@productbrain/mcp 0.0.1-beta.190 → 0.0.1-beta.1900

package/dist/http.js

@@ -1,21 +1,21 @@
 import {
-  DEFAULT_CLOUD_URL,
   SERVER_VERSION,
-  bootstrapHttp,
   createProductBrainServer,
-  getKeyState,
-  hashKey,
-  initFeatureFlags,
-  runWithAuth
-} from "./chunk-ZF6N62QQ.js";
+  initFeatureFlags
+} from "./chunk-ZKW7JZUF.js";
 import {
+  DEFAULT_CLOUD_URL,
+  bootstrapHttp,
+  getKeyState,
   getPostHogClient,
+  hashKey,
   initAnalytics,
+  runWithAuth,
   shutdownAnalytics
-} from "./chunk-YMF3IQ5E.js";
+} from "./chunk-6JNK5DIZ.js";
 
 // src/http.ts
-import { createHash, randomUUID } from "crypto";
+import { createHash, randomUUID as randomUUID2 } from "crypto";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
@@ -54,6 +54,223 @@ function appLogoMarkup(opts = {}) {
   return `<span class="${cls}"><span class="pb-logo__mark"><span class="pb-logo__core"></span></span>${wordmark}</span>`;
 }
 
+// src/lib/refresh-token.ts
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
+var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
+var PREFIX = "pb_rt_";
+var secret = (() => {
+  const fromEnv = process.env.MCP_REFRESH_SECRET;
+  if (fromEnv && fromEnv.length > 0) return Buffer.from(fromEnv, "utf8");
+  if (process.env.NODE_ENV === "production") {
+    console.warn(
+      "[HTTP] WARNING MCP_REFRESH_SECRET not set \u2014 refresh tokens will not survive restart"
+    );
+  }
+  return randomBytes(32);
+})();
+function sign(payloadB64) {
+  return createHmac("sha256", secret).update(payloadB64).digest();
+}
+function signRefreshToken(apiKey) {
+  const payload = {
+    k: apiKey,
+    i: Date.now(),
+    j: randomUUID()
+  };
+  const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+  const sigB64 = sign(payloadB64).toString("base64url");
+  return `${PREFIX}${payloadB64}.${sigB64}`;
+}
+function verifyRefreshToken(token) {
+  if (typeof token !== "string" || !token.startsWith(PREFIX)) return null;
+  const body = token.slice(PREFIX.length);
+  const dot = body.indexOf(".");
+  if (dot <= 0 || dot === body.length - 1) return null;
+  const payloadB64 = body.slice(0, dot);
+  const sigB64 = body.slice(dot + 1);
+  let providedSig;
+  try {
+    providedSig = Buffer.from(sigB64, "base64url");
+  } catch {
+    return null;
+  }
+  const expectedSig = sign(payloadB64);
+  if (providedSig.length !== expectedSig.length) return null;
+  if (!timingSafeEqual(providedSig, expectedSig)) return null;
+  let payload;
+  try {
+    const json = Buffer.from(payloadB64, "base64url").toString("utf8");
+    payload = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!payload || typeof payload.k !== "string" || typeof payload.i !== "number" || typeof payload.j !== "string") {
+    return null;
+  }
+  if (Date.now() - payload.i > REFRESH_TOKEN_TTL_MS) return null;
+  return { apiKey: payload.k };
+}
+
+// src/sessionCap.ts
+function planKeyAdmission(sessions2, keyHash, cap, now, opts) {
+  if (cap < 1) {
+    throw new RangeError(`cap must be >= 1, got ${cap}`);
+  }
+  const { ttlMs, graceMs } = opts;
+  const isProtected = (s) => s.inFlight > 0 || now - s.lastAccess < graceMs;
+  const keyEntries = [];
+  for (const [id, session] of sessions2) {
+    if (session.keyHash === keyHash) {
+      keyEntries.push([id, session]);
+    }
+  }
+  const evictSet = /* @__PURE__ */ new Set();
+  for (const [id, session] of keyEntries) {
+    if (!isProtected(session) && now - session.lastAccess >= ttlMs) {
+      evictSet.add(id);
+    }
+  }
+  let survivors = keyEntries.filter(([id]) => !evictSet.has(id));
+  if (survivors.length >= cap) {
+    const idleSurvivors = survivors.filter(([, s]) => !isProtected(s)).sort(([, a], [, b]) => a.lastAccess - b.lastAccess);
+    for (const [id] of idleSurvivors) {
+      if (survivors.length < cap) break;
+      evictSet.add(id);
+      survivors = survivors.filter(([sid]) => sid !== id);
+    }
+  }
+  const evict = Array.from(evictSet);
+  const admit = survivors.length < cap;
+  let retryAfterSeconds = 0;
+  let retryIsPoll = false;
+  if (!admit) {
+    const graceBlockers = survivors.filter(([, s]) => s.inFlight === 0);
+    if (graceBlockers.length > 0) {
+      const minLastAccess = Math.min(...graceBlockers.map(([, s]) => s.lastAccess));
+      const msRemaining = graceMs - (now - minLastAccess);
+      retryAfterSeconds = Math.max(1, Math.ceil(msRemaining / 1e3));
+    } else {
+      retryAfterSeconds = 5;
+      retryIsPoll = true;
+    }
+  }
+  return { evict, admit, retryAfterSeconds, retryIsPoll };
+}
+function countKeySessions(sessions2, keyHash) {
+  let count = 0;
+  for (const session of sessions2.values()) {
+    if (session.keyHash === keyHash) count++;
+  }
+  return count;
+}
+
+// src/httpErrors.ts
+function clampSeconds(s) {
+  return Math.max(0, Math.round(s));
+}
+function build(reason, message, p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return {
+    status: 429,
+    headers: { "Retry-After": String(seconds) },
+    body: {
+      jsonrpc: "2.0",
+      id: p.id ?? null,
+      error: {
+        code: -32e3,
+        message,
+        data: {
+          reason,
+          retryAfterSeconds: seconds,
+          limit: p.limit,
+          current: p.current
+        }
+      }
+    }
+  };
+}
+function buildRateLimitError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return build(
+    "rate_limited",
+    `Too many requests \u2014 retry after ${seconds} s.`,
+    p
+  );
+}
+function buildAuthLockoutError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return build(
+    "auth_lockout",
+    `Too many failed auth attempts \u2014 locked out, retry after ${seconds} s.`,
+    p
+  );
+}
+function buildSessionCapError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  const message = p.poll ? "Server busy \u2014 all sessions active; retry shortly." : `Too many active sessions for this key \u2014 retry after ${seconds} s.`;
+  return build("session_cap", message, p);
+}
+function send429(res, built) {
+  if (res.headersSent) return;
+  for (const [k, v] of Object.entries(built.headers)) {
+    res.setHeader(k, v);
+  }
+  res.status(built.status).json(built.body);
+}
+
+// src/authLockout.ts
+var AUTH_FAILURE_MAX = 10;
+var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
+var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
+var MAX_AUTH_FAILURE_ENTRIES = 1e4;
+function resolveBearerAuth(authorizationHeader, accessTokens2, now, accessTokenTtlMs) {
+  if (typeof authorizationHeader !== "string" || authorizationHeader.trim() === "") {
+    return { status: "absent" };
+  }
+  if (!authorizationHeader.startsWith("Bearer ")) {
+    return { status: "rejected" };
+  }
+  const token = authorizationHeader.slice(7).trim();
+  if (token === "") {
+    return { status: "rejected" };
+  }
+  if (token.startsWith("pb_sk_")) {
+    return { status: "ok", apiKey: token };
+  }
+  if (token.startsWith("pb_at_")) {
+    const entry = accessTokens2.get(token);
+    if (!entry) return { status: "rejected" };
+    if (now - entry.createdAt > accessTokenTtlMs) {
+      accessTokens2.delete(token);
+      return { status: "rejected" };
+    }
+    return { status: "ok", apiKey: entry.apiKey };
+  }
+  return { status: "rejected" };
+}
+function checkAuthBlock(failures, ip, now) {
+  const rec = failures.get(ip);
+  if (!rec) return false;
+  return rec.blockedUntil > now;
+}
+function recordAuthFailure(failures, ip, now) {
+  const rec = failures.get(ip);
+  if (!rec) {
+    failures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });
+    return;
+  }
+  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
+    rec.count = 1;
+    rec.firstFailure = now;
+    rec.blockedUntil = 0;
+  } else {
+    rec.count++;
+    if (rec.count >= AUTH_FAILURE_MAX) {
+      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
+    }
+  }
+}
+
 // src/http.ts
 bootstrapHttp();
 initAnalytics();
@@ -78,7 +295,7 @@ app.use((_req, res, next) => {
     "Access-Control-Allow-Headers",
     "Content-Type, Authorization, Mcp-Session-Id, Last-Event-Id"
   );
-  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
+  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id, Retry-After");
   if (_req.method === "OPTIONS") {
     res.status(204).end();
     return;
@@ -137,7 +354,7 @@ app.post(
       });
       return;
     }
-    const clientId = `pb_client_${randomUUID()}`;
+    const clientId = `pb_client_${randomUUID2()}`;
     const client = {
       client_id: clientId,
       redirect_uris,
@@ -158,10 +375,6 @@ app.post(
 var pendingCodes = /* @__PURE__ */ new Map();
 var ACCESS_TOKEN_TTL = 3600;
 var ACCESS_TOKEN_TTL_MS = ACCESS_TOKEN_TTL * 1e3;
-var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
-var refreshTokens = /* @__PURE__ */ new Map();
-var MAX_REFRESH_TOKENS = 2e3;
-var MAX_REFRESH_TOKENS_PER_KEY = 20;
 var accessTokens = /* @__PURE__ */ new Map();
 setInterval(() => {
   const now = Date.now();
@@ -171,15 +384,6 @@ setInterval(() => {
   for (const [id, client] of registeredClients) {
     if (now - client.registeredAt > 24 * 60 * 6e4) registeredClients.delete(id);
   }
-  for (const [token, entry] of refreshTokens) {
-    if (now - entry.createdAt > REFRESH_TOKEN_TTL_MS) refreshTokens.delete(token);
-  }
-  if (refreshTokens.size > MAX_REFRESH_TOKENS) {
-    const sorted = [...refreshTokens.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
-    for (let i = 0; i < sorted.length - MAX_REFRESH_TOKENS; i++) {
-      refreshTokens.delete(sorted[i][0]);
-    }
-  }
   for (const [token, entry] of accessTokens) {
     if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) accessTokens.delete(token);
   }
@@ -415,12 +619,22 @@ ${appLogoStyles}
   color:var(--fg-bright);opacity:0;
 }
 .panel:not([hidden]) .ok-title{animation:rise 600ms ease-out 380ms forwards}
-.ok-sentence{
-  margin:20px auto 0;font-size:16px;line-height:1.6;color:var(--fg2);
+.ok-lead{
+  margin:18px auto 0;max-width:22em;font-size:16px;line-height:1.55;color:var(--fg2);
   opacity:0;
-  display:flex;align-items:center;justify-content:center;gap:8px;flex-wrap:wrap;
 }
-.panel:not([hidden]) .ok-sentence{animation:rise 600ms ease-out 520ms forwards}
+.panel:not([hidden]) .ok-lead{animation:rise 600ms ease-out 500ms forwards}
+.ok-phrase-row{
+  margin-top:14px;display:flex;align-items:center;justify-content:center;
+  opacity:0;
+}
+.panel:not([hidden]) .ok-phrase-row{animation:rise 600ms ease-out 620ms forwards}
+.cmd.is-copied .cmd-quote-part{display:none}
+.success-cta-wrap{
+  margin-top:48px;width:100%;opacity:0;
+}
+.panel:not([hidden]) .success-cta-wrap{animation:rise 600ms ease-out 780ms forwards}
+a.btn-primary.success-cta{color:var(--btn-fg);text-decoration:none}
 
 .cmd{
   display:inline-flex;align-items:center;gap:8px;vertical-align:middle;
@@ -441,16 +655,6 @@ ${appLogoStyles}
 .cmd.is-copied .cmd-icon{color:var(--green);opacity:1}
 .cmd .cmd-icon svg{width:12px;height:12px;stroke:currentColor;fill:none;stroke-width:1.5;stroke-linecap:round;stroke-linejoin:round}
 
-.return-link{
-  display:block;margin:36px auto 0;width:fit-content;
-  font-family:var(--font-mono);font-size:11px;letter-spacing:0.18em;
-  text-transform:uppercase;color:var(--fg4);text-decoration:none;
-  border-bottom:1px dotted currentColor;padding-bottom:2px;
-  opacity:0;transition:color 140ms;
-}
-.panel:not([hidden]) .return-link{animation:rise 600ms ease-out 760ms forwards}
-.return-link:hover{color:var(--fg2)}
-
 /* error specifics */
 .err-title{
   font-family:var(--font-display);font-weight:600;
@@ -514,7 +718,7 @@ ${appLogoStyles}
 }
 function providerDisplayName(clientName) {
   const name = (clientName ?? "").trim();
-  if (!name) return "your agent";
+  if (!name) return "your assistant";
   return name.length > 40 ? name.slice(0, 40) + "\u2026" : name;
 }
 function successPanelInner(workspaceName, redirectUrl, providerName) {
@@ -536,18 +740,19 @@ function successPanelInner(workspaceName, redirectUrl, providerName) {
   <div class="orb-core"><div class="orb-dot"></div></div>
 </div>
 <div class="eyebrow success"><span class="dot"></span>Connected</div>
-<h1 class="ok-title">Product Brain is live.</h1>
-<p class="ok-sentence">
-  <span>Then say</span>
-  <button class="cmd" type="button" data-cmd-pill data-redirect="${esc(redirectUrl)}" aria-label="Copy 'Start PB' and return to ${esc(providerName)}">
-    <span data-cmd-text>Start PB</span>
+<h1 class="ok-title">Product Brain is Live</h1>
+<p class="ok-lead">Return to your assistant, then say</p>
+<div class="ok-phrase-row">
+  <button class="cmd" type="button" data-cmd-pill data-redirect="${esc(redirectUrl)}" aria-label="Copy &quot;Start PB&quot; and return to ${esc(providerName)}">
+    <span class="cmd-quote-part" aria-hidden="true">&ldquo;</span><span data-cmd-text>Start PB</span><span class="cmd-quote-part" aria-hidden="true">&rdquo;</span>
     <span class="cmd-icon" aria-hidden="true">
       <svg data-cmd-svg viewBox="0 0 24 24"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M5 15V6a2 2 0 0 1 2-2h9"/></svg>
     </span>
   </button>
-  <span>in <span data-provider>${esc(providerName)}</span>.</span>
-</p>
-<a class="return-link" href="${esc(redirectUrl)}" data-return-link>Return to <span data-provider>${esc(providerName)}</span> &rarr;</a>
+</div>
+<div class="success-cta-wrap">
+  <a class="btn-primary success-cta" href="${esc(redirectUrl)}">Continue in ${esc(providerName)}</a>
+</div>
 <!-- workspace name retained as data hook for tests, hidden from view -->
 <span hidden data-field="ws-name">${esc(workspaceName)}</span>`;
 }
@@ -579,7 +784,7 @@ var cmdScript = `
         pill.classList.add('is-copied');
         if(textEl)textEl.textContent='Copied';
         if(svgEl)svgEl.innerHTML='<polyline points="4 12 10 18 20 6"/>';
-        setTimeout(function(){if(redirectUrl)window.location.href=redirectUrl},900);
+        setTimeout(function(){if(redirectUrl)window.location.assign(redirectUrl)},900);
       };
       try{
         if(navigator.clipboard&&navigator.clipboard.writeText){
@@ -677,7 +882,7 @@ ${cmdScript}
   function showSuccess(workspaceName,redirectUrl,providerName){
     var tpl=document.getElementById('tpl-connected');
     var safeWs=String(workspaceName||'').replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]});
-    var safeProv=String(providerName||'your agent').replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]});
+    var safeProv=String(providerName||'your assistant').replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]});
     var safeUrl=String(redirectUrl||'').replace(/"/g,'&quot;').replace(/[<>]/g,function(c){return{'<':'&lt;','>':'&gt;'}[c]});
     var html=tpl.innerHTML.split('__WS__').join(safeWs).split('__URL__').join(safeUrl).split('__PROVIDER__').join(safeProv);
     pOk.innerHTML=html;
@@ -865,7 +1070,7 @@ app.post(
     } catch {
       process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
     }
-    const code = randomUUID();
+    const code = randomUUID2();
     pendingCodes.set(code, {
       apiKey: api_key,
       codeChallenge: code_challenge,
@@ -885,42 +1090,13 @@ app.post(
   }
 );
 function issueTokens(apiKey) {
-  const now = Date.now();
-  const refreshToken = `pb_rt_${randomUUID()}`;
-  let perKeyCount = 0;
-  let oldestKeyForApiKey = null;
-  let oldestAtForApiKey = Infinity;
-  for (const [k, v] of refreshTokens) {
-    if (v.apiKey === apiKey) {
-      perKeyCount++;
-      if (v.createdAt < oldestAtForApiKey) {
-        oldestAtForApiKey = v.createdAt;
-        oldestKeyForApiKey = k;
-      }
-    }
-  }
-  if (perKeyCount >= MAX_REFRESH_TOKENS_PER_KEY && oldestKeyForApiKey) {
-    refreshTokens.delete(oldestKeyForApiKey);
-  }
-  if (refreshTokens.size >= MAX_REFRESH_TOKENS) {
-    let oldestKey = null;
-    let oldestAt = Infinity;
-    for (const [k, v] of refreshTokens) {
-      if (v.createdAt < oldestAt) {
-        oldestAt = v.createdAt;
-        oldestKey = k;
-      }
-    }
-    if (oldestKey) refreshTokens.delete(oldestKey);
-  }
-  refreshTokens.set(refreshToken, { apiKey, createdAt: now });
   return {
     access_token: apiKey,
     token_type: "Bearer",
     // 1-year TTL: actual validity enforced by Convex, not by expiry clock.
     // Long TTL prevents unnecessary refresh cycles after restarts.
     expires_in: 365 * 24 * 3600,
-    refresh_token: refreshToken
+    refresh_token: signRefreshToken(apiKey)
   };
 }
 app.post(
@@ -931,19 +1107,15 @@ app.post(
   (req, res) => {
     const { grant_type, code, code_verifier, redirect_uri, refresh_token } = req.body;
     if (grant_type === "refresh_token") {
-      const entry = refreshTokens.get(refresh_token);
-      if (!entry) {
-        res.status(400).json({ error: "invalid_grant", error_description: "Invalid refresh token" });
-        return;
-      }
-      if (Date.now() - entry.createdAt > REFRESH_TOKEN_TTL_MS) {
-        refreshTokens.delete(refresh_token);
-        res.status(400).json({ error: "invalid_grant", error_description: "Refresh token expired" });
+      const verified = verifyRefreshToken(refresh_token);
+      if (!verified) {
+        res.status(400).json({
+          error: "invalid_grant",
+          error_description: "Invalid or expired refresh token"
+        });
         return;
       }
-      const apiKey = entry.apiKey;
-      refreshTokens.delete(refresh_token);
-      res.json(issueTokens(apiKey));
+      res.json(issueTokens(verified.apiKey));
       return;
     }
     if (grant_type !== "authorization_code") {
@@ -973,85 +1145,63 @@ var mcpLimiter = rateLimit({
   max: 120,
   standardHeaders: true,
   legacyHeaders: false,
-  message: { error: "Too many requests. Try again later." }
+  handler: (req, res) => {
+    const r = req.rateLimit;
+    const reset = r?.resetTime?.getTime?.() ?? Date.now() + 6e4;
+    send429(res, buildRateLimitError({
+      retryAfterSeconds: Math.max(1, Math.ceil((reset - Date.now()) / 1e3)),
+      limit: r?.limit ?? 120,
+      current: r?.used ?? 0,
+      id: req.body?.id ?? null
+      // mirror the JSON-RPC id when a POST body is present
+    }));
+  }
 });
 var authFailures = /* @__PURE__ */ new Map();
-var AUTH_FAILURE_MAX = 10;
-var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
-var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
-var MAX_AUTH_FAILURE_ENTRIES = 1e4;
-function checkAuthBlock(ip) {
-  const rec = authFailures.get(ip);
-  if (!rec) return false;
-  return rec.blockedUntil > Date.now();
-}
-function recordAuthFailure(ip) {
-  const now = Date.now();
-  const rec = authFailures.get(ip);
-  if (!rec) {
-    authFailures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });
-    return;
-  }
-  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
-    rec.count = 1;
-    rec.firstFailure = now;
-    rec.blockedUntil = 0;
-  } else {
-    rec.count++;
-    if (rec.count >= AUTH_FAILURE_MAX) {
-      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
-    }
-  }
-}
 app.get("/health", (_req, res) => {
   res.json({ status: "ok", version: SERVER_VERSION, transport: "http" });
 });
 var sessions = /* @__PURE__ */ new Map();
 var SESSION_TTL_MS = 30 * 60 * 1e3;
 var MAX_SESSIONS = 200;
-var MAX_SESSIONS_PER_KEY = 5;
+var EVICT_GRACE_MS = 6e4;
+var MAX_SESSIONS_PER_KEY = Math.max(
+  1,
+  Math.min(MAX_SESSIONS - 1, Number(process.env.MCP_MAX_SESSIONS_PER_KEY) || 25)
+);
 function evictStaleSessions() {
   const now = Date.now();
   for (const [id, entry] of sessions) {
     if (now - entry.lastAccess > SESSION_TTL_MS) {
-      logSessionLifecycle("session_deleted", id, "ttl");
+      logSessionLifecycle(
+        "session_deleted",
+        id,
+        entry.inFlight > 0 ? "inflight_leak" : "ttl"
+      );
       entry.transport.close().catch(() => {
       });
       sessions.delete(id);
     }
   }
   if (sessions.size > MAX_SESSIONS) {
-    const sorted = [...sessions.entries()].sort(
-      (a, b) => a[1].lastAccess - b[1].lastAccess
-    );
-    for (let i = 0; i < sorted.length - MAX_SESSIONS; i++) {
+    const sorted = [...sessions.entries()].filter(([, e]) => e.inFlight === 0).sort((a, b) => a[1].lastAccess - b[1].lastAccess);
+    const overflow = sessions.size - MAX_SESSIONS;
+    for (let i = 0; i < Math.min(overflow, sorted.length); i++) {
       logSessionLifecycle("session_deleted", sorted[i][0], "eviction");
       sorted[i][1].transport.close().catch(() => {
       });
       sessions.delete(sorted[i][0]);
     }
-  }
-}
-setInterval(evictStaleSessions, 6e4);
-function extractBearerKey(req) {
-  const header = req.headers?.authorization;
-  if (typeof header !== "string" || !header.startsWith("Bearer ")) return null;
-  const token = header.slice(7).trim();
-  if (token.startsWith("pb_sk_")) {
-    return token;
-  }
-  if (token.startsWith("pb_at_")) {
-    const entry = accessTokens.get(token);
-    if (!entry) return null;
-    const now = Date.now();
-    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) {
-      accessTokens.delete(token);
-      return null;
+    if (sessions.size > MAX_SESSIONS) {
+      const ts = (/* @__PURE__ */ new Date()).toISOString();
+      process.stderr.write(
+        `[HTTP] ${ts} session_cap_breach size=${sessions.size} max=${MAX_SESSIONS} reason=all_inflight (no idle sessions to evict; TTL backstop will reclaim)
+`
+      );
     }
-    return entry.apiKey;
   }
-  return null;
 }
+setInterval(evictStaleSessions, 6e4);
 function send401(req, res) {
   const base = baseUrl(req);
   res.status(401).set(
@@ -1074,17 +1224,21 @@ function logSessionLifecycle(event, sessionId, reason) {
 }
 app.post("/mcp", mcpLimiter, async (req, res) => {
   const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+  const nowTs = Date.now();
+  if (checkAuthBlock(authFailures, reqIp, nowTs)) {
+    const rec = authFailures.get(reqIp);
+    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - nowTs) / 1e3)) : 0;
+    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  if (auth.status !== "ok") {
     logRequest("POST", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   const reqStart = Date.now();
   try {
@@ -1099,41 +1253,91 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
           });
           return;
         }
-        entry.lastAccess = Date.now();
-        await entry.transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", sessionId, Date.now() - reqStart);
+        try {
+          entry.inFlight++;
+          entry.lastAccess = Date.now();
+          await entry.transport.handleRequest(req, res, req.body);
+          logRequest("POST", "ok", sessionId, Date.now() - reqStart);
+        } finally {
+          entry.inFlight--;
+          entry.lastAccess = Date.now();
+        }
       } else if (!sessionId && isInitializeRequest(req.body)) {
         const keyH = hashKey(apiKey);
-        let keySessionCount = 0;
-        for (const entry of sessions.values()) {
-          if (entry.keyHash === keyH) keySessionCount++;
-        }
-        if (keySessionCount >= MAX_SESSIONS_PER_KEY) {
-          res.status(429).json({
-            jsonrpc: "2.0",
-            error: { code: -32e3, message: "Too many sessions for this API key" },
-            id: null
+        const plan = planKeyAdmission(
+          sessions,
+          keyH,
+          MAX_SESSIONS_PER_KEY,
+          Date.now(),
+          { ttlMs: SESSION_TTL_MS, graceMs: EVICT_GRACE_MS }
+        );
+        for (const sid2 of plan.evict) {
+          const victim = sessions.get(sid2);
+          sessions.delete(sid2);
+          victim?.transport.close().catch(() => {
           });
+          logSessionLifecycle("session_deleted", sid2, "lru_evict");
+        }
+        if (!plan.admit) {
+          send429(res, buildSessionCapError({
+            retryAfterSeconds: plan.retryAfterSeconds,
+            limit: MAX_SESSIONS_PER_KEY,
+            current: countKeySessions(sessions, keyH),
+            poll: plan.retryIsPoll,
+            id: req.body?.id ?? null
+          }));
           return;
         }
+        const sid = randomUUID2();
+        let initialized = false;
         const transport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID(),
-          onsessioninitialized: (sid) => {
-            sessions.set(sid, { transport, lastAccess: Date.now(), keyHash: keyH });
-            logSessionLifecycle("session_created", sid);
+          sessionIdGenerator: () => sid,
+          onsessioninitialized: (s) => {
+            initialized = true;
+            logSessionLifecycle("session_created", s);
           }
+          // log only — no map write
         });
+        const reserved = { transport, lastAccess: Date.now(), keyHash: keyH, inFlight: 1 };
+        sessions.set(sid, reserved);
         transport.onclose = () => {
-          const sid = transport.sessionId;
-          if (sid) {
-            logSessionLifecycle("session_deleted", sid, "onclose");
-            sessions.delete(sid);
+          const s = transport.sessionId ?? sid;
+          if (sessions.has(s)) {
+            sessions.delete(s);
+            logSessionLifecycle("session_deleted", s, "onclose");
           }
         };
-        const server = createProductBrainServer();
-        await server.connect(transport);
-        await transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+        try {
+          const server = createProductBrainServer();
+          await server.connect(transport);
+          await transport.handleRequest(req, res, req.body);
+          logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+        } catch (e) {
+          transport.onclose = void 0;
+          sessions.delete(sid);
+          throw e;
+        } finally {
+          if (!initialized) {
+            transport.onclose = void 0;
+            if (sessions.delete(sid)) logSessionLifecycle("session_deleted", sid, "init_rejected");
+          } else {
+            const e = sessions.get(sid);
+            if (e) {
+              e.inFlight--;
+              e.lastAccess = Date.now();
+            }
+          }
+        }
+      } else if (sessionId) {
+        process.stderr.write(
+          `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale sessionId=${sessionId} (likely server restart \u2014 instructing client to re-initialise)
+`
+        );
+        res.status(404).json({
+          jsonrpc: "2.0",
+          error: { code: -32001, message: "Session not found \u2014 re-initialise" },
+          id: null
+        });
       } else {
         process.stderr.write(
           `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_invalid no valid session ID (client may have omitted Mcp-Session-Id)
@@ -1159,20 +1363,32 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
 });
 app.get("/mcp", mcpLimiter, async (req, res) => {
   const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+  const nowTs = Date.now();
+  if (checkAuthBlock(authFailures, reqIp, nowTs)) {
+    const rec = authFailures.get(reqIp);
+    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - nowTs) / 1e3)) : 0;
+    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  if (auth.status !== "ok") {
     logRequest("GET", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
-  if (!sessionId || !sessions.has(sessionId)) {
-    res.status(400).send("Invalid or missing session ID");
+  if (!sessionId) {
+    res.status(400).send("Missing Mcp-Session-Id header");
+    return;
+  }
+  if (!sessions.has(sessionId)) {
+    process.stderr.write(
+      `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale GET sessionId=${sessionId}
+`
+    );
+    res.status(404).send("Session not found \u2014 re-initialise");
     return;
   }
   try {
@@ -1196,20 +1412,32 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
 });
 app.delete("/mcp", mcpLimiter, async (req, res) => {
   const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+  const nowTs = Date.now();
+  if (checkAuthBlock(authFailures, reqIp, nowTs)) {
+    const rec = authFailures.get(reqIp);
+    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - nowTs) / 1e3)) : 0;
+    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  if (auth.status !== "ok") {
     logRequest("DELETE", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
-  if (!sessionId || !sessions.has(sessionId)) {
-    res.status(400).send("Invalid or missing session ID");
+  if (!sessionId) {
+    res.status(400).send("Missing Mcp-Session-Id header");
+    return;
+  }
+  if (!sessions.has(sessionId)) {
+    process.stderr.write(
+      `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale DELETE sessionId=${sessionId}
+`
+    );
+    res.status(404).send("Session not found \u2014 re-initialise");
     return;
   }
   try {