   }
-  for (const [id, client] of registeredClients) {
-    if (now - client.registeredAt > 24 * 60 * 6e4) registeredClients.delete(id);
-  }
-  for (const [token, entry] of refreshTokens) {
-    if (now - entry.createdAt > REFRESH_TOKEN_TTL_MS) refreshTokens.delete(token);
+  for (const [credentialId, rec] of authFailures) {
+    if (rec.blockedUntil < now && rec.firstFailure + AUTH_FAILURE_WINDOW_MS < now) {
+      authFailures.delete(credentialId);
+    }
   }
 }, 6e4);
 function esc(s) {
   return String(s ?? "").replace(
-    /[&"<>]/g,
-    (c) => ({ "&": "&amp;", '"': "&quot;", "<": "&lt;", ">": "&gt;" })[c]
+    /[&"'<>]/g,
+    (c) => ({ "&": "&amp;", '"': "&quot;", "'": "&#39;", "<": "&lt;", ">": "&gt;" })[c]
   );
 }
-app.get("/authorize", (req, res) => {
-  const { redirect_uri, code_challenge, code_challenge_method, state } = req.query;
-  res.type("html").send(`<!DOCTYPE html>
-<html lang="en"><head>
+function authPageShell(title, bodyContent, headExtra = "") {
+  return `<!DOCTYPE html>
+<html lang="en" data-theme="parchment-dark"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Authorize \u2014 Product Brain</title>
+<title>${esc(title)} \u2014 Product Brain</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Source+Serif+4:opsz,wght@8..60,600&family=IBM+Plex+Sans:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500;700&display=swap">
+${headExtra}
 <style>
-*{margin:0;padding:0;box-sizing:border-box}
-body{font-family:-apple-system,system-ui,sans-serif;background:#0a0a0a;color:#e5e5e5;
-  display:flex;align-items:center;justify-content:center;min-height:100vh;padding:1rem}
-.card{background:#1a1a1a;border:1px solid #333;border-radius:12px;padding:2rem;max-width:400px;width:100%}
-h1{font-size:1.2rem;margin-bottom:.25rem}
-.sub{color:#999;font-size:.85rem;margin-bottom:1.5rem}
-label{display:block;font-size:.85rem;margin-bottom:.4rem;color:#ccc}
-input[type=password]{width:100%;padding:.6rem .75rem;background:#111;border:1px solid #444;
-  border-radius:8px;color:#e5e5e5;font:.85rem/1.4 monospace}
-input:focus{outline:none;border-color:#7c3aed}
-button{width:100%;padding:.6rem;background:#7c3aed;color:#fff;border:none;
-  border-radius:8px;font-size:.85rem;cursor:pointer;margin-top:1rem}
-button:hover{background:#6d28d9}
-.err{color:#ef4444;font-size:.8rem;margin-top:.5rem;display:none}
-</style></head><body>
-<div class="card">
-<h1>Product Brain</h1>
-<p class="sub">Enter your API key to connect Claude to your workspace.</p>
-<form method="POST" action="/authorize">
-  <input type="hidden" name="redirect_uri" value="${esc(redirect_uri)}">
-  <input type="hidden" name="code_challenge" value="${esc(code_challenge)}">
-  <input type="hidden" name="code_challenge_method" value="${esc(code_challenge_method)}">
-  <input type="hidden" name="state" value="${esc(state)}">
-  <label for="k">API Key</label>
-  <input type="password" id="k" name="api_key" placeholder="pb_sk_\u2026" required autofocus>
-  <p class="err" id="e">Key must start with pb_sk_</p>
-  <button type="submit">Authorize</button>
-</form>
+:root{
+  --bg:#1a1917;--bg-warm:#201f1c;--surface:#262521;
+  --fg1:#e4e0d8;--fg2:#c4bfb4;--fg3:#9a9589;--fg4:#6a6560;--fg-bright:#ffffff;
+  --border:rgba(255,255,255,0.07);--border-light:rgba(255,255,255,0.04);
+  --accent:#c9b99a;
+  --btn-bg:#ffffff;--btn-fg:#1a1917;--btn-hover:#e4e0d8;
+  --green:#4ade80;--rose:#ef4444;
+  --ghost:rgba(38,37,33,0.55);
+  --radius-md:7px;--radius-lg:10px;
+  --font-display:"Source Serif 4",ui-serif,Georgia,serif;
+  --font-body:"IBM Plex Sans",ui-sans-serif,system-ui,sans-serif;
+  --font-mono:"IBM Plex Mono",ui-monospace,"SF Mono",Menlo,monospace;
+}
+*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
+html,body{height:100%}
+body{
+  font-family:var(--font-body);font-size:13px;line-height:1.45;
+  color:var(--fg1);background:var(--bg);
+  min-height:100vh;display:grid;place-items:center;padding:24px;
+  -webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;
+  position:relative;overflow:hidden;
+}
+body::before{
+  content:"";position:fixed;inset:0;
+  background:radial-gradient(900px 600px at 50% 50%,rgba(228,224,216,0.025),transparent 60%);
+  pointer-events:none;z-index:0;
+}
+.top-mark{position:fixed;top:22px;left:24px;z-index:5;opacity:0.7}
+${appLogoStyles}
+.stage{
+  width:100%;max-width:460px;text-align:center;
+  position:relative;z-index:1;
+  display:grid;
+}
+.panel{
+  grid-area:1/1;
+  transition:opacity 280ms ease-out,transform 380ms cubic-bezier(.2,.6,.2,1),filter 380ms ease-out;
+}
+.panel[hidden]{
+  display:block !important;
+  opacity:0;transform:scale(0.96) translateY(-2px);filter:blur(6px);
+  pointer-events:none;
+}
+.panel:not([hidden]){opacity:1;transform:scale(1);filter:none;pointer-events:auto}
+
+/* eyebrows */
+.eyebrow{
+  font-family:var(--font-mono);font-size:10px;font-weight:700;
+  letter-spacing:0.28em;text-transform:uppercase;color:var(--fg4);
+  margin-bottom:24px;display:inline-flex;align-items:center;gap:7px;
+}
+.eyebrow .dot{width:5px;height:5px;border-radius:50%;background:currentColor}
+.eyebrow.danger{color:var(--rose)}
+.eyebrow.success{color:var(--green)}
+.eyebrow.success .dot{box-shadow:0 0 0 3px rgba(74,222,128,0.18)}
+
+/* form input */
+.input-wrap{
+  display:flex;align-items:center;background:rgba(0,0,0,0.22);
+  border:1px solid var(--border);border-radius:var(--radius-md);
+  transition:border-color 200ms ease-out,box-shadow 200ms ease-out;
+}
+.input-wrap:focus-within{
+  border-color:rgba(228,224,216,0.45);
+  box-shadow:0 0 0 3px rgba(228,224,216,0.10);
+}
+.input-wrap.has-error{
+  border-color:rgba(239,68,68,0.55);
+  box-shadow:0 0 0 3px rgba(239,68,68,0.12);
+  animation:shake 360ms cubic-bezier(.36,.07,.19,.97);
+}
+@keyframes shake{
+  10%,90%{transform:translateX(-1px)}20%,80%{transform:translateX(2px)}
+  30%,50%,70%{transform:translateX(-4px)}40%,60%{transform:translateX(4px)}
+}
+.input{
+  flex:1;min-width:0;background:transparent;border:0;outline:none;
+  padding:16px;
+  font-family:var(--font-mono);font-size:14px;color:var(--fg1);letter-spacing:0.02em;
+}
+.input::placeholder{color:var(--fg4)}
+.hint{
+  margin-top:10px;font-family:var(--font-mono);font-size:10.5px;
+  letter-spacing:0.16em;text-transform:uppercase;
+  text-align:left;padding-left:4px;height:14px;color:var(--fg4);
+  transition:color 160ms ease-out;
+}
+.hint.is-error{color:var(--rose)}
+
+/* primary button */
+.btn-primary{
+  width:100%;height:48px;margin-top:14px;
+  border:0;border-radius:var(--radius-md);
+  background:var(--btn-bg);color:var(--btn-fg);
+  font-family:var(--font-body);font-size:14.5px;font-weight:600;letter-spacing:-0.005em;
+  cursor:pointer;display:inline-flex;align-items:center;justify-content:center;gap:10px;
+  transition:background 140ms ease-out,transform 80ms ease-out,opacity 200ms ease-out;
+  position:relative;overflow:hidden;
+}
+.btn-primary:hover:not([disabled]){background:var(--btn-hover)}
+.btn-primary:active:not([disabled]){transform:translateY(1px)}
+.btn-primary[disabled]{opacity:0.45;cursor:default}
+.spin{
+  width:14px;height:14px;border-radius:50%;
+  border:1.5px solid currentColor;border-top-color:transparent;
+  animation:spin 700ms linear infinite;opacity:0.85;
+}
+@keyframes spin{to{transform:rotate(360deg)}}
+
+/* secondary link */
+.small-link{
+  margin-top:18px;font-family:var(--font-mono);font-size:11px;
+  letter-spacing:0.18em;text-transform:uppercase;color:var(--fg4);
+}
+.small-link a{
+  color:var(--fg3);text-decoration:none;border-bottom:1px dotted currentColor;
+  padding-bottom:1px;transition:color 140ms;
+}
+.small-link a:hover{color:var(--fg1)}
+
+/* orb */
+.orb-wrap{
+  position:relative;width:160px;height:160px;margin:0 auto 36px;
+  display:grid;place-items:center;
+}
+.orb-ring{position:absolute;border-radius:50%}
+.orb-ring.r1{inset:0;border:1px solid rgba(228,224,216,0.06);animation:drift1 40s linear infinite}
+.orb-ring.r2{inset:18px;border:1px dashed rgba(228,224,216,0.10);animation:drift2 28s linear infinite}
+.orb-ring.r3{inset:38px;border:1px solid rgba(74,222,128,0.20);animation:ringPulse 3.4s ease-in-out infinite}
+@keyframes drift1{to{transform:rotate(360deg)}}
+@keyframes drift2{to{transform:rotate(-360deg)}}
+@keyframes ringPulse{0%,100%{opacity:0.6}50%{opacity:1}}
+
+.orb-wrap.is-verifying .orb-ring.r3{
+  border-color:rgba(228,224,216,0.20);
+  animation:ringPulse 1.1s ease-in-out infinite;
+}
+.orb-wrap.is-verifying .orb-core{
+  box-shadow:0 0 0 6px rgba(228,224,216,0.04),0 0 22px rgba(228,224,216,0.10),inset 0 0 16px rgba(228,224,216,0.06);
+  animation:corePulseNeutral 1.6s ease-in-out infinite;
+}
+.orb-wrap.is-verifying .orb-dot{background:var(--fg3);box-shadow:0 0 10px rgba(228,224,216,0.4)}
+@keyframes corePulseNeutral{
+  0%,100%{box-shadow:0 0 0 6px rgba(228,224,216,0.04),0 0 22px rgba(228,224,216,0.10),inset 0 0 16px rgba(228,224,216,0.06)}
+  50%{box-shadow:0 0 0 9px rgba(228,224,216,0.07),0 0 32px rgba(228,224,216,0.18),inset 0 0 22px rgba(228,224,216,0.10)}
+}
+
+.orb-wrap.is-error .orb-ring.r3{border-color:rgba(239,68,68,0.30);animation:none;opacity:1}
+.orb-wrap.is-error .orb-ring.r1,.orb-wrap.is-error .orb-ring.r2{animation-play-state:paused}
+.orb-wrap.is-error .orb-core{
+  box-shadow:0 0 0 6px rgba(239,68,68,0.05),0 0 22px rgba(239,68,68,0.20),inset 0 0 16px rgba(239,68,68,0.08);
+  animation:none;
+}
+.orb-wrap.is-error .orb-dot{background:var(--rose);box-shadow:0 0 10px rgba(239,68,68,0.6)}
+
+.sat-orbit{position:absolute;inset:0;pointer-events:none}
+.sat-orbit.o1{animation:drift1 40s linear infinite}
+.sat-orbit.o2{animation:drift2 56s linear infinite}
+.sat{
+  position:absolute;top:50%;left:50%;
+  font-family:var(--font-mono);font-size:9px;font-weight:700;letter-spacing:0.14em;
+  background:var(--bg);padding:2px 6px;border-radius:3px;
+  border:1px solid var(--border-light);
+  transform-origin:0 0;opacity:0;
+}
+.panel:not([hidden])[data-state="connected"] .sat{animation:satIn 600ms ease-out forwards}
+@keyframes satIn{from{opacity:0}to{opacity:1}}
+.sat span{display:inline-block;animation:counter 40s linear infinite}
+.sat-orbit.o2 .sat span{animation:counter2 56s linear infinite}
+@keyframes counter{to{transform:rotate(-360deg)}}
+@keyframes counter2{to{transform:rotate(360deg)}}
+
+.orb-core{
+  position:relative;width:60px;height:60px;border-radius:50%;
+  background:radial-gradient(circle at 50% 45%,#1a1a1a 0%,#0c0c0c 60%,#050505 100%);
+  border:1px solid rgba(255,255,255,0.06);
+  display:grid;place-items:center;
+  box-shadow:0 0 0 6px rgba(74,222,128,0.04),0 0 28px rgba(74,222,128,0.20),inset 0 0 18px rgba(74,222,128,0.08);
+  animation:corePulse 3.4s ease-in-out infinite;
+}
+@keyframes corePulse{
+  0%,100%{box-shadow:0 0 0 6px rgba(74,222,128,0.04),0 0 24px rgba(74,222,128,0.18),inset 0 0 16px rgba(74,222,128,0.06)}
+  50%{box-shadow:0 0 0 9px rgba(74,222,128,0.06),0 0 40px rgba(74,222,128,0.32),inset 0 0 22px rgba(74,222,128,0.14)}
+}
+.orb-dot{width:10px;height:10px;border-radius:50%;background:#4ade80;box-shadow:0 0 12px rgba(74,222,128,0.7)}
+
+.core-shockwave{
+  position:absolute;inset:0;border-radius:50%;
+  border:1px solid rgba(74,222,128,0.6);
+  opacity:0;pointer-events:none;
+}
+.panel:not([hidden])[data-state="connected"] .core-shockwave{animation:shock 1100ms ease-out 200ms}
+@keyframes shock{
+  0%{opacity:0.7;transform:scale(0.4);border-width:2px}
+  100%{opacity:0;transform:scale(2.4);border-width:1px}
+}
+
+/* titles */
+.ok-title{
+  font-family:var(--font-display);font-weight:600;
+  font-size:38px;line-height:1.05;letter-spacing:-0.025em;
+  color:var(--fg-bright);opacity:0;
+}
+.panel:not([hidden]) .ok-title{animation:rise 600ms ease-out 380ms forwards}
+.ok-lead{
+  margin:18px auto 0;max-width:22em;font-size:16px;line-height:1.55;color:var(--fg2);
+  opacity:0;
+}
+.panel:not([hidden]) .ok-lead{animation:rise 600ms ease-out 500ms forwards}
+.ok-phrase-row{
+  margin-top:14px;display:flex;align-items:center;justify-content:center;
+  opacity:0;
+}
+.panel:not([hidden]) .ok-phrase-row{animation:rise 600ms ease-out 620ms forwards}
+.cmd.is-copied .cmd-quote-part{display:none}
+.success-cta-wrap{
+  margin-top:48px;width:100%;opacity:0;
+}
+.panel:not([hidden]) .success-cta-wrap{animation:rise 600ms ease-out 780ms forwards}
+a.btn-primary.success-cta{color:var(--btn-fg);text-decoration:none}
+
+.cmd{
+  display:inline-flex;align-items:center;gap:8px;vertical-align:middle;
+  font-family:var(--font-mono);font-size:15px;font-weight:500;color:var(--accent);
+  background:rgba(201,185,154,0.08);border:1px solid rgba(201,185,154,0.30);
+  padding:5px 10px 5px 12px;border-radius:6px;letter-spacing:0.02em;
+  cursor:pointer;user-select:none;
+  transition:background 140ms ease-out,border-color 140ms ease-out,color 140ms ease-out;
+}
+.cmd:hover{background:rgba(201,185,154,0.14);border-color:rgba(201,185,154,0.50);color:#dcc9a4}
+.cmd.is-copied{color:var(--green);border-color:rgba(74,222,128,0.35);background:rgba(74,222,128,0.08)}
+.cmd .cmd-icon{
+  width:12px;height:12px;color:currentColor;opacity:0.75;
+  display:inline-grid;place-items:center;
+  transition:opacity 140ms;
+}
+.cmd:hover .cmd-icon{opacity:1}
+.cmd.is-copied .cmd-icon{color:var(--green);opacity:1}
+.cmd .cmd-icon svg{width:12px;height:12px;stroke:currentColor;fill:none;stroke-width:1.5;stroke-linecap:round;stroke-linejoin:round}
+
+/* error specifics */
+.err-title{
+  font-family:var(--font-display);font-weight:600;
+  font-size:32px;line-height:1.1;letter-spacing:-0.02em;
+  color:var(--fg1);margin-bottom:12px;
+}
+.err-msg{
+  font-size:14.5px;line-height:1.55;color:var(--fg3);
+  margin-bottom:28px;
+}
+.err-msg code{
+  font-family:var(--font-mono);font-size:12px;
+  background:rgba(255,255,255,0.06);padding:1px 5px;border-radius:4px;color:var(--fg2);
+}
+.err-actions{display:flex;gap:8px}
+.btn-secondary{
+  flex:1;height:44px;border-radius:var(--radius-md);
+  background:transparent;color:var(--fg2);
+  border:1px solid var(--border);
+  font-family:var(--font-body);font-size:13.5px;font-weight:500;
+  cursor:pointer;text-decoration:none;
+  display:inline-flex;align-items:center;justify-content:center;
+  transition:background 140ms,color 140ms,border-color 140ms;
+}
+.btn-secondary:hover{background:rgba(255,255,255,0.04);color:var(--fg1);border-color:rgba(255,255,255,0.14)}
+
+/* verifying */
+.verifying-eyebrow{
+  font-family:var(--font-mono);font-size:10px;
+  letter-spacing:0.28em;text-transform:uppercase;color:var(--fg3);
+  font-weight:700;margin-bottom:14px;
+}
+.verifying-title{
+  font-family:var(--font-display);font-weight:600;
+  font-size:28px;line-height:1.1;color:var(--fg1);margin-bottom:8px;
+  letter-spacing:-0.02em;
+}
+.verifying-sub{font-size:13px;color:var(--fg3);min-height:1.45em}
+
+/* form heading */
+.form-title{
+  font-family:var(--font-display);font-weight:600;
+  font-size:32px;line-height:1.1;letter-spacing:-0.02em;
+  color:var(--fg1);margin-bottom:10px;
+}
+.form-sub{font-size:13.5px;color:var(--fg3);margin-bottom:28px;line-height:1.55}
+
+@keyframes rise{from{opacity:0;transform:translateY(8px)}to{opacity:1;transform:translateY(0)}}
+
+@media (prefers-reduced-motion: reduce){
+  *,*::before,*::after{
+    animation-duration:0.01ms !important;animation-iteration-count:1 !important;
+    transition-duration:0.01ms !important;
+  }
+}
+</style>
+</head><body>
+<div class="top-mark">${appLogoMarkup({ size: "sm" })}</div>
+<div class="stage">${bodyContent}</div>
+</body></html>`;
+}
+var PROVIDER_NAME = "your assistant";
+function successPanelInner(workspaceName, redirectUrl, providerName) {
+  return `
+<div class="orb-wrap">
+  <div class="orb-ring r1"></div>
+  <div class="orb-ring r2"></div>
+  <div class="orb-ring r3"></div>
+  <div class="sat-orbit o1">
+    <span class="sat" style="transform:rotate(20deg) translate(78px) rotate(-20deg);color:#4ade80;animation-delay:600ms"><span>DEC</span></span>
+    <span class="sat" style="transform:rotate(140deg) translate(78px) rotate(-140deg);color:#c9b99a;animation-delay:720ms"><span>WP</span></span>
+    <span class="sat" style="transform:rotate(260deg) translate(78px) rotate(-260deg);color:#f59e0b;animation-delay:840ms"><span>TEN</span></span>
+  </div>
+  <div class="sat-orbit o2">
+    <span class="sat" style="transform:rotate(80deg) translate(54px) rotate(-80deg);color:#60a5fa;animation-delay:960ms"><span>STD</span></span>
+    <span class="sat" style="transform:rotate(220deg) translate(54px) rotate(-220deg);color:#a78bfa;animation-delay:1080ms"><span>INS</span></span>
+  </div>
+  <div class="core-shockwave"></div>
+  <div class="orb-core"><div class="orb-dot"></div></div>
+</div>
+<div class="eyebrow success"><span class="dot"></span>Connected</div>
+<h1 class="ok-title">Product Brain is Live</h1>
+<p class="ok-lead">Return to your assistant, then say</p>
+<div class="ok-phrase-row">
+  <button class="cmd" type="button" data-cmd-pill data-redirect="${esc(redirectUrl)}" aria-label="Copy &quot;${esc(PASTE_NOW)}&quot; and return to ${esc(providerName)}">
+    <span class="cmd-quote-part" aria-hidden="true">&ldquo;</span><span data-cmd-text>${esc(PASTE_NOW)}</span><span class="cmd-quote-part" aria-hidden="true">&rdquo;</span>
+    <span class="cmd-icon" aria-hidden="true">
+      <svg data-cmd-svg viewBox="0 0 24 24"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M5 15V6a2 2 0 0 1 2-2h9"/></svg>
+    </span>
+  </button>
 </div>
-<script>document.querySelector("form").onsubmit=function(e){
-if(!document.getElementById("k").value.startsWith("pb_sk_")){
-e.preventDefault();document.getElementById("e").style.display="block"}}</script>
-</body></html>`);
+<div class="success-cta-wrap">
+  <a class="btn-primary success-cta" href="${esc(redirectUrl)}">Continue in ${esc(providerName)}</a>
+</div>
+<!-- workspace name retained as data hook for tests, hidden from view -->
+<span hidden data-field="ws-name">${esc(workspaceName)}</span>`;
+}
+function errorPanelInner(title, trustedDetailHtml, retryUrl) {
+  return `
+<div class="orb-wrap is-error">
+  <div class="orb-ring r1"></div>
+  <div class="orb-ring r2"></div>
+  <div class="orb-ring r3"></div>
+  <div class="orb-core"><div class="orb-dot"></div></div>
+</div>
+<div class="eyebrow danger"><span class="dot"></span>Couldn't connect</div>
+<h2 class="err-title" data-field="err-title">${esc(title)}</h2>
+<p class="err-msg" data-field="err-msg">${trustedDetailHtml}</p>
+<div class="err-actions">
+  <a href="${esc(retryUrl)}" class="btn-secondary" data-retry-link>&larr; Try again</a>
+  <a href="${esc(apiKeysUrl())}" target="_blank" rel="noopener noreferrer" class="btn-secondary">Get an API key &rarr;</a>
+</div>`;
+}
+var cmdScript = `
+(function(){
+  function bindCmd(pill){
+    if(!pill||pill.__bound)return;pill.__bound=true;
+    var textEl=pill.querySelector('[data-cmd-text]');
+    var svgEl=pill.querySelector('[data-cmd-svg]');
+    var redirectUrl=pill.getAttribute('data-redirect')||'';
+    pill.addEventListener('click',function(){
+      var done=function(){
+        pill.classList.add('is-copied');
+        if(textEl)textEl.textContent='Copied';
+        if(svgEl)svgEl.innerHTML='<polyline points="4 12 10 18 20 6"/>';
+        setTimeout(function(){if(redirectUrl)window.location.assign(redirectUrl)},900);
+      };
+      try{
+        if(navigator.clipboard&&navigator.clipboard.writeText){
+          navigator.clipboard.writeText(${JSON.stringify(PASTE_NOW)}).then(done,done);
+        }else{done()}
+      }catch(e){done()}
+    });
+  }
+  document.querySelectorAll('[data-cmd-pill]').forEach(bindCmd);
+})();
+`;
+function authorizeFormPage(params) {
+  const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = params;
+  const providerName = PROVIDER_NAME;
+  const body = `
+<!-- \u2500\u2500\u2500 CONNECT \u2500\u2500\u2500 -->
+<div class="panel" id="p-connect" data-state="connect">
+  <div class="eyebrow">Connect Product Brain</div>
+  <h1 class="form-title">Paste your API key</h1>
+  <p class="form-sub">Give <span data-provider>${esc(providerName)}</span> access to your workspace memory.</p>
+  <form method="POST" action="/authorize" id="f" autocomplete="off">
+    <input type="hidden" name="redirect_uri" value="${esc(redirect_uri)}">
+    <input type="hidden" name="code_challenge" value="${esc(code_challenge)}">
+    <input type="hidden" name="code_challenge_method" value="${esc(code_challenge_method)}">
+    <input type="hidden" name="state" value="${esc(state)}">
+    <input type="hidden" name="client_id" value="${esc(client_id)}">
+    <div class="input-wrap" id="iw">
+      <input type="password" id="k" name="api_key" class="input input-full" placeholder="pb_sk_\u2026" required autofocus spellcheck="false">
+    </div>
+    <div class="hint" id="hint" hidden></div>
+    <button type="submit" class="btn-primary" id="sb" disabled><span id="bt">Connect</span></button>
+  </form>
+  <div class="small-link"><a href="${esc(apiKeysUrl())}" target="_blank" rel="noopener noreferrer">No key? Generate one &rarr;</a></div>
+</div>
+
+<!-- \u2500\u2500\u2500 VERIFYING \u2500\u2500\u2500 -->
+<div class="panel" id="p-verifying" data-state="verifying" hidden>
+  <div class="orb-wrap is-verifying">
+    <div class="orb-ring r1"></div>
+    <div class="orb-ring r2"></div>
+    <div class="orb-ring r3"></div>
+    <div class="orb-core"><div class="orb-dot"></div></div>
+  </div>
+  <div class="verifying-eyebrow">Handshake</div>
+  <h2 class="verifying-title">Verifying key\u2026</h2>
+  <p class="verifying-sub" id="verify-sub">Checking workspace \xB7 \u2026</p>
+</div>
+
+<!-- \u2500\u2500\u2500 CONNECTED (filled by JS from JSON response) \u2500\u2500\u2500 -->
+<div class="panel" id="p-connected" data-state="connected" hidden></div>
+
+<!-- \u2500\u2500\u2500 ERROR (filled by JS from JSON response) \u2500\u2500\u2500 -->
+<div class="panel" id="p-error" data-state="error" hidden></div>
+
+<template id="tpl-connected">${successPanelInner("__WS__", "__URL__", "__PROVIDER__")}</template>
+<template id="tpl-error">${errorPanelInner("__TITLE__", "__DETAIL__", "__RETRY__")}</template>
+
+<script>
+${cmdScript}
+(function(){
+  var f=document.getElementById('f'),k=document.getElementById('k'),iw=document.getElementById('iw'),hint=document.getElementById('hint'),sb=document.getElementById('sb'),bt=document.getElementById('bt');
+  var pConnect=document.getElementById('p-connect'),pVerify=document.getElementById('p-verifying'),pOk=document.getElementById('p-connected'),pErr=document.getElementById('p-error');
+  var verifySub=document.getElementById('verify-sub');
+
+  function show(panel){
+    [pConnect,pVerify,pOk,pErr].forEach(function(p){
+      if(p===panel){p.removeAttribute('hidden')}else{p.setAttribute('hidden','')}
+    });
+  }
+
+  function syncInput(){
+    sb.disabled=!k.value.trim();
+    iw.classList.remove('has-error');
+    hint.classList.remove('is-error');
+    hint.textContent='';
+    hint.setAttribute('hidden','');
+  }
+  k.addEventListener('input',syncInput);
+  k.addEventListener('keydown',function(e){
+    if(e.key==='Escape'){k.value='';syncInput()}
+  });
+
+  function showError(title,detailHtml){
+    var tpl=document.getElementById('tpl-error');
+    var html=tpl.innerHTML
+      .replace('__TITLE__',title.replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]}))
+      .replace('__DETAIL__',detailHtml)
+      .replace('__RETRY__','#');
+    pErr.innerHTML=html;
+    var retry=pErr.querySelector('[data-retry-link]');
+    if(retry){retry.addEventListener('click',function(e){e.preventDefault();show(pConnect);k.focus();k.select()})}
+    show(pErr);
+  }
+
+  function showSuccess(workspaceName,redirectUrl,providerName){
+    var tpl=document.getElementById('tpl-connected');
+    var safeWs=String(workspaceName||'').replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]});
+    var safeProv=String(providerName||'your assistant').replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]});
+    var safeUrl=String(redirectUrl||'').replace(/"/g,'&quot;').replace(/[<>]/g,function(c){return{'<':'&lt;','>':'&gt;'}[c]});
+    var html=tpl.innerHTML.split('__WS__').join(safeWs).split('__URL__').join(safeUrl).split('__PROVIDER__').join(safeProv);
+    pOk.innerHTML=html;
+    pOk.querySelectorAll('[data-cmd-pill]').forEach(function(pill){
+      pill.__bound=false;
+    });
+    // Re-run binder
+    var s=document.createElement('script');s.textContent=${JSON.stringify(cmdScript)};document.body.appendChild(s);s.remove();
+    show(pOk);
+  }
+
+  f.addEventListener('submit',function(e){
+    e.preventDefault();
+    var v=k.value.trim();
+    if(!v){iw.classList.add('has-error');hint.classList.add('is-error');hint.textContent='Paste your key first';hint.removeAttribute('hidden');return}
+    sb.disabled=true;bt.textContent='Verifying';
+    show(pVerify);
+
+    var steps=['Checking workspace \xB7 \u2026','Loading chain \xB7 \u2026','Establishing memory \xB7 \u2026'];
+    var i=0;verifySub.textContent=steps[0];
+    var ti=setInterval(function(){i++;if(i>=steps.length){clearInterval(ti);return}verifySub.textContent=steps[i]},900);
+
+    var minDelay=new Promise(function(r){setTimeout(r,2800)});
+    var fd=new FormData(f);
+    var body=new URLSearchParams();
+    fd.forEach(function(val,key){body.append(key,String(val))});
+
+    var req=fetch('/authorize',{
+      method:'POST',
+      headers:{'Accept':'application/json','Content-Type':'application/x-www-form-urlencoded'},
+      body:body.toString(),
+      credentials:'same-origin'
+    }).then(function(r){return r.json().then(function(j){return{status:r.status,body:j}})});
+
+    Promise.all([req,minDelay]).then(function(arr){
+      clearInterval(ti);
+      var res=arr[0];
+      if(res.body&&res.body.ok){
+        showSuccess(res.body.workspaceName,res.body.redirectUrl,res.body.providerName);
+      }else{
+        showError(res.body&&res.body.title||'Couldn\\'t connect',res.body&&res.body.detail||'Try again, or generate a new key.');
+        sb.disabled=false;bt.textContent='Connect';
+      }
+    }).catch(function(){
+      clearInterval(ti);
+      showError('Network error','We couldn\\'t reach Product Brain. Check your connection and try again.');
+      sb.disabled=false;bt.textContent='Connect';
+    });
+  });
+
+  k.focus();
+})();
+</script>`;
+  return authPageShell("Connect Product Brain", body);
+}
+function authorizeSuccessPage(workspaceName, redirectUrl, providerName) {
+  const body = `
+<div class="panel" data-state="connected">
+${successPanelInner(workspaceName, redirectUrl, providerName)}
+</div>
+<script>${cmdScript}</script>`;
+  return authPageShell("Connected", body);
+}
+function authorizeErrorPage(title, trustedDetailHtml, retryUrl) {
+  const body = `
+<div class="panel" data-state="error">
+${errorPanelInner(title, trustedDetailHtml, retryUrl)}
+</div>`;
+  return authPageShell("Connection error", body);
+}
+app.get("/authorize", authLimiter, (req, res) => {
+  const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.query;
+  const refusal = checkRedirectUri(redirect_uri, OAUTH_REDIRECT_ALLOWLIST);
+  if (refusal) {
+    logOAuthDoor("GET /authorize", 400, refusal);
+    res.status(400).json({ error: "invalid_request", error_description: refusal });
+    return;
+  }
+  res.type("html").send(authorizeFormPage({
+    redirect_uri: String(redirect_uri ?? ""),
+    code_challenge: String(code_challenge ?? ""),
+    code_challenge_method: String(code_challenge_method ?? "S256"),
+    state: String(state ?? ""),
+    client_id: String(client_id ?? "")
+  }));
 });
 app.post(
   "/authorize",
+  authLimiter,
   express.urlencoded({ extended: false }),
-  (req, res) => {
-    const { api_key, redirect_uri, code_challenge, state } = req.body;
-    if (!api_key?.startsWith("pb_sk_")) {
-      res.status(400).send("Invalid API key");
+  async (req, res) => {
+    const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.body;
+    const api_key = normalisePastedKey(req.body.api_key);
+    const wantsJson = String(req.headers["accept"] ?? "").includes("application/json");
+    const retryParams = new URLSearchParams({
+      redirect_uri: redirect_uri ?? "",
+      code_challenge: code_challenge ?? "",
+      code_challenge_method: code_challenge_method ?? "S256",
+      ...state ? { state } : {},
+      ...client_id ? { client_id } : {}
+    }).toString();
+    const retryUrl = `/authorize?${retryParams}`;
+    function sendError(title, trustedDetailHtml, status = 400) {
+      logOAuthDoor("POST /authorize", status, title);
+      if (wantsJson) {
+        res.status(status).json({ ok: false, title, detail: trustedDetailHtml });
+      } else {
+        res.status(status).type("html").send(authorizeErrorPage(title, trustedDetailHtml, retryUrl));
+      }
+    }
+    if (isCrossSiteFormPost(req.headers["origin"], req.headers["sec-fetch-site"], baseUrl(req))) {
+      sendError("Request refused", "This form only accepts keys sent from its own sign-in page. Open the connect link again.", 403);
+      return;
+    }
+    const nowTs = Date.now();
+    const pasted = resolvePastedKey(api_key);
+    const lockout = authLockoutError(authFailures, pasted, nowTs);
+    if (lockout) {
+      const retryAfter = lockout.headers["Retry-After"];
+      res.setHeader("Retry-After", retryAfter);
+      sendError("Too many attempts", `This key was not recognized too many times. Try again in ${retryAfter}s.`, 429);
+      return;
+    }
+    if (pasted.status !== "ok") {
+      if (pasted.status === "rejected") recordAuthFailure(authFailures, pasted.credentialId, nowTs);
+      sendError("Invalid key format", "API keys start with <code>pb_sk_</code>. Check your key and try again.");
+      return;
+    }
+    if (!client_id) {
+      logOAuthDoor("POST /authorize", 400, "client_id is required");
+      res.status(400).json({ error: "invalid_request", error_description: "client_id is required" });
+      return;
+    }
+    const redirectRefusal = checkRedirectUri(redirect_uri, OAUTH_REDIRECT_ALLOWLIST);
+    if (redirectRefusal) {
+      logOAuthDoor("POST /authorize", 400, redirectRefusal);
+      res.status(400).json({ error: "invalid_request", error_description: redirectRefusal });
+      return;
+    }
+    let workspaceName = "Your Workspace";
+    const check = await checkKeyAgainstCandidates(keyCheckCandidates(), api_key, 5e3);
+    const gate = keyVerdictGate(check.verdict, authFailures, pasted.credentialId, nowTs);
+    if (check.verdict === "ok") {
+      if (check.workspaceName) workspaceName = check.workspaceName;
+      getKeyState(api_key).deploymentUrl = check.deploymentUrl;
+    } else if (check.verdict === "rate_limited") {
+      sendError(
+        "Rate limited",
+        `This API key is valid but temporarily rate limited. Try again in ${check.retryAfterSeconds ?? 60}s.`,
+        429
+      );
       return;
+    } else if (gate === "unauthorized") {
+      sendError("Key not recognized", "This API key wasn't found in Product Brain. Check your API Keys in Cortex and try again.", 401);
+      return;
+    } else {
+      process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
     }
     const code = randomUUID();
     pendingCodes.set(code, {
@@ -185,53 +1145,44 @@ app.post(
     const url = new URL(redirect_uri);
     url.searchParams.set("code", code);
     if (state) url.searchParams.set("state", state);
-    res.redirect(302, url.toString());
+    const redirectUrl = url.toString();
+    const providerName = PROVIDER_NAME;
+    logOAuthDoor("POST /authorize", 200, "code_issued");
+    if (wantsJson) {
+      res.json({ ok: true, workspaceName, redirectUrl, providerName });
+    } else {
+      res.type("html").send(authorizeSuccessPage(workspaceName, redirectUrl, providerName));
+    }
   }
 );
-function issueTokens(apiKey) {
-  const refreshToken = `pb_rt_${randomUUID()}`;
-  refreshTokens.set(refreshToken, { apiKey, createdAt: Date.now() });
-  return {
-    access_token: apiKey,
-    token_type: "Bearer",
-    expires_in: ACCESS_TOKEN_TTL,
-    refresh_token: refreshToken
-  };
-}
 app.post(
   "/oauth/token",
   express.urlencoded({ extended: false }),
   express.json(),
   (req, res) => {
-    const { grant_type, code, code_verifier, redirect_uri, refresh_token } = req.body;
-    if (grant_type === "refresh_token") {
-      const entry = refreshTokens.get(refresh_token);
-      if (!entry) {
-        res.status(400).json({ error: "invalid_grant", error_description: "Invalid refresh token" });
-        return;
-      }
-      if (Date.now() - entry.createdAt > REFRESH_TOKEN_TTL_MS) {
-        refreshTokens.delete(refresh_token);
-        res.status(400).json({ error: "invalid_grant", error_description: "Refresh token expired" });
-        return;
-      }
-      const apiKey = entry.apiKey;
-      refreshTokens.delete(refresh_token);
-      res.json(issueTokens(apiKey));
-      return;
-    }
+    const { grant_type, code, code_verifier, redirect_uri } = req.body ?? {};
     if (grant_type !== "authorization_code") {
+      logOAuthDoor("POST /oauth/token", 400, "unsupported_grant_type");
       res.status(400).json({ error: "unsupported_grant_type" });
       return;
     }
     const pending = pendingCodes.get(code);
-    if (!pending || pending.redirectUri !== redirect_uri) {
+    const codeRefusal = pendingCodeRefusal(pending, redirect_uri, Date.now());
+    if (codeRefusal === "expired") {
+      pendingCodes.delete(code);
+      logOAuthDoor("POST /oauth/token", 400, "expired");
+      res.status(400).json({ error: "invalid_grant", error_description: "authorization code expired" });
+      return;
+    }
+    if (codeRefusal || !pending) {
+      logOAuthDoor("POST /oauth/token", 400, codeRefusal ?? "unknown_code");
       res.status(400).json({ error: "invalid_grant" });
       return;
     }
     const challenge = createHash("sha256").update(code_verifier ?? "").digest("base64url");
     if (challenge !== pending.codeChallenge) {
       pendingCodes.delete(code);
+      logOAuthDoor("POST /oauth/token", 400, "pkce_failed");
       res.status(400).json({
         error: "invalid_grant",
         error_description: "PKCE verification failed"
@@ -239,51 +1190,56 @@ app.post(
       return;
     }
     pendingCodes.delete(code);
-    res.json(issueTokens(pending.apiKey));
+    logOAuthDoor("POST /oauth/token", 200, "token_issued");
+    res.json(tokenResponse(pending.apiKey));
   }
 );
-var mcpLimiter = rateLimit({
-  windowMs: 6e4,
-  max: 120,
-  standardHeaders: true,
-  legacyHeaders: false,
-  message: { error: "Too many requests. Try again later." }
-});
+var mcpLimit = mcpLimiters();
+var authFailures = /* @__PURE__ */ new Map();
 app.get("/health", (_req, res) => {
   res.json({ status: "ok", version: SERVER_VERSION, transport: "http" });
 });
 var sessions = /* @__PURE__ */ new Map();
 var SESSION_TTL_MS = 30 * 60 * 1e3;
 var MAX_SESSIONS = 200;
+var EVICT_GRACE_MS = 6e4;
+var MAX_SESSIONS_PER_KEY = Math.max(
+  1,
+  Math.min(MAX_SESSIONS - 1, Number(process.env.MCP_MAX_SESSIONS_PER_KEY) || 25)
+);
 function evictStaleSessions() {
   const now = Date.now();
   for (const [id, entry] of sessions) {
     if (now - entry.lastAccess > SESSION_TTL_MS) {
-      logSessionLifecycle("session_deleted", id, "ttl");
+      logSessionLifecycle(
+        "session_deleted",
+        id,
+        entry.inFlight > 0 ? "inflight_leak" : "ttl"
+      );
       entry.transport.close().catch(() => {
       });
       sessions.delete(id);
     }
   }
   if (sessions.size > MAX_SESSIONS) {
-    const sorted = [...sessions.entries()].sort(
-      (a, b) => a[1].lastAccess - b[1].lastAccess
-    );
-    for (let i = 0; i < sorted.length - MAX_SESSIONS; i++) {
+    const sorted = [...sessions.entries()].filter(([, e]) => e.inFlight === 0).sort((a, b) => a[1].lastAccess - b[1].lastAccess);
+    const overflow = sessions.size - MAX_SESSIONS;
+    for (let i = 0; i < Math.min(overflow, sorted.length); i++) {
       logSessionLifecycle("session_deleted", sorted[i][0], "eviction");
       sorted[i][1].transport.close().catch(() => {
       });
       sessions.delete(sorted[i][0]);
     }
+    if (sessions.size > MAX_SESSIONS) {
+      const ts = (/* @__PURE__ */ new Date()).toISOString();
+      process.stderr.write(
+        `[HTTP] ${ts} session_cap_breach size=${sessions.size} max=${MAX_SESSIONS} reason=all_inflight (no idle sessions to evict; TTL backstop will reclaim)
+`
+      );
+    }
   }
 }
 setInterval(evictStaleSessions, 6e4);
-function extractBearerKey(req) {
-  const header = req.headers?.authorization;
-  if (typeof header !== "string" || !header.startsWith("Bearer ")) return null;
-  const token = header.slice(7).trim();
-  return token.startsWith("pb_sk_") ? token : null;
-}
 function send401(req, res) {
   const base = baseUrl(req);
   res.status(401).set(
@@ -304,41 +1260,137 @@ function logSessionLifecycle(event, sessionId, reason) {
   process.stderr.write(`[HTTP] ${ts} ${event} session=${sessionId}${r}
 `);
 }
-app.post("/mcp", mcpLimiter, async (req, res) => {
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+app.post("/mcp", ...mcpLimit, async (req, res) => {
+  const nowTs = Date.now();
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  const lockout = authLockoutError(authFailures, auth, nowTs, req.body?.id ?? null);
+  if (lockout) {
+    send429(res, lockout);
+    return;
+  }
+  if (auth.status !== "ok") {
     logRequest("POST", "auth_fail");
+    if (auth.status === "rejected") recordAuthFailure(authFailures, auth.credentialId, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   const reqStart = Date.now();
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       if (sessionId && sessions.has(sessionId)) {
         const entry = sessions.get(sessionId);
-        entry.lastAccess = Date.now();
-        await entry.transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", sessionId, Date.now() - reqStart);
+        if (entry.keyHash !== hashKey(apiKey)) {
+          res.status(403).json({
+            jsonrpc: "2.0",
+            error: { code: -32e3, message: "Session key mismatch" },
+            id: null
+          });
+          return;
+        }
+        try {
+          entry.inFlight++;
+          entry.lastAccess = Date.now();
+          await entry.transport.handleRequest(req, res, req.body);
+          logRequest("POST", "ok", sessionId, Date.now() - reqStart);
+        } finally {
+          entry.inFlight--;
+          entry.lastAccess = Date.now();
+        }
       } else if (!sessionId && isInitializeRequest(req.body)) {
+        const check = await checkKeyAgainstCandidates(keyCheckCandidates(), apiKey, 5e3);
+        const gate = keyVerdictGate(check.verdict, authFailures, auth.credentialId, Date.now());
+        if (gate === "unauthorized") {
+          logRequest("POST", "auth_fail");
+          send401(req, res);
+          return;
+        }
+        if (gate === "unavailable") {
+          res.status(503).json({
+            jsonrpc: "2.0",
+            error: { code: -32e3, message: "Product Brain could not verify this API key right now. Retry shortly." },
+            id: req.body?.id ?? null
+          });
+          return;
+        }
+        if (check.verdict === "ok" || check.verdict === "rate_limited") getKeyState(apiKey).deploymentUrl = check.deploymentUrl;
+        const keyH = hashKey(apiKey);
+        const plan = planKeyAdmission(
+          sessions,
+          keyH,
+          MAX_SESSIONS_PER_KEY,
+          Date.now(),
+          { ttlMs: SESSION_TTL_MS, graceMs: EVICT_GRACE_MS }
+        );
+        for (const sid2 of plan.evict) {
+          const victim = sessions.get(sid2);
+          sessions.delete(sid2);
+          victim?.transport.close().catch(() => {
+          });
+          logSessionLifecycle("session_deleted", sid2, "lru_evict");
+        }
+        if (!plan.admit) {
+          send429(res, buildSessionCapError({
+            retryAfterSeconds: plan.retryAfterSeconds,
+            limit: MAX_SESSIONS_PER_KEY,
+            current: countKeySessions(sessions, keyH),
+            poll: plan.retryIsPoll,
+            id: req.body?.id ?? null
+          }));
+          return;
+        }
+        const sid = randomUUID();
+        let initialized = false;
         const transport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID(),
-          onsessioninitialized: (sid) => {
-            sessions.set(sid, { transport, lastAccess: Date.now() });
-            logSessionLifecycle("session_created", sid);
+          sessionIdGenerator: () => sid,
+          onsessioninitialized: (s) => {
+            initialized = true;
+            logSessionLifecycle("session_created", s);
           }
+          // log only — no map write
         });
+        const reserved = { transport, lastAccess: Date.now(), keyHash: keyH, inFlight: 1 };
+        sessions.set(sid, reserved);
         transport.onclose = () => {
-          const sid = transport.sessionId;
-          if (sid) {
-            logSessionLifecycle("session_deleted", sid, "onclose");
-            sessions.delete(sid);
+          const s = transport.sessionId ?? sid;
+          forgetStreamLifecycle(keyH, s);
+          if (sessions.has(s)) {
+            sessions.delete(s);
+            logSessionLifecycle("session_deleted", s, "onclose");
           }
         };
-        const server = createProductBrainServer();
-        await server.connect(transport);
-        await transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+        try {
+          const server = createProductBrainServer();
+          await server.connect(transport);
+          await transport.handleRequest(req, res, req.body);
+          logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+        } catch (e) {
+          transport.onclose = void 0;
+          sessions.delete(sid);
+          throw e;
+        } finally {
+          if (!initialized) {
+            transport.onclose = void 0;
+            if (sessions.delete(sid)) logSessionLifecycle("session_deleted", sid, "init_rejected");
+          } else {
+            const e = sessions.get(sid);
+            if (e) {
+              e.inFlight--;
+              e.lastAccess = Date.now();
+            }
+          }
+        }
+      } else if (sessionId) {
+        process.stderr.write(
+          `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale sessionId=${sessionId} (likely server restart \u2014 instructing client to re-initialise)
+`
+        );
+        res.status(404).json({
+          jsonrpc: "2.0",
+          error: { code: -32001, message: "Session not found \u2014 re-initialise" },
+          id: null
+        });
       } else {
         process.stderr.write(
           `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_invalid no valid session ID (client may have omitted Mcp-Session-Id)
@@ -362,21 +1414,45 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
     }
   }
 });
-app.get("/mcp", mcpLimiter, async (req, res) => {
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+app.get("/mcp", ...mcpLimit, async (req, res) => {
+  const nowTs = Date.now();
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  const lockout = authLockoutError(authFailures, auth, nowTs, req.body?.id ?? null);
+  if (lockout) {
+    send429(res, lockout);
+    return;
+  }
+  if (auth.status !== "ok") {
     logRequest("GET", "auth_fail");
+    if (auth.status === "rejected") recordAuthFailure(authFailures, auth.credentialId, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
-  if (!sessionId || !sessions.has(sessionId)) {
-    res.status(400).send("Invalid or missing session ID");
+  if (!sessionId) {
+    res.status(400).send("Missing Mcp-Session-Id header");
+    return;
+  }
+  if (!sessions.has(sessionId)) {
+    process.stderr.write(
+      `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale GET sessionId=${sessionId}
+`
+    );
+    res.status(404).send("Session not found \u2014 re-initialise");
     return;
   }
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       const entry = sessions.get(sessionId);
+      if (entry.keyHash !== hashKey(apiKey)) {
+        res.status(403).json({
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Session key mismatch" },
+          id: null
+        });
+        return;
+      }
       entry.lastAccess = Date.now();
       await entry.transport.handleRequest(req, res);
       logRequest("GET", "ok", sessionId);
@@ -385,21 +1461,45 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
     logRequest("GET", "error", sessionId);
   }
 });
-app.delete("/mcp", mcpLimiter, async (req, res) => {
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+app.delete("/mcp", ...mcpLimit, async (req, res) => {
+  const nowTs = Date.now();
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  const lockout = authLockoutError(authFailures, auth, nowTs, req.body?.id ?? null);
+  if (lockout) {
+    send429(res, lockout);
+    return;
+  }
+  if (auth.status !== "ok") {
     logRequest("DELETE", "auth_fail");
+    if (auth.status === "rejected") recordAuthFailure(authFailures, auth.credentialId, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
-  if (!sessionId || !sessions.has(sessionId)) {
-    res.status(400).send("Invalid or missing session ID");
+  if (!sessionId) {
+    res.status(400).send("Missing Mcp-Session-Id header");
+    return;
+  }
+  if (!sessions.has(sessionId)) {
+    process.stderr.write(
+      `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale DELETE sessionId=${sessionId}
+`
+    );
+    res.status(404).send("Session not found \u2014 re-initialise");
     return;
   }
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       const entry = sessions.get(sessionId);
+      if (entry.keyHash !== hashKey(apiKey)) {
+        res.status(403).json({
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Session key mismatch" },
+          id: null
+        });
+        return;
+      }
       await entry.transport.handleRequest(req, res);
       logRequest("DELETE", "ok", sessionId);
     });
@@ -425,10 +1525,6 @@ async function gracefulShutdown() {
     await entry.transport.close().catch(() => {
     });
   }
-  try {
-    await shutdownAnalytics();
-  } catch {
-  }
   process.exit(0);
 }
 var LISTEN_HOST = "0.0.0.0";