@productbrain/mcp 0.0.1-beta.181 → 0.0.1-beta.1815

package/dist/http.js

@@ -1,25 +1,277 @@
 import {
-  DEFAULT_CLOUD_URL,
   SERVER_VERSION,
-  bootstrapHttp,
   createProductBrainServer,
-  getKeyState,
-  hashKey,
-  initFeatureFlags,
-  runWithAuth
-} from "./chunk-XPFSARXP.js";
+  initFeatureFlags
+} from "./chunk-VRAAJA3M.js";
 import {
+  DEFAULT_CLOUD_URL,
+  bootstrapHttp,
+  getKeyState,
   getPostHogClient,
+  hashKey,
   initAnalytics,
+  runWithAuth,
   shutdownAnalytics
-} from "./chunk-YMF3IQ5E.js";
+} from "./chunk-AMJILQKI.js";
 
 // src/http.ts
-import { createHash, randomUUID } from "crypto";
+import { createHash, randomUUID as randomUUID2 } from "crypto";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import rateLimit from "express-rate-limit";
+
+// src/brand/logo-markup.ts
+var SIZE_CLASSES = {
+  sm: "pb-logo--sm",
+  md: "pb-logo--md"
+};
+var appLogoStyles = `
+.pb-logo{display:inline-flex;align-items:center;gap:8px;color:inherit}
+.pb-logo__mark{
+  border-radius:4px;background:#1c1e24;
+  border:1px solid rgba(255,255,255,0.06);
+  display:inline-grid;place-items:center;flex-shrink:0;
+}
+.pb-logo__core{border-radius:50%;background:var(--accent,#c9b99a)}
+.pb-logo__name{
+  font-family:var(--font-mono,"IBM Plex Mono",ui-monospace,monospace);
+  font-weight:500;text-transform:uppercase;
+  letter-spacing:0.22em;color:var(--fg4,#6a6560);
+}
+.pb-logo--sm .pb-logo__mark{width:16px;height:16px}
+.pb-logo--sm .pb-logo__core{width:5px;height:5px}
+.pb-logo--sm .pb-logo__name{font-size:10.5px}
+.pb-logo--md .pb-logo__mark{width:24px;height:24px;border-radius:6px}
+.pb-logo--md .pb-logo__core{width:8px;height:8px}
+.pb-logo--md .pb-logo__name{font-size:13px}
+`;
+function appLogoMarkup(opts = {}) {
+  const size = opts.size ?? "sm";
+  const showWordmark = opts.showWordmark ?? true;
+  const cls = ["pb-logo", SIZE_CLASSES[size], opts.className].filter(Boolean).join(" ");
+  const wordmark = showWordmark ? `<span class="pb-logo__name">Product Brain</span>` : "";
+  return `<span class="${cls}"><span class="pb-logo__mark"><span class="pb-logo__core"></span></span>${wordmark}</span>`;
+}
+
+// src/lib/refresh-token.ts
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
+var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
+var PREFIX = "pb_rt_";
+var secret = (() => {
+  const fromEnv = process.env.MCP_REFRESH_SECRET;
+  if (fromEnv && fromEnv.length > 0) return Buffer.from(fromEnv, "utf8");
+  if (process.env.NODE_ENV === "production") {
+    console.warn(
+      "[HTTP] WARNING MCP_REFRESH_SECRET not set \u2014 refresh tokens will not survive restart"
+    );
+  }
+  return randomBytes(32);
+})();
+function sign(payloadB64) {
+  return createHmac("sha256", secret).update(payloadB64).digest();
+}
+function signRefreshToken(apiKey) {
+  const payload = {
+    k: apiKey,
+    i: Date.now(),
+    j: randomUUID()
+  };
+  const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+  const sigB64 = sign(payloadB64).toString("base64url");
+  return `${PREFIX}${payloadB64}.${sigB64}`;
+}
+function verifyRefreshToken(token) {
+  if (typeof token !== "string" || !token.startsWith(PREFIX)) return null;
+  const body = token.slice(PREFIX.length);
+  const dot = body.indexOf(".");
+  if (dot <= 0 || dot === body.length - 1) return null;
+  const payloadB64 = body.slice(0, dot);
+  const sigB64 = body.slice(dot + 1);
+  let providedSig;
+  try {
+    providedSig = Buffer.from(sigB64, "base64url");
+  } catch {
+    return null;
+  }
+  const expectedSig = sign(payloadB64);
+  if (providedSig.length !== expectedSig.length) return null;
+  if (!timingSafeEqual(providedSig, expectedSig)) return null;
+  let payload;
+  try {
+    const json = Buffer.from(payloadB64, "base64url").toString("utf8");
+    payload = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!payload || typeof payload.k !== "string" || typeof payload.i !== "number" || typeof payload.j !== "string") {
+    return null;
+  }
+  if (Date.now() - payload.i > REFRESH_TOKEN_TTL_MS) return null;
+  return { apiKey: payload.k };
+}
+
+// src/sessionCap.ts
+function planKeyAdmission(sessions2, keyHash, cap, now, opts) {
+  if (cap < 1) {
+    throw new RangeError(`cap must be >= 1, got ${cap}`);
+  }
+  const { ttlMs, graceMs } = opts;
+  const isProtected = (s) => s.inFlight > 0 || now - s.lastAccess < graceMs;
+  const keyEntries = [];
+  for (const [id, session] of sessions2) {
+    if (session.keyHash === keyHash) {
+      keyEntries.push([id, session]);
+    }
+  }
+  const evictSet = /* @__PURE__ */ new Set();
+  for (const [id, session] of keyEntries) {
+    if (!isProtected(session) && now - session.lastAccess >= ttlMs) {
+      evictSet.add(id);
+    }
+  }
+  let survivors = keyEntries.filter(([id]) => !evictSet.has(id));
+  if (survivors.length >= cap) {
+    const idleSurvivors = survivors.filter(([, s]) => !isProtected(s)).sort(([, a], [, b]) => a.lastAccess - b.lastAccess);
+    for (const [id] of idleSurvivors) {
+      if (survivors.length < cap) break;
+      evictSet.add(id);
+      survivors = survivors.filter(([sid]) => sid !== id);
+    }
+  }
+  const evict = Array.from(evictSet);
+  const admit = survivors.length < cap;
+  let retryAfterSeconds = 0;
+  let retryIsPoll = false;
+  if (!admit) {
+    const graceBlockers = survivors.filter(([, s]) => s.inFlight === 0);
+    if (graceBlockers.length > 0) {
+      const minLastAccess = Math.min(...graceBlockers.map(([, s]) => s.lastAccess));
+      const msRemaining = graceMs - (now - minLastAccess);
+      retryAfterSeconds = Math.max(1, Math.ceil(msRemaining / 1e3));
+    } else {
+      retryAfterSeconds = 5;
+      retryIsPoll = true;
+    }
+  }
+  return { evict, admit, retryAfterSeconds, retryIsPoll };
+}
+function countKeySessions(sessions2, keyHash) {
+  let count = 0;
+  for (const session of sessions2.values()) {
+    if (session.keyHash === keyHash) count++;
+  }
+  return count;
+}
+
+// src/httpErrors.ts
+function clampSeconds(s) {
+  return Math.max(0, Math.round(s));
+}
+function build(reason, message, p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return {
+    status: 429,
+    headers: { "Retry-After": String(seconds) },
+    body: {
+      jsonrpc: "2.0",
+      id: p.id ?? null,
+      error: {
+        code: -32e3,
+        message,
+        data: {
+          reason,
+          retryAfterSeconds: seconds,
+          limit: p.limit,
+          current: p.current
+        }
+      }
+    }
+  };
+}
+function buildRateLimitError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return build(
+    "rate_limited",
+    `Too many requests \u2014 retry after ${seconds} s.`,
+    p
+  );
+}
+function buildAuthLockoutError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return build(
+    "auth_lockout",
+    `Too many failed auth attempts \u2014 locked out, retry after ${seconds} s.`,
+    p
+  );
+}
+function buildSessionCapError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  const message = p.poll ? "Server busy \u2014 all sessions active; retry shortly." : `Too many active sessions for this key \u2014 retry after ${seconds} s.`;
+  return build("session_cap", message, p);
+}
+function send429(res, built) {
+  if (res.headersSent) return;
+  for (const [k, v] of Object.entries(built.headers)) {
+    res.setHeader(k, v);
+  }
+  res.status(built.status).json(built.body);
+}
+
+// src/authLockout.ts
+var AUTH_FAILURE_MAX = 10;
+var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
+var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
+var MAX_AUTH_FAILURE_ENTRIES = 1e4;
+function resolveBearerAuth(authorizationHeader, accessTokens2, now, accessTokenTtlMs) {
+  if (typeof authorizationHeader !== "string" || authorizationHeader.trim() === "") {
+    return { status: "absent" };
+  }
+  if (!authorizationHeader.startsWith("Bearer ")) {
+    return { status: "rejected" };
+  }
+  const token = authorizationHeader.slice(7).trim();
+  if (token === "") {
+    return { status: "rejected" };
+  }
+  if (token.startsWith("pb_sk_")) {
+    return { status: "ok", apiKey: token };
+  }
+  if (token.startsWith("pb_at_")) {
+    const entry = accessTokens2.get(token);
+    if (!entry) return { status: "rejected" };
+    if (now - entry.createdAt > accessTokenTtlMs) {
+      accessTokens2.delete(token);
+      return { status: "rejected" };
+    }
+    return { status: "ok", apiKey: entry.apiKey };
+  }
+  return { status: "rejected" };
+}
+function checkAuthBlock(failures, ip, now) {
+  const rec = failures.get(ip);
+  if (!rec) return false;
+  return rec.blockedUntil > now;
+}
+function recordAuthFailure(failures, ip, now) {
+  const rec = failures.get(ip);
+  if (!rec) {
+    failures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });
+    return;
+  }
+  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
+    rec.count = 1;
+    rec.firstFailure = now;
+    rec.blockedUntil = 0;
+  } else {
+    rec.count++;
+    if (rec.count >= AUTH_FAILURE_MAX) {
+      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
+    }
+  }
+}
+
+// src/http.ts
 bootstrapHttp();
 initAnalytics();
 initFeatureFlags(getPostHogClient());
@@ -32,10 +284,10 @@ function baseUrl(req) {
 var app = express();
 app.set("trust proxy", 1);
 app.use(express.json());
-var ALLOWED_ORIGINS = process.env.CORS_ORIGINS?.split(",").map((o) => o.trim()).filter(Boolean);
+var ALLOWED_ORIGINS = (process.env.CORS_ORIGINS ?? "https://claude.ai").split(",").map((o) => o.trim()).filter(Boolean);
 app.use((_req, res, next) => {
   const origin = _req.headers.origin;
-  if (ALLOWED_ORIGINS && origin && ALLOWED_ORIGINS.includes(origin)) {
+  if (origin && ALLOWED_ORIGINS.includes(origin)) {
     res.setHeader("Access-Control-Allow-Origin", origin);
   }
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
@@ -43,7 +295,7 @@ app.use((_req, res, next) => {
     "Access-Control-Allow-Headers",
     "Content-Type, Authorization, Mcp-Session-Id, Last-Event-Id"
   );
-  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
+  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id, Retry-After");
   if (_req.method === "OPTIONS") {
     res.status(204).end();
     return;
@@ -102,7 +354,7 @@ app.post(
       });
       return;
     }
-    const clientId = `pb_client_${randomUUID()}`;
+    const clientId = `pb_client_${randomUUID2()}`;
     const client = {
       client_id: clientId,
       redirect_uris,
@@ -123,10 +375,6 @@ app.post(
 var pendingCodes = /* @__PURE__ */ new Map();
 var ACCESS_TOKEN_TTL = 3600;
 var ACCESS_TOKEN_TTL_MS = ACCESS_TOKEN_TTL * 1e3;
-var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
-var refreshTokens = /* @__PURE__ */ new Map();
-var MAX_REFRESH_TOKENS = 2e3;
-var MAX_REFRESH_TOKENS_PER_KEY = 20;
 var accessTokens = /* @__PURE__ */ new Map();
 setInterval(() => {
   const now = Date.now();
@@ -136,15 +384,6 @@ setInterval(() => {
   for (const [id, client] of registeredClients) {
     if (now - client.registeredAt > 24 * 60 * 6e4) registeredClients.delete(id);
   }
-  for (const [token, entry] of refreshTokens) {
-    if (now - entry.createdAt > REFRESH_TOKEN_TTL_MS) refreshTokens.delete(token);
-  }
-  if (refreshTokens.size > MAX_REFRESH_TOKENS) {
-    const sorted = [...refreshTokens.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
-    for (let i = 0; i < sorted.length - MAX_REFRESH_TOKENS; i++) {
-      refreshTokens.delete(sorted[i][0]);
-    }
-  }
   for (const [token, entry] of accessTokens) {
     if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) accessTokens.delete(token);
   }
@@ -168,145 +407,564 @@ function esc(s) {
 }
 function authPageShell(title, bodyContent, headExtra = "") {
   return `<!DOCTYPE html>
-<html lang="en"><head>
+<html lang="en" data-theme="parchment-dark"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>${title} \u2014 Product Brain</title>
+<title>${esc(title)} \u2014 Product Brain</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Source+Serif+4:opsz,wght@8..60,600&family=IBM+Plex+Sans:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500;700&display=swap">
 ${headExtra}
 <style>
-:root{--bg:#0d0c10;--surface:#18161e;--border:#2d2840;--border-focus:#7c3aed;--text:#e8e4f0;--muted:#7b7590;--accent:#7c3aed;--accent-h:#6d28d9;--err:#f87171;--ok:#34d399}
-*{margin:0;padding:0;box-sizing:border-box}
-body{font-family:-apple-system,BlinkMacSystemFont,'Inter',system-ui,sans-serif;background:var(--bg);color:var(--text);min-height:100vh;display:flex;align-items:center;justify-content:center;padding:1.5rem}
-body::before{content:'';position:fixed;inset:0;background-image:radial-gradient(circle,#3d3560 1px,transparent 1px);background-size:28px 28px;opacity:.22;pointer-events:none;z-index:0}
-.card{position:relative;z-index:1;background:var(--surface);border:1px solid var(--border);border-radius:16px;padding:2rem 2rem 1.75rem;max-width:380px;width:100%}
+:root{
+  --bg:#1a1917;--bg-warm:#201f1c;--surface:#262521;
+  --fg1:#e4e0d8;--fg2:#c4bfb4;--fg3:#9a9589;--fg4:#6a6560;--fg-bright:#ffffff;
+  --border:rgba(255,255,255,0.07);--border-light:rgba(255,255,255,0.04);
+  --accent:#c9b99a;
+  --btn-bg:#ffffff;--btn-fg:#1a1917;--btn-hover:#e4e0d8;
+  --green:#4ade80;--rose:#ef4444;
+  --ghost:rgba(38,37,33,0.55);
+  --radius-md:7px;--radius-lg:10px;
+  --font-display:"Source Serif 4",ui-serif,Georgia,serif;
+  --font-body:"IBM Plex Sans",ui-sans-serif,system-ui,sans-serif;
+  --font-mono:"IBM Plex Mono",ui-monospace,"SF Mono",Menlo,monospace;
+}
+*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
+html,body{height:100%}
+body{
+  font-family:var(--font-body);font-size:13px;line-height:1.45;
+  color:var(--fg1);background:var(--bg);
+  min-height:100vh;display:grid;place-items:center;padding:24px;
+  -webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;
+  position:relative;overflow:hidden;
+}
+body::before{
+  content:"";position:fixed;inset:0;
+  background:radial-gradient(900px 600px at 50% 50%,rgba(228,224,216,0.025),transparent 60%);
+  pointer-events:none;z-index:0;
+}
+.top-mark{position:fixed;top:22px;left:24px;z-index:5;opacity:0.7}
+${appLogoStyles}
+.stage{
+  width:100%;max-width:460px;text-align:center;
+  position:relative;z-index:1;
+  display:grid;
+}
+.panel{
+  grid-area:1/1;
+  transition:opacity 280ms ease-out,transform 380ms cubic-bezier(.2,.6,.2,1),filter 380ms ease-out;
+}
+.panel[hidden]{
+  display:block !important;
+  opacity:0;transform:scale(0.96) translateY(-2px);filter:blur(6px);
+  pointer-events:none;
+}
+.panel:not([hidden]){opacity:1;transform:scale(1);filter:none;pointer-events:auto}
+
+/* eyebrows */
+.eyebrow{
+  font-family:var(--font-mono);font-size:10px;font-weight:700;
+  letter-spacing:0.28em;text-transform:uppercase;color:var(--fg4);
+  margin-bottom:24px;display:inline-flex;align-items:center;gap:7px;
+}
+.eyebrow .dot{width:5px;height:5px;border-radius:50%;background:currentColor}
+.eyebrow.danger{color:var(--rose)}
+.eyebrow.success{color:var(--green)}
+.eyebrow.success .dot{box-shadow:0 0 0 3px rgba(74,222,128,0.18)}
+
+/* form input */
+.input-wrap{
+  display:flex;align-items:center;background:rgba(0,0,0,0.22);
+  border:1px solid var(--border);border-radius:var(--radius-md);
+  transition:border-color 200ms ease-out,box-shadow 200ms ease-out;
+}
+.input-wrap:focus-within{
+  border-color:rgba(228,224,216,0.45);
+  box-shadow:0 0 0 3px rgba(228,224,216,0.10);
+}
+.input-wrap.has-error{
+  border-color:rgba(239,68,68,0.55);
+  box-shadow:0 0 0 3px rgba(239,68,68,0.12);
+  animation:shake 360ms cubic-bezier(.36,.07,.19,.97);
+}
+@keyframes shake{
+  10%,90%{transform:translateX(-1px)}20%,80%{transform:translateX(2px)}
+  30%,50%,70%{transform:translateX(-4px)}40%,60%{transform:translateX(4px)}
+}
+.input{
+  flex:1;min-width:0;background:transparent;border:0;outline:none;
+  padding:16px;
+  font-family:var(--font-mono);font-size:14px;color:var(--fg1);letter-spacing:0.02em;
+}
+.input::placeholder{color:var(--fg4)}
+.hint{
+  margin-top:10px;font-family:var(--font-mono);font-size:10.5px;
+  letter-spacing:0.16em;text-transform:uppercase;
+  text-align:left;padding-left:4px;height:14px;color:var(--fg4);
+  transition:color 160ms ease-out;
+}
+.hint.is-error{color:var(--rose)}
+
+/* primary button */
+.btn-primary{
+  width:100%;height:48px;margin-top:14px;
+  border:0;border-radius:var(--radius-md);
+  background:var(--btn-bg);color:var(--btn-fg);
+  font-family:var(--font-body);font-size:14.5px;font-weight:600;letter-spacing:-0.005em;
+  cursor:pointer;display:inline-flex;align-items:center;justify-content:center;gap:10px;
+  transition:background 140ms ease-out,transform 80ms ease-out,opacity 200ms ease-out;
+  position:relative;overflow:hidden;
+}
+.btn-primary:hover:not([disabled]){background:var(--btn-hover)}
+.btn-primary:active:not([disabled]){transform:translateY(1px)}
+.btn-primary[disabled]{opacity:0.45;cursor:default}
+.spin{
+  width:14px;height:14px;border-radius:50%;
+  border:1.5px solid currentColor;border-top-color:transparent;
+  animation:spin 700ms linear infinite;opacity:0.85;
+}
+@keyframes spin{to{transform:rotate(360deg)}}
+
+/* secondary link */
+.small-link{
+  margin-top:18px;font-family:var(--font-mono);font-size:11px;
+  letter-spacing:0.18em;text-transform:uppercase;color:var(--fg4);
+}
+.small-link a{
+  color:var(--fg3);text-decoration:none;border-bottom:1px dotted currentColor;
+  padding-bottom:1px;transition:color 140ms;
+}
+.small-link a:hover{color:var(--fg1)}
+
+/* orb */
+.orb-wrap{
+  position:relative;width:160px;height:160px;margin:0 auto 36px;
+  display:grid;place-items:center;
+}
+.orb-ring{position:absolute;border-radius:50%}
+.orb-ring.r1{inset:0;border:1px solid rgba(228,224,216,0.06);animation:drift1 40s linear infinite}
+.orb-ring.r2{inset:18px;border:1px dashed rgba(228,224,216,0.10);animation:drift2 28s linear infinite}
+.orb-ring.r3{inset:38px;border:1px solid rgba(74,222,128,0.20);animation:ringPulse 3.4s ease-in-out infinite}
+@keyframes drift1{to{transform:rotate(360deg)}}
+@keyframes drift2{to{transform:rotate(-360deg)}}
+@keyframes ringPulse{0%,100%{opacity:0.6}50%{opacity:1}}
+
+.orb-wrap.is-verifying .orb-ring.r3{
+  border-color:rgba(228,224,216,0.20);
+  animation:ringPulse 1.1s ease-in-out infinite;
+}
+.orb-wrap.is-verifying .orb-core{
+  box-shadow:0 0 0 6px rgba(228,224,216,0.04),0 0 22px rgba(228,224,216,0.10),inset 0 0 16px rgba(228,224,216,0.06);
+  animation:corePulseNeutral 1.6s ease-in-out infinite;
+}
+.orb-wrap.is-verifying .orb-dot{background:var(--fg3);box-shadow:0 0 10px rgba(228,224,216,0.4)}
+@keyframes corePulseNeutral{
+  0%,100%{box-shadow:0 0 0 6px rgba(228,224,216,0.04),0 0 22px rgba(228,224,216,0.10),inset 0 0 16px rgba(228,224,216,0.06)}
+  50%{box-shadow:0 0 0 9px rgba(228,224,216,0.07),0 0 32px rgba(228,224,216,0.18),inset 0 0 22px rgba(228,224,216,0.10)}
+}
+
+.orb-wrap.is-error .orb-ring.r3{border-color:rgba(239,68,68,0.30);animation:none;opacity:1}
+.orb-wrap.is-error .orb-ring.r1,.orb-wrap.is-error .orb-ring.r2{animation-play-state:paused}
+.orb-wrap.is-error .orb-core{
+  box-shadow:0 0 0 6px rgba(239,68,68,0.05),0 0 22px rgba(239,68,68,0.20),inset 0 0 16px rgba(239,68,68,0.08);
+  animation:none;
+}
+.orb-wrap.is-error .orb-dot{background:var(--rose);box-shadow:0 0 10px rgba(239,68,68,0.6)}
+
+.sat-orbit{position:absolute;inset:0;pointer-events:none}
+.sat-orbit.o1{animation:drift1 40s linear infinite}
+.sat-orbit.o2{animation:drift2 56s linear infinite}
+.sat{
+  position:absolute;top:50%;left:50%;
+  font-family:var(--font-mono);font-size:9px;font-weight:700;letter-spacing:0.14em;
+  background:var(--bg);padding:2px 6px;border-radius:3px;
+  border:1px solid var(--border-light);
+  transform-origin:0 0;opacity:0;
+}
+.panel:not([hidden])[data-state="connected"] .sat{animation:satIn 600ms ease-out forwards}
+@keyframes satIn{from{opacity:0}to{opacity:1}}
+.sat span{display:inline-block;animation:counter 40s linear infinite}
+.sat-orbit.o2 .sat span{animation:counter2 56s linear infinite}
+@keyframes counter{to{transform:rotate(-360deg)}}
+@keyframes counter2{to{transform:rotate(360deg)}}
+
+.orb-core{
+  position:relative;width:60px;height:60px;border-radius:50%;
+  background:radial-gradient(circle at 50% 45%,#1a1a1a 0%,#0c0c0c 60%,#050505 100%);
+  border:1px solid rgba(255,255,255,0.06);
+  display:grid;place-items:center;
+  box-shadow:0 0 0 6px rgba(74,222,128,0.04),0 0 28px rgba(74,222,128,0.20),inset 0 0 18px rgba(74,222,128,0.08);
+  animation:corePulse 3.4s ease-in-out infinite;
+}
+@keyframes corePulse{
+  0%,100%{box-shadow:0 0 0 6px rgba(74,222,128,0.04),0 0 24px rgba(74,222,128,0.18),inset 0 0 16px rgba(74,222,128,0.06)}
+  50%{box-shadow:0 0 0 9px rgba(74,222,128,0.06),0 0 40px rgba(74,222,128,0.32),inset 0 0 22px rgba(74,222,128,0.14)}
+}
+.orb-dot{width:10px;height:10px;border-radius:50%;background:#4ade80;box-shadow:0 0 12px rgba(74,222,128,0.7)}
+
+.core-shockwave{
+  position:absolute;inset:0;border-radius:50%;
+  border:1px solid rgba(74,222,128,0.6);
+  opacity:0;pointer-events:none;
+}
+.panel:not([hidden])[data-state="connected"] .core-shockwave{animation:shock 1100ms ease-out 200ms}
+@keyframes shock{
+  0%{opacity:0.7;transform:scale(0.4);border-width:2px}
+  100%{opacity:0;transform:scale(2.4);border-width:1px}
+}
+
+/* titles */
+.ok-title{
+  font-family:var(--font-display);font-weight:600;
+  font-size:38px;line-height:1.05;letter-spacing:-0.025em;
+  color:var(--fg-bright);opacity:0;
+}
+.panel:not([hidden]) .ok-title{animation:rise 600ms ease-out 380ms forwards}
+.ok-lead{
+  margin:18px auto 0;max-width:22em;font-size:16px;line-height:1.55;color:var(--fg2);
+  opacity:0;
+}
+.panel:not([hidden]) .ok-lead{animation:rise 600ms ease-out 500ms forwards}
+.ok-phrase-row{
+  margin-top:14px;display:flex;align-items:center;justify-content:center;
+  opacity:0;
+}
+.panel:not([hidden]) .ok-phrase-row{animation:rise 600ms ease-out 620ms forwards}
+.cmd.is-copied .cmd-quote-part{display:none}
+.success-cta-wrap{
+  margin-top:48px;width:100%;opacity:0;
+}
+.panel:not([hidden]) .success-cta-wrap{animation:rise 600ms ease-out 780ms forwards}
+a.btn-primary.success-cta{color:var(--btn-fg);text-decoration:none}
+
+.cmd{
+  display:inline-flex;align-items:center;gap:8px;vertical-align:middle;
+  font-family:var(--font-mono);font-size:15px;font-weight:500;color:var(--accent);
+  background:rgba(201,185,154,0.08);border:1px solid rgba(201,185,154,0.30);
+  padding:5px 10px 5px 12px;border-radius:6px;letter-spacing:0.02em;
+  cursor:pointer;user-select:none;
+  transition:background 140ms ease-out,border-color 140ms ease-out,color 140ms ease-out;
+}
+.cmd:hover{background:rgba(201,185,154,0.14);border-color:rgba(201,185,154,0.50);color:#dcc9a4}
+.cmd.is-copied{color:var(--green);border-color:rgba(74,222,128,0.35);background:rgba(74,222,128,0.08)}
+.cmd .cmd-icon{
+  width:12px;height:12px;color:currentColor;opacity:0.75;
+  display:inline-grid;place-items:center;
+  transition:opacity 140ms;
+}
+.cmd:hover .cmd-icon{opacity:1}
+.cmd.is-copied .cmd-icon{color:var(--green);opacity:1}
+.cmd .cmd-icon svg{width:12px;height:12px;stroke:currentColor;fill:none;stroke-width:1.5;stroke-linecap:round;stroke-linejoin:round}
+
+/* error specifics */
+.err-title{
+  font-family:var(--font-display);font-weight:600;
+  font-size:32px;line-height:1.1;letter-spacing:-0.02em;
+  color:var(--fg1);margin-bottom:12px;
+}
+.err-msg{
+  font-size:14.5px;line-height:1.55;color:var(--fg3);
+  margin-bottom:28px;
+}
+.err-msg code{
+  font-family:var(--font-mono);font-size:12px;
+  background:rgba(255,255,255,0.06);padding:1px 5px;border-radius:4px;color:var(--fg2);
+}
+.err-actions{display:flex;gap:8px}
+.btn-secondary{
+  flex:1;height:44px;border-radius:var(--radius-md);
+  background:transparent;color:var(--fg2);
+  border:1px solid var(--border);
+  font-family:var(--font-body);font-size:13.5px;font-weight:500;
+  cursor:pointer;text-decoration:none;
+  display:inline-flex;align-items:center;justify-content:center;
+  transition:background 140ms,color 140ms,border-color 140ms;
+}
+.btn-secondary:hover{background:rgba(255,255,255,0.04);color:var(--fg1);border-color:rgba(255,255,255,0.14)}
+
+/* verifying */
+.verifying-eyebrow{
+  font-family:var(--font-mono);font-size:10px;
+  letter-spacing:0.28em;text-transform:uppercase;color:var(--fg3);
+  font-weight:700;margin-bottom:14px;
+}
+.verifying-title{
+  font-family:var(--font-display);font-weight:600;
+  font-size:28px;line-height:1.1;color:var(--fg1);margin-bottom:8px;
+  letter-spacing:-0.02em;
+}
+.verifying-sub{font-size:13px;color:var(--fg3);min-height:1.45em}
+
+/* form heading */
+.form-title{
+  font-family:var(--font-display);font-weight:600;
+  font-size:32px;line-height:1.1;letter-spacing:-0.02em;
+  color:var(--fg1);margin-bottom:10px;
+}
+.form-sub{font-size:13.5px;color:var(--fg3);margin-bottom:28px;line-height:1.55}
+
+@keyframes rise{from{opacity:0;transform:translateY(8px)}to{opacity:1;transform:translateY(0)}}
+
+@media (prefers-reduced-motion: reduce){
+  *,*::before,*::after{
+    animation-duration:0.01ms !important;animation-iteration-count:1 !important;
+    transition-duration:0.01ms !important;
+  }
+}
 </style>
 </head><body>
-<div class="card">${bodyContent}</div>
+<div class="top-mark">${appLogoMarkup({ size: "sm" })}</div>
+<div class="stage">${bodyContent}</div>
 </body></html>`;
 }
+function providerDisplayName(clientName) {
+  const name = (clientName ?? "").trim();
+  if (!name) return "your assistant";
+  return name.length > 40 ? name.slice(0, 40) + "\u2026" : name;
+}
+function successPanelInner(workspaceName, redirectUrl, providerName) {
+  return `
+<div class="orb-wrap">
+  <div class="orb-ring r1"></div>
+  <div class="orb-ring r2"></div>
+  <div class="orb-ring r3"></div>
+  <div class="sat-orbit o1">
+    <span class="sat" style="transform:rotate(20deg) translate(78px) rotate(-20deg);color:#4ade80;animation-delay:600ms"><span>DEC</span></span>
+    <span class="sat" style="transform:rotate(140deg) translate(78px) rotate(-140deg);color:#c9b99a;animation-delay:720ms"><span>WP</span></span>
+    <span class="sat" style="transform:rotate(260deg) translate(78px) rotate(-260deg);color:#f59e0b;animation-delay:840ms"><span>TEN</span></span>
+  </div>
+  <div class="sat-orbit o2">
+    <span class="sat" style="transform:rotate(80deg) translate(54px) rotate(-80deg);color:#60a5fa;animation-delay:960ms"><span>STD</span></span>
+    <span class="sat" style="transform:rotate(220deg) translate(54px) rotate(-220deg);color:#a78bfa;animation-delay:1080ms"><span>INS</span></span>
+  </div>
+  <div class="core-shockwave"></div>
+  <div class="orb-core"><div class="orb-dot"></div></div>
+</div>
+<div class="eyebrow success"><span class="dot"></span>Connected</div>
+<h1 class="ok-title">Product Brain is Live</h1>
+<p class="ok-lead">Return to your assistant, then say</p>
+<div class="ok-phrase-row">
+  <button class="cmd" type="button" data-cmd-pill data-redirect="${esc(redirectUrl)}" aria-label="Copy &quot;Start PB&quot; and return to ${esc(providerName)}">
+    <span class="cmd-quote-part" aria-hidden="true">&ldquo;</span><span data-cmd-text>Start PB</span><span class="cmd-quote-part" aria-hidden="true">&rdquo;</span>
+    <span class="cmd-icon" aria-hidden="true">
+      <svg data-cmd-svg viewBox="0 0 24 24"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M5 15V6a2 2 0 0 1 2-2h9"/></svg>
+    </span>
+  </button>
+</div>
+<div class="success-cta-wrap">
+  <a class="btn-primary success-cta" href="${esc(redirectUrl)}">Continue in ${esc(providerName)}</a>
+</div>
+<!-- workspace name retained as data hook for tests, hidden from view -->
+<span hidden data-field="ws-name">${esc(workspaceName)}</span>`;
+}
+function errorPanelInner(title, trustedDetailHtml, retryUrl) {
+  return `
+<div class="orb-wrap is-error">
+  <div class="orb-ring r1"></div>
+  <div class="orb-ring r2"></div>
+  <div class="orb-ring r3"></div>
+  <div class="orb-core"><div class="orb-dot"></div></div>
+</div>
+<div class="eyebrow danger"><span class="dot"></span>Couldn't connect</div>
+<h2 class="err-title" data-field="err-title">${esc(title)}</h2>
+<p class="err-msg" data-field="err-msg">${trustedDetailHtml}</p>
+<div class="err-actions">
+  <a href="${esc(retryUrl)}" class="btn-secondary" data-retry-link>&larr; Try again</a>
+  <a href="https://productbrain.io" target="_blank" rel="noopener noreferrer" class="btn-secondary">Get an API key &rarr;</a>
+</div>`;
+}
+var cmdScript = `
+(function(){
+  function bindCmd(pill){
+    if(!pill||pill.__bound)return;pill.__bound=true;
+    var textEl=pill.querySelector('[data-cmd-text]');
+    var svgEl=pill.querySelector('[data-cmd-svg]');
+    var redirectUrl=pill.getAttribute('data-redirect')||'';
+    pill.addEventListener('click',function(){
+      var done=function(){
+        pill.classList.add('is-copied');
+        if(textEl)textEl.textContent='Copied';
+        if(svgEl)svgEl.innerHTML='<polyline points="4 12 10 18 20 6"/>';
+        setTimeout(function(){if(redirectUrl)window.location.assign(redirectUrl)},900);
+      };
+      try{
+        if(navigator.clipboard&&navigator.clipboard.writeText){
+          navigator.clipboard.writeText('Start PB').then(done,done);
+        }else{done()}
+      }catch(e){done()}
+    });
+  }
+  document.querySelectorAll('[data-cmd-pill]').forEach(bindCmd);
+})();
+`;
 function authorizeFormPage(params) {
   const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = params;
+  const providerName = providerDisplayName(params.client_name);
   const body = `
-<style>
-.brand{display:flex;align-items:center;gap:.55rem;margin-bottom:1.5rem}
-.brand-icon{width:30px;height:30px;background:var(--accent);border-radius:8px;display:flex;align-items:center;justify-content:center;font-size:1rem;flex-shrink:0}
-.brand-name{font-size:.88rem;font-weight:600;letter-spacing:-.01em}
-h1{font-size:1.3rem;font-weight:700;letter-spacing:-.02em;margin-bottom:.35rem;line-height:1.3}
-.sub{font-size:.8rem;color:var(--muted);margin-bottom:1.75rem;line-height:1.55}
-label{display:block;font-size:.72rem;font-weight:600;color:#a89fc4;margin-bottom:.4rem;letter-spacing:.04em;text-transform:uppercase}
-.inp-wrap{position:relative}
-input[type=password]{width:100%;padding:.65rem .85rem;background:var(--bg);border:1px solid var(--border);border-radius:10px;color:var(--text);font:.875rem/1.4 'JetBrains Mono','Fira Code',ui-monospace,monospace;outline:none;transition:border-color .15s,box-shadow .15s}
-input:focus{border-color:var(--accent);box-shadow:0 0 0 3px rgba(124,58,237,.15)}
-input.err{border-color:var(--err);box-shadow:0 0 0 3px rgba(248,113,113,.12)}
-.field-row{display:flex;align-items:center;justify-content:space-between;margin-top:.4rem}
-.hint{font-size:.73rem;color:var(--muted)}
-.hint code{font-size:.72rem;background:rgba(255,255,255,.06);padding:.1rem .3rem;border-radius:4px}
-.get-key{font-size:.73rem;color:var(--accent);text-decoration:none;opacity:.85;transition:opacity .1s}
-.get-key:hover{opacity:1;text-decoration:underline}
-.err-msg{font-size:.73rem;color:var(--err);margin-top:.35rem;display:none}
-.err-msg.show{display:block}
-.btn{width:100%;padding:.7rem;background:var(--accent);color:#fff;border:none;border-radius:10px;font-size:.88rem;font-weight:600;cursor:pointer;margin-top:1.25rem;letter-spacing:-.01em;transition:background .15s,transform .1s;display:flex;align-items:center;justify-content:center;gap:.5rem}
-.btn:hover{background:var(--accent-h)}
-.btn:active{transform:scale(.98)}
-.btn:disabled{opacity:.6;cursor:not-allowed;transform:none}
-.spinner{width:15px;height:15px;border:2px solid rgba(255,255,255,.3);border-top-color:#fff;border-radius:50%;animation:spin .7s linear infinite;display:none}
-@keyframes spin{to{transform:rotate(360deg)}}
-.divider{height:1px;background:var(--border);margin:1.5rem -2rem}
-.footer{font-size:.7rem;color:var(--muted);text-align:center;padding-top:.5rem;line-height:1.6}
-.footer a{color:var(--muted);text-decoration:underline}
-</style>
-<div class="brand"><div class="brand-icon">&#11041;</div><span class="brand-name">Product Brain</span></div>
-<h1>Connect to Claude</h1>
-<p class="sub">Enter your API key to give Claude access to your workspace.</p>
-<form method="POST" action="/authorize" id="f">
-  <input type="hidden" name="redirect_uri" value="${esc(redirect_uri)}">
-  <input type="hidden" name="code_challenge" value="${esc(code_challenge)}">
-  <input type="hidden" name="code_challenge_method" value="${esc(code_challenge_method)}">
-  <input type="hidden" name="state" value="${esc(state)}">
-  <input type="hidden" name="client_id" value="${esc(client_id)}">
-  <label for="k">API Key</label>
-  <div class="inp-wrap">
-    <input type="password" id="k" name="api_key" placeholder="pb_sk_\u2026" required autofocus autocomplete="off">
-  </div>
-  <div class="field-row">
-    <span class="hint">Starts with <code>pb_sk_</code></span>
-    <a href="https://productbrain.io" target="_blank" rel="noopener noreferrer" class="get-key">No key? Get one &rarr;</a>
+<!-- \u2500\u2500\u2500 CONNECT \u2500\u2500\u2500 -->
+<div class="panel" id="p-connect" data-state="connect">
+  <div class="eyebrow">Connect Product Brain</div>
+  <h1 class="form-title">Paste your API key</h1>
+  <p class="form-sub">Give <span data-provider>${esc(providerName)}</span> access to your workspace memory.</p>
+  <form method="POST" action="/authorize" id="f" autocomplete="off">
+    <input type="hidden" name="redirect_uri" value="${esc(redirect_uri)}">
+    <input type="hidden" name="code_challenge" value="${esc(code_challenge)}">
+    <input type="hidden" name="code_challenge_method" value="${esc(code_challenge_method)}">
+    <input type="hidden" name="state" value="${esc(state)}">
+    <input type="hidden" name="client_id" value="${esc(client_id)}">
+    <div class="input-wrap" id="iw">
+      <input type="password" id="k" name="api_key" class="input input-full" placeholder="pb_sk_\u2026" required autofocus spellcheck="false">
+    </div>
+    <div class="hint" id="hint" hidden></div>
+    <button type="submit" class="btn-primary" id="sb" disabled><span id="bt">Connect</span></button>
+  </form>
+  <div class="small-link"><a href="https://productbrain.io" target="_blank" rel="noopener noreferrer">No key? Generate one &rarr;</a></div>
+</div>
+
+<!-- \u2500\u2500\u2500 VERIFYING \u2500\u2500\u2500 -->
+<div class="panel" id="p-verifying" data-state="verifying" hidden>
+  <div class="orb-wrap is-verifying">
+    <div class="orb-ring r1"></div>
+    <div class="orb-ring r2"></div>
+    <div class="orb-ring r3"></div>
+    <div class="orb-core"><div class="orb-dot"></div></div>
   </div>
-  <p class="err-msg" id="em">Key must start with <code>pb_sk_</code></p>
-  <button type="submit" class="btn" id="sb">
-    <span id="bt">Authorize</span>
-    <div class="spinner" id="sp"></div>
-  </button>
-</form>
-<div class="divider"></div>
-<p class="footer">Product Brain gives Claude access to your knowledge graph.<br><a href="https://productbrain.io" target="_blank" rel="noopener noreferrer">Learn more</a></p>
+  <div class="verifying-eyebrow">Handshake</div>
+  <h2 class="verifying-title">Verifying key\u2026</h2>
+  <p class="verifying-sub" id="verify-sub">Checking workspace \xB7 \u2026</p>
+</div>
+
+<!-- \u2500\u2500\u2500 CONNECTED (filled by JS from JSON response) \u2500\u2500\u2500 -->
+<div class="panel" id="p-connected" data-state="connected" hidden></div>
+
+<!-- \u2500\u2500\u2500 ERROR (filled by JS from JSON response) \u2500\u2500\u2500 -->
+<div class="panel" id="p-error" data-state="error" hidden></div>
+
+<template id="tpl-connected">${successPanelInner("__WS__", "__URL__", "__PROVIDER__")}</template>
+<template id="tpl-error">${errorPanelInner("__TITLE__", "__DETAIL__", "__RETRY__")}</template>
+
 <script>
-var f=document.getElementById('f'),k=document.getElementById('k'),em=document.getElementById('em'),sb=document.getElementById('sb'),bt=document.getElementById('bt'),sp=document.getElementById('sp');
-k.addEventListener('input',function(){var v=k.value.trim();if(v&&!v.startsWith('pb_sk_')){k.classList.add('err');em.classList.add('show')}else{k.classList.remove('err');em.classList.remove('show')}});
-f.addEventListener('submit',function(e){var v=k.value.trim();if(!v.startsWith('pb_sk_')){e.preventDefault();k.classList.add('err');em.classList.add('show');k.focus();return}sb.disabled=true;bt.textContent='Verifying\u2026';sp.style.display='block'});
+${cmdScript}
+(function(){
+  var f=document.getElementById('f'),k=document.getElementById('k'),iw=document.getElementById('iw'),hint=document.getElementById('hint'),sb=document.getElementById('sb'),bt=document.getElementById('bt');
+  var pConnect=document.getElementById('p-connect'),pVerify=document.getElementById('p-verifying'),pOk=document.getElementById('p-connected'),pErr=document.getElementById('p-error');
+  var verifySub=document.getElementById('verify-sub');
+
+  function show(panel){
+    [pConnect,pVerify,pOk,pErr].forEach(function(p){
+      if(p===panel){p.removeAttribute('hidden')}else{p.setAttribute('hidden','')}
+    });
+  }
+
+  function syncInput(){
+    sb.disabled=!k.value.trim();
+    iw.classList.remove('has-error');
+    hint.classList.remove('is-error');
+    hint.textContent='';
+    hint.setAttribute('hidden','');
+  }
+  k.addEventListener('input',syncInput);
+  k.addEventListener('keydown',function(e){
+    if(e.key==='Escape'){k.value='';syncInput()}
+  });
+
+  function showError(title,detailHtml){
+    var tpl=document.getElementById('tpl-error');
+    var html=tpl.innerHTML
+      .replace('__TITLE__',title.replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]}))
+      .replace('__DETAIL__',detailHtml)
+      .replace('__RETRY__','#');
+    pErr.innerHTML=html;
+    var retry=pErr.querySelector('[data-retry-link]');
+    if(retry){retry.addEventListener('click',function(e){e.preventDefault();show(pConnect);k.focus();k.select()})}
+    show(pErr);
+  }
+
+  function showSuccess(workspaceName,redirectUrl,providerName){
+    var tpl=document.getElementById('tpl-connected');
+    var safeWs=String(workspaceName||'').replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]});
+    var safeProv=String(providerName||'your assistant').replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]});
+    var safeUrl=String(redirectUrl||'').replace(/"/g,'&quot;').replace(/[<>]/g,function(c){return{'<':'&lt;','>':'&gt;'}[c]});
+    var html=tpl.innerHTML.split('__WS__').join(safeWs).split('__URL__').join(safeUrl).split('__PROVIDER__').join(safeProv);
+    pOk.innerHTML=html;
+    pOk.querySelectorAll('[data-cmd-pill]').forEach(function(pill){
+      pill.__bound=false;
+    });
+    // Re-run binder
+    var s=document.createElement('script');s.textContent=${JSON.stringify(cmdScript)};document.body.appendChild(s);s.remove();
+    show(pOk);
+  }
+
+  f.addEventListener('submit',function(e){
+    e.preventDefault();
+    var v=k.value.trim();
+    if(!v){iw.classList.add('has-error');hint.classList.add('is-error');hint.textContent='Paste your key first';hint.removeAttribute('hidden');return}
+    if(v.indexOf('pb_sk_')!==0){iw.classList.add('has-error');hint.classList.add('is-error');hint.textContent='Key must start with pb_sk_';hint.removeAttribute('hidden');return}
+    sb.disabled=true;bt.textContent='Verifying';
+    show(pVerify);
+
+    var steps=['Checking workspace \xB7 \u2026','Loading chain \xB7 \u2026','Establishing memory \xB7 \u2026'];
+    var i=0;verifySub.textContent=steps[0];
+    var ti=setInterval(function(){i++;if(i>=steps.length){clearInterval(ti);return}verifySub.textContent=steps[i]},900);
+
+    var minDelay=new Promise(function(r){setTimeout(r,2800)});
+    var fd=new FormData(f);
+    var body=new URLSearchParams();
+    fd.forEach(function(val,key){body.append(key,String(val))});
+
+    var req=fetch('/authorize',{
+      method:'POST',
+      headers:{'Accept':'application/json','Content-Type':'application/x-www-form-urlencoded'},
+      body:body.toString(),
+      credentials:'same-origin'
+    }).then(function(r){return r.json().then(function(j){return{status:r.status,body:j}})});
+
+    Promise.all([req,minDelay]).then(function(arr){
+      clearInterval(ti);
+      var res=arr[0];
+      if(res.body&&res.body.ok){
+        showSuccess(res.body.workspaceName,res.body.redirectUrl,res.body.providerName);
+      }else{
+        showError(res.body&&res.body.title||'Couldn\\'t connect',res.body&&res.body.detail||'Try again, or generate a new key.');
+        sb.disabled=false;bt.textContent='Connect';
+      }
+    }).catch(function(){
+      clearInterval(ti);
+      showError('Network error','We couldn\\'t reach Product Brain. Check your connection and try again.');
+      sb.disabled=false;bt.textContent='Connect';
+    });
+  });
+
+  k.focus();
+})();
 </script>`;
-  return authPageShell("Connect to Claude", body);
+  return authPageShell("Connect Product Brain", body);
 }
-function authorizeSuccessPage(workspaceName, redirectUrl) {
-  const safeUrl = JSON.stringify(redirectUrl).replace(/<\/script>/gi, "<\\/script>");
+function authorizeSuccessPage(workspaceName, redirectUrl, providerName) {
   const body = `
-<style>
-.card{text-align:center;padding:2.5rem 2rem}
-.ring{width:60px;height:60px;background:rgba(52,211,153,.1);border:1px solid rgba(52,211,153,.25);border-radius:50%;display:flex;align-items:center;justify-content:center;margin:0 auto 1.4rem;animation:pop .5s cubic-bezier(.175,.885,.32,1.275) .15s both}
-@keyframes pop{from{transform:scale(.4);opacity:0}to{transform:scale(1);opacity:1}}
-svg{animation:draw .6s ease .5s both}
-@keyframes draw{from{stroke-dashoffset:30}to{stroke-dashoffset:0}}
-h1{font-size:1.3rem;font-weight:700;letter-spacing:-.02em;margin-bottom:.3rem}
-.ws{font-size:.8rem;color:var(--ok);font-weight:500;margin-bottom:1.5rem}
-.redirect-msg{font-size:.78rem;color:var(--muted);margin-bottom:1.4rem}
-.dots::after{content:'';animation:dots 1.4s steps(4,end) infinite}
-@keyframes dots{0%{content:''}25%{content:'.'}50%{content:'..'}75%{content:'...'}}
-.continue{display:inline-flex;align-items:center;gap:.4rem;padding:.6rem 1.2rem;background:var(--accent);color:#fff;border:none;border-radius:10px;font-size:.84rem;font-weight:600;cursor:pointer;text-decoration:none;transition:background .15s}
-.continue:hover{background:var(--accent-h)}
-@keyframes fadein{from{opacity:0;transform:translateY(6px)}to{opacity:1;transform:translateY(0)}}
-.card{animation:fadein .35s ease}
-</style>
-<div class="ring">
-  <svg width="28" height="28" viewBox="0 0 24 24" fill="none" stroke="#34d399" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="30"><polyline points="20 6 9 17 4 12"/></svg>
+<div class="panel" data-state="connected">
+${successPanelInner(workspaceName, redirectUrl, providerName)}
 </div>
-<h1>Claude is connected</h1>
-<p class="ws">${esc(workspaceName)}</p>
-<p class="redirect-msg">Returning to Claude<span class="dots"></span></p>
-<a href="${esc(redirectUrl)}" class="continue">Continue to Claude &rarr;</a>
-<script>setTimeout(function(){window.location.href=${safeUrl}},1800)</script>`;
+<script>${cmdScript}</script>`;
   return authPageShell("Connected", body);
 }
 function authorizeErrorPage(title, trustedDetailHtml, retryUrl) {
   const body = `
-<style>
-.card{text-align:center;padding:2.25rem 2rem}
-.x-ring{width:52px;height:52px;background:rgba(248,113,113,.1);border:1px solid rgba(248,113,113,.2);border-radius:50%;display:flex;align-items:center;justify-content:center;margin:0 auto 1.25rem;font-size:1.4rem;animation:shake .4s ease .1s}
-@keyframes shake{0%,100%{transform:translateX(0)}25%{transform:translateX(-5px)}75%{transform:translateX(5px)}}
-h1{font-size:1.2rem;font-weight:700;letter-spacing:-.02em;margin-bottom:.5rem;color:var(--err)}
-.detail{font-size:.8rem;color:var(--muted);line-height:1.6;margin-bottom:1.5rem}
-.detail code{font-size:.75rem;background:rgba(255,255,255,.06);padding:.1rem .3rem;border-radius:4px}
-.actions{display:flex;gap:.75rem;justify-content:center;flex-wrap:wrap}
-.btn-retry{display:inline-flex;align-items:center;padding:.55rem 1.1rem;background:var(--accent);color:#fff;border:none;border-radius:10px;font-size:.82rem;font-weight:600;cursor:pointer;text-decoration:none;transition:background .15s}
-.btn-retry:hover{background:var(--accent-h)}
-.btn-key{display:inline-flex;align-items:center;padding:.55rem 1rem;background:transparent;color:var(--muted);border:1px solid var(--border);border-radius:10px;font-size:.82rem;text-decoration:none;transition:border-color .15s,color .15s}
-.btn-key:hover{border-color:var(--accent);color:var(--text)}
-</style>
-<div class="x-ring">&#10005;</div>
-<h1>${esc(title)}</h1>
-<p class="detail">${trustedDetailHtml}</p>
-<div class="actions">
-  <a href="${esc(retryUrl)}" class="btn-retry">&larr; Try again</a>
-  <a href="https://productbrain.io" target="_blank" rel="noopener noreferrer" class="btn-key">Get an API key &rarr;</a>
+<div class="panel" data-state="error">
+${errorPanelInner(title, trustedDetailHtml, retryUrl)}
 </div>`;
   return authPageShell("Connection error", body);
 }
 app.get("/authorize", authLimiter, (req, res) => {
   const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.query;
+  const cid = String(client_id ?? "");
+  const clientName = cid && registeredClients.has(cid) ? registeredClients.get(cid).client_name : void 0;
   res.type("html").send(authorizeFormPage({
     redirect_uri: String(redirect_uri ?? ""),
     code_challenge: String(code_challenge ?? ""),
     code_challenge_method: String(code_challenge_method ?? "S256"),
     state: String(state ?? ""),
-    client_id: String(client_id ?? "")
+    client_id: cid,
+    client_name: clientName
   }));
 });
 app.post(
@@ -315,6 +973,7 @@ app.post(
   express.urlencoded({ extended: false }),
   async (req, res) => {
     const { api_key, redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.body;
+    const wantsJson = String(req.headers["accept"] ?? "").includes("application/json");
     const retryParams = new URLSearchParams({
       redirect_uri: redirect_uri ?? "",
       code_challenge: code_challenge ?? "",
@@ -323,21 +982,44 @@ app.post(
       ...client_id ? { client_id } : {}
     }).toString();
     const retryUrl = `/authorize?${retryParams}`;
+    function sendError(title, trustedDetailHtml, status = 400) {
+      if (wantsJson) {
+        res.status(status).json({ ok: false, title, detail: trustedDetailHtml });
+      } else {
+        res.status(status).type("html").send(authorizeErrorPage(title, trustedDetailHtml, retryUrl));
+      }
+    }
     if (!api_key?.startsWith("pb_sk_")) {
-      res.type("html").send(authorizeErrorPage(
+      sendError(
         "Invalid key format",
-        "API keys start with <code>pb_sk_</code>. Check your key and try again.",
-        retryUrl
-      ));
+        "API keys start with <code>pb_sk_</code>. Check your key and try again."
+      );
       return;
     }
-    if (!client_id || !registeredClients.has(client_id)) {
+    if (!client_id) {
       res.status(400).json({
         error: "invalid_request",
-        error_description: "Unknown or missing client_id"
+        error_description: "client_id is required"
       });
       return;
     }
+    if (!registeredClients.has(client_id)) {
+      if (typeof redirect_uri === "string" && redirect_uri.startsWith("https://")) {
+        registeredClients.set(client_id, {
+          client_id,
+          redirect_uris: [redirect_uri],
+          registeredAt: Date.now()
+        });
+        process.stderr.write(`[authorize] auto-re-registered stale client_id after restart
+`);
+      } else {
+        res.status(400).json({
+          error: "invalid_request",
+          error_description: "Unknown client_id and redirect_uri is not a valid https URL"
+        });
+        return;
+      }
+    }
     const client = registeredClients.get(client_id);
     if (!client.redirect_uris.includes(redirect_uri)) {
       res.status(400).json({
@@ -374,11 +1056,11 @@ app.post(
       }
       if (!foundUrl) {
         if (anyDefinitiveReject) {
-          res.type("html").send(authorizeErrorPage(
+          sendError(
             "Key not recognized",
-            "This API key wasn't found in Product Brain. Check your API Keys in Studio and try again.",
-            retryUrl
-          ));
+            "This API key wasn't found in Product Brain. Check your API Keys in Cortex and try again.",
+            401
+          );
           return;
         }
         process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
@@ -388,7 +1070,7 @@ app.post(
     } catch {
       process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
     }
-    const code = randomUUID();
+    const code = randomUUID2();
     pendingCodes.set(code, {
       apiKey: api_key,
       codeChallenge: code_challenge,
@@ -399,46 +1081,22 @@ app.post(
     url.searchParams.set("code", code);
     if (state) url.searchParams.set("state", state);
     const redirectUrl = url.toString();
-    res.type("html").send(authorizeSuccessPage(workspaceName, redirectUrl));
+    const providerName = providerDisplayName(client.client_name);
+    if (wantsJson) {
+      res.json({ ok: true, workspaceName, redirectUrl, providerName });
+    } else {
+      res.type("html").send(authorizeSuccessPage(workspaceName, redirectUrl, providerName));
+    }
   }
 );
 function issueTokens(apiKey) {
-  const now = Date.now();
-  const refreshToken = `pb_rt_${randomUUID()}`;
-  let perKeyCount = 0;
-  let oldestKeyForApiKey = null;
-  let oldestAtForApiKey = Infinity;
-  for (const [k, v] of refreshTokens) {
-    if (v.apiKey === apiKey) {
-      perKeyCount++;
-      if (v.createdAt < oldestAtForApiKey) {
-        oldestAtForApiKey = v.createdAt;
-        oldestKeyForApiKey = k;
-      }
-    }
-  }
-  if (perKeyCount >= MAX_REFRESH_TOKENS_PER_KEY && oldestKeyForApiKey) {
-    refreshTokens.delete(oldestKeyForApiKey);
-  }
-  if (refreshTokens.size >= MAX_REFRESH_TOKENS) {
-    let oldestKey = null;
-    let oldestAt = Infinity;
-    for (const [k, v] of refreshTokens) {
-      if (v.createdAt < oldestAt) {
-        oldestAt = v.createdAt;
-        oldestKey = k;
-      }
-    }
-    if (oldestKey) refreshTokens.delete(oldestKey);
-  }
-  refreshTokens.set(refreshToken, { apiKey, createdAt: now });
   return {
     access_token: apiKey,
     token_type: "Bearer",
     // 1-year TTL: actual validity enforced by Convex, not by expiry clock.
     // Long TTL prevents unnecessary refresh cycles after restarts.
     expires_in: 365 * 24 * 3600,
-    refresh_token: refreshToken
+    refresh_token: signRefreshToken(apiKey)
   };
 }
 app.post(
@@ -449,19 +1107,15 @@ app.post(
   (req, res) => {
     const { grant_type, code, code_verifier, redirect_uri, refresh_token } = req.body;
     if (grant_type === "refresh_token") {
-      const entry = refreshTokens.get(refresh_token);
-      if (!entry) {
-        res.status(400).json({ error: "invalid_grant", error_description: "Invalid refresh token" });
-        return;
-      }
-      if (Date.now() - entry.createdAt > REFRESH_TOKEN_TTL_MS) {
-        refreshTokens.delete(refresh_token);
-        res.status(400).json({ error: "invalid_grant", error_description: "Refresh token expired" });
+      const verified = verifyRefreshToken(refresh_token);
+      if (!verified) {
+        res.status(400).json({
+          error: "invalid_grant",
+          error_description: "Invalid or expired refresh token"
+        });
         return;
       }
-      const apiKey = entry.apiKey;
-      refreshTokens.delete(refresh_token);
-      res.json(issueTokens(apiKey));
+      res.json(issueTokens(verified.apiKey));
       return;
     }
     if (grant_type !== "authorization_code") {
@@ -491,85 +1145,63 @@ var mcpLimiter = rateLimit({
   max: 120,
   standardHeaders: true,
   legacyHeaders: false,
-  message: { error: "Too many requests. Try again later." }
+  handler: (req, res) => {
+    const r = req.rateLimit;
+    const reset = r?.resetTime?.getTime?.() ?? Date.now() + 6e4;
+    send429(res, buildRateLimitError({
+      retryAfterSeconds: Math.max(1, Math.ceil((reset - Date.now()) / 1e3)),
+      limit: r?.limit ?? 120,
+      current: r?.used ?? 0,
+      id: req.body?.id ?? null
+      // mirror the JSON-RPC id when a POST body is present
+    }));
+  }
 });
 var authFailures = /* @__PURE__ */ new Map();
-var AUTH_FAILURE_MAX = 10;
-var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
-var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
-var MAX_AUTH_FAILURE_ENTRIES = 1e4;
-function checkAuthBlock(ip) {
-  const rec = authFailures.get(ip);
-  if (!rec) return false;
-  return rec.blockedUntil > Date.now();
-}
-function recordAuthFailure(ip) {
-  const now = Date.now();
-  const rec = authFailures.get(ip);
-  if (!rec) {
-    authFailures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });
-    return;
-  }
-  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
-    rec.count = 1;
-    rec.firstFailure = now;
-    rec.blockedUntil = 0;
-  } else {
-    rec.count++;
-    if (rec.count >= AUTH_FAILURE_MAX) {
-      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
-    }
-  }
-}
 app.get("/health", (_req, res) => {
   res.json({ status: "ok", version: SERVER_VERSION, transport: "http" });
 });
 var sessions = /* @__PURE__ */ new Map();
 var SESSION_TTL_MS = 30 * 60 * 1e3;
 var MAX_SESSIONS = 200;
-var MAX_SESSIONS_PER_KEY = 5;
+var EVICT_GRACE_MS = 6e4;
+var MAX_SESSIONS_PER_KEY = Math.max(
+  1,
+  Math.min(MAX_SESSIONS - 1, Number(process.env.MCP_MAX_SESSIONS_PER_KEY) || 25)
+);
 function evictStaleSessions() {
   const now = Date.now();
   for (const [id, entry] of sessions) {
     if (now - entry.lastAccess > SESSION_TTL_MS) {
-      logSessionLifecycle("session_deleted", id, "ttl");
+      logSessionLifecycle(
+        "session_deleted",
+        id,
+        entry.inFlight > 0 ? "inflight_leak" : "ttl"
+      );
       entry.transport.close().catch(() => {
       });
       sessions.delete(id);
     }
   }
   if (sessions.size > MAX_SESSIONS) {
-    const sorted = [...sessions.entries()].sort(
-      (a, b) => a[1].lastAccess - b[1].lastAccess
-    );
-    for (let i = 0; i < sorted.length - MAX_SESSIONS; i++) {
+    const sorted = [...sessions.entries()].filter(([, e]) => e.inFlight === 0).sort((a, b) => a[1].lastAccess - b[1].lastAccess);
+    const overflow = sessions.size - MAX_SESSIONS;
+    for (let i = 0; i < Math.min(overflow, sorted.length); i++) {
       logSessionLifecycle("session_deleted", sorted[i][0], "eviction");
       sorted[i][1].transport.close().catch(() => {
       });
       sessions.delete(sorted[i][0]);
     }
-  }
-}
-setInterval(evictStaleSessions, 6e4);
-function extractBearerKey(req) {
-  const header = req.headers?.authorization;
-  if (typeof header !== "string" || !header.startsWith("Bearer ")) return null;
-  const token = header.slice(7).trim();
-  if (token.startsWith("pb_sk_")) {
-    return token;
-  }
-  if (token.startsWith("pb_at_")) {
-    const entry = accessTokens.get(token);
-    if (!entry) return null;
-    const now = Date.now();
-    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) {
-      accessTokens.delete(token);
-      return null;
+    if (sessions.size > MAX_SESSIONS) {
+      const ts = (/* @__PURE__ */ new Date()).toISOString();
+      process.stderr.write(
+        `[HTTP] ${ts} session_cap_breach size=${sessions.size} max=${MAX_SESSIONS} reason=all_inflight (no idle sessions to evict; TTL backstop will reclaim)
+`
+      );
     }
-    return entry.apiKey;
   }
-  return null;
 }
+setInterval(evictStaleSessions, 6e4);
 function send401(req, res) {
   const base = baseUrl(req);
   res.status(401).set(
@@ -592,17 +1224,21 @@ function logSessionLifecycle(event, sessionId, reason) {
 }
 app.post("/mcp", mcpLimiter, async (req, res) => {
   const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+  const nowTs = Date.now();
+  if (checkAuthBlock(authFailures, reqIp, nowTs)) {
+    const rec = authFailures.get(reqIp);
+    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - nowTs) / 1e3)) : 0;
+    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  if (auth.status !== "ok") {
     logRequest("POST", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   const reqStart = Date.now();
   try {
@@ -617,41 +1253,91 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
           });
           return;
         }
-        entry.lastAccess = Date.now();
-        await entry.transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", sessionId, Date.now() - reqStart);
+        try {
+          entry.inFlight++;
+          entry.lastAccess = Date.now();
+          await entry.transport.handleRequest(req, res, req.body);
+          logRequest("POST", "ok", sessionId, Date.now() - reqStart);
+        } finally {
+          entry.inFlight--;
+          entry.lastAccess = Date.now();
+        }
       } else if (!sessionId && isInitializeRequest(req.body)) {
         const keyH = hashKey(apiKey);
-        let keySessionCount = 0;
-        for (const entry of sessions.values()) {
-          if (entry.keyHash === keyH) keySessionCount++;
-        }
-        if (keySessionCount >= MAX_SESSIONS_PER_KEY) {
-          res.status(429).json({
-            jsonrpc: "2.0",
-            error: { code: -32e3, message: "Too many sessions for this API key" },
-            id: null
+        const plan = planKeyAdmission(
+          sessions,
+          keyH,
+          MAX_SESSIONS_PER_KEY,
+          Date.now(),
+          { ttlMs: SESSION_TTL_MS, graceMs: EVICT_GRACE_MS }
+        );
+        for (const sid2 of plan.evict) {
+          const victim = sessions.get(sid2);
+          sessions.delete(sid2);
+          victim?.transport.close().catch(() => {
           });
+          logSessionLifecycle("session_deleted", sid2, "lru_evict");
+        }
+        if (!plan.admit) {
+          send429(res, buildSessionCapError({
+            retryAfterSeconds: plan.retryAfterSeconds,
+            limit: MAX_SESSIONS_PER_KEY,
+            current: countKeySessions(sessions, keyH),
+            poll: plan.retryIsPoll,
+            id: req.body?.id ?? null
+          }));
           return;
         }
+        const sid = randomUUID2();
+        let initialized = false;
         const transport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID(),
-          onsessioninitialized: (sid) => {
-            sessions.set(sid, { transport, lastAccess: Date.now(), keyHash: keyH });
-            logSessionLifecycle("session_created", sid);
+          sessionIdGenerator: () => sid,
+          onsessioninitialized: (s) => {
+            initialized = true;
+            logSessionLifecycle("session_created", s);
           }
+          // log only — no map write
         });
+        const reserved = { transport, lastAccess: Date.now(), keyHash: keyH, inFlight: 1 };
+        sessions.set(sid, reserved);
         transport.onclose = () => {
-          const sid = transport.sessionId;
-          if (sid) {
-            logSessionLifecycle("session_deleted", sid, "onclose");
-            sessions.delete(sid);
+          const s = transport.sessionId ?? sid;
+          if (sessions.has(s)) {
+            sessions.delete(s);
+            logSessionLifecycle("session_deleted", s, "onclose");
           }
         };
-        const server = createProductBrainServer();
-        await server.connect(transport);
-        await transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+        try {
+          const server = createProductBrainServer();
+          await server.connect(transport);
+          await transport.handleRequest(req, res, req.body);
+          logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+        } catch (e) {
+          transport.onclose = void 0;
+          sessions.delete(sid);
+          throw e;
+        } finally {
+          if (!initialized) {
+            transport.onclose = void 0;
+            if (sessions.delete(sid)) logSessionLifecycle("session_deleted", sid, "init_rejected");
+          } else {
+            const e = sessions.get(sid);
+            if (e) {
+              e.inFlight--;
+              e.lastAccess = Date.now();
+            }
+          }
+        }
+      } else if (sessionId) {
+        process.stderr.write(
+          `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale sessionId=${sessionId} (likely server restart \u2014 instructing client to re-initialise)
+`
+        );
+        res.status(404).json({
+          jsonrpc: "2.0",
+          error: { code: -32001, message: "Session not found \u2014 re-initialise" },
+          id: null
+        });
       } else {
         process.stderr.write(
           `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_invalid no valid session ID (client may have omitted Mcp-Session-Id)
@@ -677,20 +1363,32 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
 });
 app.get("/mcp", mcpLimiter, async (req, res) => {
   const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+  const nowTs = Date.now();
+  if (checkAuthBlock(authFailures, reqIp, nowTs)) {
+    const rec = authFailures.get(reqIp);
+    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - nowTs) / 1e3)) : 0;
+    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  if (auth.status !== "ok") {
     logRequest("GET", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
-  if (!sessionId || !sessions.has(sessionId)) {
-    res.status(400).send("Invalid or missing session ID");
+  if (!sessionId) {
+    res.status(400).send("Missing Mcp-Session-Id header");
+    return;
+  }
+  if (!sessions.has(sessionId)) {
+    process.stderr.write(
+      `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale GET sessionId=${sessionId}
+`
+    );
+    res.status(404).send("Session not found \u2014 re-initialise");
     return;
   }
   try {
@@ -714,20 +1412,32 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
 });
 app.delete("/mcp", mcpLimiter, async (req, res) => {
   const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+  const nowTs = Date.now();
+  if (checkAuthBlock(authFailures, reqIp, nowTs)) {
+    const rec = authFailures.get(reqIp);
+    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - nowTs) / 1e3)) : 0;
+    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  if (auth.status !== "ok") {
     logRequest("DELETE", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
-  if (!sessionId || !sessions.has(sessionId)) {
-    res.status(400).send("Invalid or missing session ID");
+  if (!sessionId) {
+    res.status(400).send("Missing Mcp-Session-Id header");
+    return;
+  }
+  if (!sessions.has(sessionId)) {
+    process.stderr.write(
+      `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale DELETE sessionId=${sessionId}
+`
+    );
+    res.status(404).send("Session not found \u2014 re-initialise");
     return;
   }
   try {