@productbrain/mcp 0.0.1-beta.18 → 0.0.1-beta.181

package/dist/http.js

@@ -1,15 +1,18 @@
 import {
+  DEFAULT_CLOUD_URL,
   SERVER_VERSION,
-  createProductBrainServer
-} from "./chunk-TUNNDDD7.js";
-import {
   bootstrapHttp,
+  createProductBrainServer,
+  getKeyState,
+  hashKey,
+  initFeatureFlags,
   runWithAuth
-} from "./chunk-47LO6K2R.js";
+} from "./chunk-XPFSARXP.js";
 import {
+  getPostHogClient,
   initAnalytics,
   shutdownAnalytics
-} from "./chunk-XBMI6QHR.js";
+} from "./chunk-YMF3IQ5E.js";
 
 // src/http.ts
 import { createHash, randomUUID } from "crypto";
@@ -19,19 +22,21 @@ import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import rateLimit from "express-rate-limit";
 bootstrapHttp();
 initAnalytics();
-var PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? "3000", 10);
+initFeatureFlags(getPostHogClient());
+var PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? "3002", 10);
 function baseUrl(req) {
   const proto = req.headers["x-forwarded-proto"] ?? req.protocol ?? "http";
   const host = req.headers.host ?? `localhost:${PORT}`;
   return `${proto}://${host}`;
 }
 var app = express();
+app.set("trust proxy", 1);
 app.use(express.json());
 var ALLOWED_ORIGINS = process.env.CORS_ORIGINS?.split(",").map((o) => o.trim()).filter(Boolean);
 app.use((_req, res, next) => {
   const origin = _req.headers.origin;
-  if (!ALLOWED_ORIGINS || origin && ALLOWED_ORIGINS.includes(origin)) {
-    res.setHeader("Access-Control-Allow-Origin", origin ?? "*");
+  if (ALLOWED_ORIGINS && origin && ALLOWED_ORIGINS.includes(origin)) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
   }
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
   res.setHeader(
@@ -62,17 +67,33 @@ app.get("/.well-known/oauth-authorization-server", (req, res) => {
     token_endpoint: `${base}/oauth/token`,
     registration_endpoint: `${base}/register`,
     response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code"],
+    grant_types_supported: ["authorization_code", "refresh_token"],
     code_challenge_methods_supported: ["S256"],
     token_endpoint_auth_methods_supported: ["none"],
     scopes_supported: ["mcp:tools", "mcp:resources"]
   });
 });
+var authLimiter = rateLimit({
+  windowMs: 6e4,
+  max: 20,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: "Too many auth requests. Try again later." }
+});
 var registeredClients = /* @__PURE__ */ new Map();
+var MAX_REGISTERED_CLIENTS = 500;
 app.post(
   "/register",
+  authLimiter,
   express.json(),
   (req, res) => {
+    if (registeredClients.size >= MAX_REGISTERED_CLIENTS) {
+      res.status(503).json({
+        error: "server_error",
+        error_description: "Registration limit reached. Try again later."
+      });
+      return;
+    }
     const { redirect_uris, client_name } = req.body;
     if (!Array.isArray(redirect_uris) || redirect_uris.length === 0) {
       res.status(400).json({
@@ -100,6 +121,13 @@ app.post(
   }
 );
 var pendingCodes = /* @__PURE__ */ new Map();
+var ACCESS_TOKEN_TTL = 3600;
+var ACCESS_TOKEN_TTL_MS = ACCESS_TOKEN_TTL * 1e3;
+var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
+var refreshTokens = /* @__PURE__ */ new Map();
+var MAX_REFRESH_TOKENS = 2e3;
+var MAX_REFRESH_TOKENS_PER_KEY = 20;
+var accessTokens = /* @__PURE__ */ new Map();
 setInterval(() => {
   const now = Date.now();
   for (const [code, auth] of pendingCodes) {
@@ -108,63 +136,258 @@ setInterval(() => {
   for (const [id, client] of registeredClients) {
     if (now - client.registeredAt > 24 * 60 * 6e4) registeredClients.delete(id);
   }
+  for (const [token, entry] of refreshTokens) {
+    if (now - entry.createdAt > REFRESH_TOKEN_TTL_MS) refreshTokens.delete(token);
+  }
+  if (refreshTokens.size > MAX_REFRESH_TOKENS) {
+    const sorted = [...refreshTokens.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
+    for (let i = 0; i < sorted.length - MAX_REFRESH_TOKENS; i++) {
+      refreshTokens.delete(sorted[i][0]);
+    }
+  }
+  for (const [token, entry] of accessTokens) {
+    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) accessTokens.delete(token);
+  }
+  for (const [ip, rec] of authFailures) {
+    if (rec.blockedUntil < now && rec.firstFailure + AUTH_FAILURE_WINDOW_MS < now) {
+      authFailures.delete(ip);
+    }
+  }
+  if (authFailures.size > MAX_AUTH_FAILURE_ENTRIES) {
+    const sorted = [...authFailures.entries()].sort((a, b) => a[1].firstFailure - b[1].firstFailure);
+    for (let i = 0; i < sorted.length - MAX_AUTH_FAILURE_ENTRIES; i++) {
+      authFailures.delete(sorted[i][0]);
+    }
+  }
 }, 6e4);
 function esc(s) {
   return String(s ?? "").replace(
-    /[&"<>]/g,
-    (c) => ({ "&": "&amp;", '"': "&quot;", "<": "&lt;", ">": "&gt;" })[c]
+    /[&"'<>]/g,
+    (c) => ({ "&": "&amp;", '"': "&quot;", "'": "&#39;", "<": "&lt;", ">": "&gt;" })[c]
   );
 }
-app.get("/authorize", (req, res) => {
-  const { redirect_uri, code_challenge, code_challenge_method, state } = req.query;
-  res.type("html").send(`<!DOCTYPE html>
+function authPageShell(title, bodyContent, headExtra = "") {
+  return `<!DOCTYPE html>
 <html lang="en"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Authorize \u2014 Product Brain</title>
+<title>${title} \u2014 Product Brain</title>
+${headExtra}
 <style>
+:root{--bg:#0d0c10;--surface:#18161e;--border:#2d2840;--border-focus:#7c3aed;--text:#e8e4f0;--muted:#7b7590;--accent:#7c3aed;--accent-h:#6d28d9;--err:#f87171;--ok:#34d399}
 *{margin:0;padding:0;box-sizing:border-box}
-body{font-family:-apple-system,system-ui,sans-serif;background:#0a0a0a;color:#e5e5e5;
-  display:flex;align-items:center;justify-content:center;min-height:100vh;padding:1rem}
-.card{background:#1a1a1a;border:1px solid #333;border-radius:12px;padding:2rem;max-width:400px;width:100%}
-h1{font-size:1.2rem;margin-bottom:.25rem}
-.sub{color:#999;font-size:.85rem;margin-bottom:1.5rem}
-label{display:block;font-size:.85rem;margin-bottom:.4rem;color:#ccc}
-input[type=password]{width:100%;padding:.6rem .75rem;background:#111;border:1px solid #444;
-  border-radius:8px;color:#e5e5e5;font:.85rem/1.4 monospace}
-input:focus{outline:none;border-color:#7c3aed}
-button{width:100%;padding:.6rem;background:#7c3aed;color:#fff;border:none;
-  border-radius:8px;font-size:.85rem;cursor:pointer;margin-top:1rem}
-button:hover{background:#6d28d9}
-.err{color:#ef4444;font-size:.8rem;margin-top:.5rem;display:none}
-</style></head><body>
-<div class="card">
-<h1>Product Brain</h1>
-<p class="sub">Enter your API key to connect Claude to your workspace.</p>
-<form method="POST" action="/authorize">
+body{font-family:-apple-system,BlinkMacSystemFont,'Inter',system-ui,sans-serif;background:var(--bg);color:var(--text);min-height:100vh;display:flex;align-items:center;justify-content:center;padding:1.5rem}
+body::before{content:'';position:fixed;inset:0;background-image:radial-gradient(circle,#3d3560 1px,transparent 1px);background-size:28px 28px;opacity:.22;pointer-events:none;z-index:0}
+.card{position:relative;z-index:1;background:var(--surface);border:1px solid var(--border);border-radius:16px;padding:2rem 2rem 1.75rem;max-width:380px;width:100%}
+</style>
+</head><body>
+<div class="card">${bodyContent}</div>
+</body></html>`;
+}
+function authorizeFormPage(params) {
+  const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = params;
+  const body = `
+<style>
+.brand{display:flex;align-items:center;gap:.55rem;margin-bottom:1.5rem}
+.brand-icon{width:30px;height:30px;background:var(--accent);border-radius:8px;display:flex;align-items:center;justify-content:center;font-size:1rem;flex-shrink:0}
+.brand-name{font-size:.88rem;font-weight:600;letter-spacing:-.01em}
+h1{font-size:1.3rem;font-weight:700;letter-spacing:-.02em;margin-bottom:.35rem;line-height:1.3}
+.sub{font-size:.8rem;color:var(--muted);margin-bottom:1.75rem;line-height:1.55}
+label{display:block;font-size:.72rem;font-weight:600;color:#a89fc4;margin-bottom:.4rem;letter-spacing:.04em;text-transform:uppercase}
+.inp-wrap{position:relative}
+input[type=password]{width:100%;padding:.65rem .85rem;background:var(--bg);border:1px solid var(--border);border-radius:10px;color:var(--text);font:.875rem/1.4 'JetBrains Mono','Fira Code',ui-monospace,monospace;outline:none;transition:border-color .15s,box-shadow .15s}
+input:focus{border-color:var(--accent);box-shadow:0 0 0 3px rgba(124,58,237,.15)}
+input.err{border-color:var(--err);box-shadow:0 0 0 3px rgba(248,113,113,.12)}
+.field-row{display:flex;align-items:center;justify-content:space-between;margin-top:.4rem}
+.hint{font-size:.73rem;color:var(--muted)}
+.hint code{font-size:.72rem;background:rgba(255,255,255,.06);padding:.1rem .3rem;border-radius:4px}
+.get-key{font-size:.73rem;color:var(--accent);text-decoration:none;opacity:.85;transition:opacity .1s}
+.get-key:hover{opacity:1;text-decoration:underline}
+.err-msg{font-size:.73rem;color:var(--err);margin-top:.35rem;display:none}
+.err-msg.show{display:block}
+.btn{width:100%;padding:.7rem;background:var(--accent);color:#fff;border:none;border-radius:10px;font-size:.88rem;font-weight:600;cursor:pointer;margin-top:1.25rem;letter-spacing:-.01em;transition:background .15s,transform .1s;display:flex;align-items:center;justify-content:center;gap:.5rem}
+.btn:hover{background:var(--accent-h)}
+.btn:active{transform:scale(.98)}
+.btn:disabled{opacity:.6;cursor:not-allowed;transform:none}
+.spinner{width:15px;height:15px;border:2px solid rgba(255,255,255,.3);border-top-color:#fff;border-radius:50%;animation:spin .7s linear infinite;display:none}
+@keyframes spin{to{transform:rotate(360deg)}}
+.divider{height:1px;background:var(--border);margin:1.5rem -2rem}
+.footer{font-size:.7rem;color:var(--muted);text-align:center;padding-top:.5rem;line-height:1.6}
+.footer a{color:var(--muted);text-decoration:underline}
+</style>
+<div class="brand"><div class="brand-icon">&#11041;</div><span class="brand-name">Product Brain</span></div>
+<h1>Connect to Claude</h1>
+<p class="sub">Enter your API key to give Claude access to your workspace.</p>
+<form method="POST" action="/authorize" id="f">
   <input type="hidden" name="redirect_uri" value="${esc(redirect_uri)}">
   <input type="hidden" name="code_challenge" value="${esc(code_challenge)}">
   <input type="hidden" name="code_challenge_method" value="${esc(code_challenge_method)}">
   <input type="hidden" name="state" value="${esc(state)}">
+  <input type="hidden" name="client_id" value="${esc(client_id)}">
   <label for="k">API Key</label>
-  <input type="password" id="k" name="api_key" placeholder="pb_sk_\u2026" required autofocus>
-  <p class="err" id="e">Key must start with pb_sk_</p>
-  <button type="submit">Authorize</button>
+  <div class="inp-wrap">
+    <input type="password" id="k" name="api_key" placeholder="pb_sk_\u2026" required autofocus autocomplete="off">
+  </div>
+  <div class="field-row">
+    <span class="hint">Starts with <code>pb_sk_</code></span>
+    <a href="https://productbrain.io" target="_blank" rel="noopener noreferrer" class="get-key">No key? Get one &rarr;</a>
+  </div>
+  <p class="err-msg" id="em">Key must start with <code>pb_sk_</code></p>
+  <button type="submit" class="btn" id="sb">
+    <span id="bt">Authorize</span>
+    <div class="spinner" id="sp"></div>
+  </button>
 </form>
+<div class="divider"></div>
+<p class="footer">Product Brain gives Claude access to your knowledge graph.<br><a href="https://productbrain.io" target="_blank" rel="noopener noreferrer">Learn more</a></p>
+<script>
+var f=document.getElementById('f'),k=document.getElementById('k'),em=document.getElementById('em'),sb=document.getElementById('sb'),bt=document.getElementById('bt'),sp=document.getElementById('sp');
+k.addEventListener('input',function(){var v=k.value.trim();if(v&&!v.startsWith('pb_sk_')){k.classList.add('err');em.classList.add('show')}else{k.classList.remove('err');em.classList.remove('show')}});
+f.addEventListener('submit',function(e){var v=k.value.trim();if(!v.startsWith('pb_sk_')){e.preventDefault();k.classList.add('err');em.classList.add('show');k.focus();return}sb.disabled=true;bt.textContent='Verifying\u2026';sp.style.display='block'});
+</script>`;
+  return authPageShell("Connect to Claude", body);
+}
+function authorizeSuccessPage(workspaceName, redirectUrl) {
+  const safeUrl = JSON.stringify(redirectUrl).replace(/<\/script>/gi, "<\\/script>");
+  const body = `
+<style>
+.card{text-align:center;padding:2.5rem 2rem}
+.ring{width:60px;height:60px;background:rgba(52,211,153,.1);border:1px solid rgba(52,211,153,.25);border-radius:50%;display:flex;align-items:center;justify-content:center;margin:0 auto 1.4rem;animation:pop .5s cubic-bezier(.175,.885,.32,1.275) .15s both}
+@keyframes pop{from{transform:scale(.4);opacity:0}to{transform:scale(1);opacity:1}}
+svg{animation:draw .6s ease .5s both}
+@keyframes draw{from{stroke-dashoffset:30}to{stroke-dashoffset:0}}
+h1{font-size:1.3rem;font-weight:700;letter-spacing:-.02em;margin-bottom:.3rem}
+.ws{font-size:.8rem;color:var(--ok);font-weight:500;margin-bottom:1.5rem}
+.redirect-msg{font-size:.78rem;color:var(--muted);margin-bottom:1.4rem}
+.dots::after{content:'';animation:dots 1.4s steps(4,end) infinite}
+@keyframes dots{0%{content:''}25%{content:'.'}50%{content:'..'}75%{content:'...'}}
+.continue{display:inline-flex;align-items:center;gap:.4rem;padding:.6rem 1.2rem;background:var(--accent);color:#fff;border:none;border-radius:10px;font-size:.84rem;font-weight:600;cursor:pointer;text-decoration:none;transition:background .15s}
+.continue:hover{background:var(--accent-h)}
+@keyframes fadein{from{opacity:0;transform:translateY(6px)}to{opacity:1;transform:translateY(0)}}
+.card{animation:fadein .35s ease}
+</style>
+<div class="ring">
+  <svg width="28" height="28" viewBox="0 0 24 24" fill="none" stroke="#34d399" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="30"><polyline points="20 6 9 17 4 12"/></svg>
 </div>
-<script>document.querySelector("form").onsubmit=function(e){
-if(!document.getElementById("k").value.startsWith("pb_sk_")){
-e.preventDefault();document.getElementById("e").style.display="block"}}</script>
-</body></html>`);
+<h1>Claude is connected</h1>
+<p class="ws">${esc(workspaceName)}</p>
+<p class="redirect-msg">Returning to Claude<span class="dots"></span></p>
+<a href="${esc(redirectUrl)}" class="continue">Continue to Claude &rarr;</a>
+<script>setTimeout(function(){window.location.href=${safeUrl}},1800)</script>`;
+  return authPageShell("Connected", body);
+}
+function authorizeErrorPage(title, trustedDetailHtml, retryUrl) {
+  const body = `
+<style>
+.card{text-align:center;padding:2.25rem 2rem}
+.x-ring{width:52px;height:52px;background:rgba(248,113,113,.1);border:1px solid rgba(248,113,113,.2);border-radius:50%;display:flex;align-items:center;justify-content:center;margin:0 auto 1.25rem;font-size:1.4rem;animation:shake .4s ease .1s}
+@keyframes shake{0%,100%{transform:translateX(0)}25%{transform:translateX(-5px)}75%{transform:translateX(5px)}}
+h1{font-size:1.2rem;font-weight:700;letter-spacing:-.02em;margin-bottom:.5rem;color:var(--err)}
+.detail{font-size:.8rem;color:var(--muted);line-height:1.6;margin-bottom:1.5rem}
+.detail code{font-size:.75rem;background:rgba(255,255,255,.06);padding:.1rem .3rem;border-radius:4px}
+.actions{display:flex;gap:.75rem;justify-content:center;flex-wrap:wrap}
+.btn-retry{display:inline-flex;align-items:center;padding:.55rem 1.1rem;background:var(--accent);color:#fff;border:none;border-radius:10px;font-size:.82rem;font-weight:600;cursor:pointer;text-decoration:none;transition:background .15s}
+.btn-retry:hover{background:var(--accent-h)}
+.btn-key{display:inline-flex;align-items:center;padding:.55rem 1rem;background:transparent;color:var(--muted);border:1px solid var(--border);border-radius:10px;font-size:.82rem;text-decoration:none;transition:border-color .15s,color .15s}
+.btn-key:hover{border-color:var(--accent);color:var(--text)}
+</style>
+<div class="x-ring">&#10005;</div>
+<h1>${esc(title)}</h1>
+<p class="detail">${trustedDetailHtml}</p>
+<div class="actions">
+  <a href="${esc(retryUrl)}" class="btn-retry">&larr; Try again</a>
+  <a href="https://productbrain.io" target="_blank" rel="noopener noreferrer" class="btn-key">Get an API key &rarr;</a>
+</div>`;
+  return authPageShell("Connection error", body);
+}
+app.get("/authorize", authLimiter, (req, res) => {
+  const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.query;
+  res.type("html").send(authorizeFormPage({
+    redirect_uri: String(redirect_uri ?? ""),
+    code_challenge: String(code_challenge ?? ""),
+    code_challenge_method: String(code_challenge_method ?? "S256"),
+    state: String(state ?? ""),
+    client_id: String(client_id ?? "")
+  }));
 });
 app.post(
   "/authorize",
+  authLimiter,
   express.urlencoded({ extended: false }),
-  (req, res) => {
-    const { api_key, redirect_uri, code_challenge, state } = req.body;
+  async (req, res) => {
+    const { api_key, redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.body;
+    const retryParams = new URLSearchParams({
+      redirect_uri: redirect_uri ?? "",
+      code_challenge: code_challenge ?? "",
+      code_challenge_method: code_challenge_method ?? "S256",
+      ...state ? { state } : {},
+      ...client_id ? { client_id } : {}
+    }).toString();
+    const retryUrl = `/authorize?${retryParams}`;
     if (!api_key?.startsWith("pb_sk_")) {
-      res.status(400).send("Invalid API key");
+      res.type("html").send(authorizeErrorPage(
+        "Invalid key format",
+        "API keys start with <code>pb_sk_</code>. Check your key and try again.",
+        retryUrl
+      ));
+      return;
+    }
+    if (!client_id || !registeredClients.has(client_id)) {
+      res.status(400).json({
+        error: "invalid_request",
+        error_description: "Unknown or missing client_id"
+      });
       return;
     }
+    const client = registeredClients.get(client_id);
+    if (!client.redirect_uris.includes(redirect_uri)) {
+      res.status(400).json({
+        error: "invalid_request",
+        error_description: "redirect_uri does not match any registered redirect for this client"
+      });
+      return;
+    }
+    let workspaceName = "Your Workspace";
+    try {
+      const primaryUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_CLOUD_URL).replace(/\/$/, "");
+      const fallbackUrls = (process.env.CONVEX_FALLBACK_URLS ?? "").split(",").map((u) => u.trim().replace(/\/$/, "")).filter(Boolean);
+      const candidates = [primaryUrl, ...fallbackUrls];
+      let foundUrl;
+      let anyDefinitiveReject = false;
+      for (const url2 of candidates) {
+        let checkData = null;
+        try {
+          const checkRes = await fetch(`${url2}/api/key-check`, {
+            method: "POST",
+            headers: { "Authorization": `Bearer ${api_key}`, "Content-Type": "application/json" },
+            signal: AbortSignal.timeout(5e3)
+          });
+          checkData = await checkRes.json();
+        } catch {
+          continue;
+        }
+        if (checkData.ok) {
+          if (checkData.workspaceName) workspaceName = checkData.workspaceName;
+          foundUrl = checkData.deploymentUrl ?? url2;
+          break;
+        }
+        anyDefinitiveReject = true;
+      }
+      if (!foundUrl) {
+        if (anyDefinitiveReject) {
+          res.type("html").send(authorizeErrorPage(
+            "Key not recognized",
+            "This API key wasn't found in Product Brain. Check your API Keys in Studio and try again.",
+            retryUrl
+          ));
+          return;
+        }
+        process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
+      } else {
+        getKeyState(api_key).deploymentUrl = foundUrl;
+      }
+    } catch {
+      process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
+    }
     const code = randomUUID();
     pendingCodes.set(code, {
       apiKey: api_key,
@@ -175,15 +398,72 @@ app.post(
     const url = new URL(redirect_uri);
     url.searchParams.set("code", code);
     if (state) url.searchParams.set("state", state);
-    res.redirect(302, url.toString());
+    const redirectUrl = url.toString();
+    res.type("html").send(authorizeSuccessPage(workspaceName, redirectUrl));
   }
 );
+function issueTokens(apiKey) {
+  const now = Date.now();
+  const refreshToken = `pb_rt_${randomUUID()}`;
+  let perKeyCount = 0;
+  let oldestKeyForApiKey = null;
+  let oldestAtForApiKey = Infinity;
+  for (const [k, v] of refreshTokens) {
+    if (v.apiKey === apiKey) {
+      perKeyCount++;
+      if (v.createdAt < oldestAtForApiKey) {
+        oldestAtForApiKey = v.createdAt;
+        oldestKeyForApiKey = k;
+      }
+    }
+  }
+  if (perKeyCount >= MAX_REFRESH_TOKENS_PER_KEY && oldestKeyForApiKey) {
+    refreshTokens.delete(oldestKeyForApiKey);
+  }
+  if (refreshTokens.size >= MAX_REFRESH_TOKENS) {
+    let oldestKey = null;
+    let oldestAt = Infinity;
+    for (const [k, v] of refreshTokens) {
+      if (v.createdAt < oldestAt) {
+        oldestAt = v.createdAt;
+        oldestKey = k;
+      }
+    }
+    if (oldestKey) refreshTokens.delete(oldestKey);
+  }
+  refreshTokens.set(refreshToken, { apiKey, createdAt: now });
+  return {
+    access_token: apiKey,
+    token_type: "Bearer",
+    // 1-year TTL: actual validity enforced by Convex, not by expiry clock.
+    // Long TTL prevents unnecessary refresh cycles after restarts.
+    expires_in: 365 * 24 * 3600,
+    refresh_token: refreshToken
+  };
+}
 app.post(
   "/oauth/token",
+  authLimiter,
   express.urlencoded({ extended: false }),
   express.json(),
   (req, res) => {
-    const { grant_type, code, code_verifier, redirect_uri } = req.body;
+    const { grant_type, code, code_verifier, redirect_uri, refresh_token } = req.body;
+    if (grant_type === "refresh_token") {
+      const entry = refreshTokens.get(refresh_token);
+      if (!entry) {
+        res.status(400).json({ error: "invalid_grant", error_description: "Invalid refresh token" });
+        return;
+      }
+      if (Date.now() - entry.createdAt > REFRESH_TOKEN_TTL_MS) {
+        refreshTokens.delete(refresh_token);
+        res.status(400).json({ error: "invalid_grant", error_description: "Refresh token expired" });
+        return;
+      }
+      const apiKey = entry.apiKey;
+      refreshTokens.delete(refresh_token);
+      res.json(issueTokens(apiKey));
+      return;
+    }
     if (grant_type !== "authorization_code") {
       res.status(400).json({ error: "unsupported_grant_type" });
       return;
@@ -203,11 +483,7 @@ app.post(
       return;
     }
     pendingCodes.delete(code);
-    res.json({
-      access_token: pending.apiKey,
-      token_type: "Bearer",
-      expires_in: 3600
-    });
+    res.json(issueTokens(pending.apiKey));
   }
 );
 var mcpLimiter = rateLimit({
@@ -217,16 +493,46 @@ var mcpLimiter = rateLimit({
   legacyHeaders: false,
   message: { error: "Too many requests. Try again later." }
 });
+var authFailures = /* @__PURE__ */ new Map();
+var AUTH_FAILURE_MAX = 10;
+var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
+var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
+var MAX_AUTH_FAILURE_ENTRIES = 1e4;
+function checkAuthBlock(ip) {
+  const rec = authFailures.get(ip);
+  if (!rec) return false;
+  return rec.blockedUntil > Date.now();
+}
+function recordAuthFailure(ip) {
+  const now = Date.now();
+  const rec = authFailures.get(ip);
+  if (!rec) {
+    authFailures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });
+    return;
+  }
+  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
+    rec.count = 1;
+    rec.firstFailure = now;
+    rec.blockedUntil = 0;
+  } else {
+    rec.count++;
+    if (rec.count >= AUTH_FAILURE_MAX) {
+      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
+    }
+  }
+}
 app.get("/health", (_req, res) => {
   res.json({ status: "ok", version: SERVER_VERSION, transport: "http" });
 });
 var sessions = /* @__PURE__ */ new Map();
 var SESSION_TTL_MS = 30 * 60 * 1e3;
 var MAX_SESSIONS = 200;
+var MAX_SESSIONS_PER_KEY = 5;
 function evictStaleSessions() {
   const now = Date.now();
   for (const [id, entry] of sessions) {
     if (now - entry.lastAccess > SESSION_TTL_MS) {
+      logSessionLifecycle("session_deleted", id, "ttl");
       entry.transport.close().catch(() => {
       });
       sessions.delete(id);
@@ -237,6 +543,7 @@ function evictStaleSessions() {
       (a, b) => a[1].lastAccess - b[1].lastAccess
     );
     for (let i = 0; i < sorted.length - MAX_SESSIONS; i++) {
+      logSessionLifecycle("session_deleted", sorted[i][0], "eviction");
       sorted[i][1].transport.close().catch(() => {
       });
       sessions.delete(sorted[i][0]);
@@ -248,7 +555,20 @@ function extractBearerKey(req) {
   const header = req.headers?.authorization;
   if (typeof header !== "string" || !header.startsWith("Bearer ")) return null;
   const token = header.slice(7).trim();
-  return token.startsWith("pb_sk_") ? token : null;
+  if (token.startsWith("pb_sk_")) {
+    return token;
+  }
+  if (token.startsWith("pb_at_")) {
+    const entry = accessTokens.get(token);
+    if (!entry) return null;
+    const now = Date.now();
+    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) {
+      accessTokens.delete(token);
+      return null;
+    }
+    return entry.apiKey;
+  }
+  return null;
 }
 function send401(req, res) {
   const base = baseUrl(req);
@@ -257,43 +577,86 @@ function send401(req, res) {
     `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource"`
   ).json({ error: "unauthorized" });
 }
-function logRequest(method, outcome, sessionId) {
+function logRequest(method, outcome, sessionId, durationMs) {
   const ts = (/* @__PURE__ */ new Date()).toISOString();
   const sid = sessionId ? ` session=${sessionId}` : "";
-  process.stderr.write(`[HTTP] ${ts} ${method} ${outcome}${sid}
+  const dur = durationMs != null ? ` duration=${durationMs}ms` : "";
+  process.stderr.write(`[HTTP] ${ts} ${method} ${outcome}${sid}${dur}
+`);
+}
+function logSessionLifecycle(event, sessionId, reason) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  const r = reason ? ` reason=${reason}` : "";
+  process.stderr.write(`[HTTP] ${ts} ${event} session=${sessionId}${r}
 `);
 }
 app.post("/mcp", mcpLimiter, async (req, res) => {
+  const reqIp = req.ip ?? "unknown";
+  if (checkAuthBlock(reqIp)) {
+    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+    return;
+  }
   const apiKey = extractBearerKey(req);
   if (!apiKey) {
     logRequest("POST", "auth_fail");
+    recordAuthFailure(reqIp);
     send401(req, res);
     return;
   }
   const sessionId = req.headers["mcp-session-id"];
+  const reqStart = Date.now();
   try {
     await runWithAuth({ apiKey }, async () => {
       if (sessionId && sessions.has(sessionId)) {
         const entry = sessions.get(sessionId);
+        if (entry.keyHash !== hashKey(apiKey)) {
+          res.status(403).json({
+            jsonrpc: "2.0",
+            error: { code: -32e3, message: "Session key mismatch" },
+            id: null
+          });
+          return;
+        }
         entry.lastAccess = Date.now();
         await entry.transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", sessionId);
+        logRequest("POST", "ok", sessionId, Date.now() - reqStart);
       } else if (!sessionId && isInitializeRequest(req.body)) {
+        const keyH = hashKey(apiKey);
+        let keySessionCount = 0;
+        for (const entry of sessions.values()) {
+          if (entry.keyHash === keyH) keySessionCount++;
+        }
+        if (keySessionCount >= MAX_SESSIONS_PER_KEY) {
+          res.status(429).json({
+            jsonrpc: "2.0",
+            error: { code: -32e3, message: "Too many sessions for this API key" },
+            id: null
+          });
+          return;
+        }
         const transport = new StreamableHTTPServerTransport({
           sessionIdGenerator: () => randomUUID(),
           onsessioninitialized: (sid) => {
-            sessions.set(sid, { transport, lastAccess: Date.now() });
-            logRequest("POST", "ok", sid);
+            sessions.set(sid, { transport, lastAccess: Date.now(), keyHash: keyH });
+            logSessionLifecycle("session_created", sid);
           }
         });
         transport.onclose = () => {
           const sid = transport.sessionId;
-          if (sid) sessions.delete(sid);
+          if (sid) {
+            logSessionLifecycle("session_deleted", sid, "onclose");
+            sessions.delete(sid);
+          }
         };
         const server = createProductBrainServer();
         await server.connect(transport);
         await transport.handleRequest(req, res, req.body);
+        logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
       } else {
+        process.stderr.write(
+          `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_invalid no valid session ID (client may have omitted Mcp-Session-Id)
+`
+        );
         res.status(400).json({
           jsonrpc: "2.0",
           error: { code: -32e3, message: "Bad Request: no valid session ID provided" },
@@ -302,7 +665,7 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
       }
     });
   } catch (err) {
-    logRequest("POST", "error", sessionId);
+    logRequest("POST", "error", sessionId, Date.now() - reqStart);
     if (!res.headersSent) {
       res.status(500).json({
         jsonrpc: "2.0",
@@ -313,9 +676,15 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
   }
 });
 app.get("/mcp", mcpLimiter, async (req, res) => {
+  const reqIp = req.ip ?? "unknown";
+  if (checkAuthBlock(reqIp)) {
+    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+    return;
+  }
   const apiKey = extractBearerKey(req);
   if (!apiKey) {
     logRequest("GET", "auth_fail");
+    recordAuthFailure(reqIp);
     send401(req, res);
     return;
   }
@@ -327,6 +696,14 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
   try {
     await runWithAuth({ apiKey }, async () => {
       const entry = sessions.get(sessionId);
+      if (entry.keyHash !== hashKey(apiKey)) {
+        res.status(403).json({
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Session key mismatch" },
+          id: null
+        });
+        return;
+      }
       entry.lastAccess = Date.now();
       await entry.transport.handleRequest(req, res);
       logRequest("GET", "ok", sessionId);
@@ -336,9 +713,15 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
   }
 });
 app.delete("/mcp", mcpLimiter, async (req, res) => {
+  const reqIp = req.ip ?? "unknown";
+  if (checkAuthBlock(reqIp)) {
+    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+    return;
+  }
   const apiKey = extractBearerKey(req);
   if (!apiKey) {
     logRequest("DELETE", "auth_fail");
+    recordAuthFailure(reqIp);
     send401(req, res);
     return;
   }
@@ -350,6 +733,14 @@ app.delete("/mcp", mcpLimiter, async (req, res) => {
   try {
     await runWithAuth({ apiKey }, async () => {
       const entry = sessions.get(sessionId);
+      if (entry.keyHash !== hashKey(apiKey)) {
+        res.status(403).json({
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Session key mismatch" },
+          id: null
+        });
+        return;
+      }
       await entry.transport.handleRequest(req, res);
       logRequest("DELETE", "ok", sessionId);
     });
@@ -357,18 +748,40 @@ app.delete("/mcp", mcpLimiter, async (req, res) => {
     logRequest("DELETE", "error", sessionId);
   }
 });
-app.listen(PORT, "0.0.0.0", () => {
-  console.log(`Product Brain MCP HTTP server v${SERVER_VERSION} listening on port ${PORT}`);
+process.on("unhandledRejection", (reason) => {
+  const msg = reason instanceof Error ? reason.message : String(reason);
+  console.error(`[MCP HTTP] Unhandled rejection: ${msg}`);
 });
+process.on("uncaughtException", (err) => {
+  console.error(`[MCP HTTP] Uncaught exception: ${err.stack ?? err.message}`);
+  gracefulShutdown();
+});
+var shuttingDown = false;
 async function gracefulShutdown() {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  setTimeout(() => process.exit(1), 3e3).unref();
   console.log("Shutting down...");
   for (const [, entry] of sessions) {
     await entry.transport.close().catch(() => {
     });
   }
-  await shutdownAnalytics();
+  try {
+    await shutdownAnalytics();
+  } catch {
+  }
   process.exit(0);
 }
+var LISTEN_HOST = "0.0.0.0";
+var httpServer = app.listen(PORT, LISTEN_HOST, () => {
+  console.log(
+    `Product Brain MCP HTTP server v${SERVER_VERSION} listening on ${LISTEN_HOST}:${PORT}`
+  );
+});
+httpServer.on("error", (err) => {
+  console.error(`[MCP HTTP] Server error: ${err.message}`);
+  process.exit(1);
+});
 process.on("SIGINT", gracefulShutdown);
 process.on("SIGTERM", gracefulShutdown);
 //# sourceMappingURL=http.js.map