@productbrain/mcp 0.0.1-beta.83 → 0.0.1-beta.8308

package/dist/http.js

@@ -1,24 +1,343 @@
 import {
   SERVER_VERSION,
-  createProductBrainServer
-} from "./chunk-WXT35272.js";
+  createProductBrainServer,
+  initFeatureFlags
+} from "./chunk-KLCOIZH3.js";
 import {
+  DEFAULT_CLOUD_URL,
   bootstrapHttp,
-  initFeatureFlags,
-  runWithAuth
-} from "./chunk-G4JJNINW.js";
-import {
+  getKeyState,
   getPostHogClient,
+  hashKey,
   initAnalytics,
+  runWithAuth,
   shutdownAnalytics
-} from "./chunk-RQXM3TCI.js";
+} from "./chunk-JRPTAOCM.js";
 
 // src/http.ts
-import { createHash, randomUUID } from "crypto";
+import { createHash, randomUUID as randomUUID2 } from "crypto";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import rateLimit from "express-rate-limit";
+
+// src/brand/logo-markup.ts
+var SIZE_CLASSES = {
+  sm: "pb-logo--sm",
+  md: "pb-logo--md"
+};
+var appLogoStyles = `
+.pb-logo{display:inline-flex;align-items:center;gap:8px;color:inherit}
+.pb-logo__mark{
+  border-radius:4px;background:#1c1e24;
+  border:1px solid rgba(255,255,255,0.06);
+  display:inline-grid;place-items:center;flex-shrink:0;
+}
+.pb-logo__core{border-radius:50%;background:var(--accent,#c9b99a)}
+.pb-logo__name{
+  font-family:var(--font-mono,"IBM Plex Mono",ui-monospace,monospace);
+  font-weight:500;text-transform:uppercase;
+  letter-spacing:0.22em;color:var(--fg4,#6a6560);
+}
+.pb-logo--sm .pb-logo__mark{width:16px;height:16px}
+.pb-logo--sm .pb-logo__core{width:5px;height:5px}
+.pb-logo--sm .pb-logo__name{font-size:10.5px}
+.pb-logo--md .pb-logo__mark{width:24px;height:24px;border-radius:6px}
+.pb-logo--md .pb-logo__core{width:8px;height:8px}
+.pb-logo--md .pb-logo__name{font-size:13px}
+`;
+function appLogoMarkup(opts = {}) {
+  const size = opts.size ?? "sm";
+  const showWordmark = opts.showWordmark ?? true;
+  const cls = ["pb-logo", SIZE_CLASSES[size], opts.className].filter(Boolean).join(" ");
+  const wordmark = showWordmark ? `<span class="pb-logo__name">Product Brain</span>` : "";
+  return `<span class="${cls}"><span class="pb-logo__mark"><span class="pb-logo__core"></span></span>${wordmark}</span>`;
+}
+
+// src/lib/refresh-token.ts
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
+var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
+var PREFIX = "pb_rt_";
+var secret = (() => {
+  const fromEnv = process.env.MCP_REFRESH_SECRET;
+  if (fromEnv && fromEnv.length > 0) return Buffer.from(fromEnv, "utf8");
+  if (process.env.NODE_ENV === "production") {
+    console.warn(
+      "[HTTP] WARNING MCP_REFRESH_SECRET not set \u2014 refresh tokens will not survive restart"
+    );
+  }
+  return randomBytes(32);
+})();
+function sign(payloadB64) {
+  return createHmac("sha256", secret).update(payloadB64).digest();
+}
+function signRefreshToken(apiKey) {
+  const payload = {
+    k: apiKey,
+    i: Date.now(),
+    j: randomUUID()
+  };
+  const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+  const sigB64 = sign(payloadB64).toString("base64url");
+  return `${PREFIX}${payloadB64}.${sigB64}`;
+}
+function verifyRefreshToken(token) {
+  if (typeof token !== "string" || !token.startsWith(PREFIX)) return null;
+  const body = token.slice(PREFIX.length);
+  const dot = body.indexOf(".");
+  if (dot <= 0 || dot === body.length - 1) return null;
+  const payloadB64 = body.slice(0, dot);
+  const sigB64 = body.slice(dot + 1);
+  let providedSig;
+  try {
+    providedSig = Buffer.from(sigB64, "base64url");
+  } catch {
+    return null;
+  }
+  const expectedSig = sign(payloadB64);
+  if (providedSig.length !== expectedSig.length) return null;
+  if (!timingSafeEqual(providedSig, expectedSig)) return null;
+  let payload;
+  try {
+    const json = Buffer.from(payloadB64, "base64url").toString("utf8");
+    payload = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!payload || typeof payload.k !== "string" || typeof payload.i !== "number" || typeof payload.j !== "string") {
+    return null;
+  }
+  if (Date.now() - payload.i > REFRESH_TOKEN_TTL_MS) return null;
+  return { apiKey: payload.k };
+}
+
+// src/sessionCap.ts
+function planKeyAdmission(sessions2, keyHash, cap, now, opts) {
+  if (cap < 1) {
+    throw new RangeError(`cap must be >= 1, got ${cap}`);
+  }
+  const { ttlMs, graceMs } = opts;
+  const isProtected = (s) => s.inFlight > 0 || now - s.lastAccess < graceMs;
+  const keyEntries = [];
+  for (const [id, session] of sessions2) {
+    if (session.keyHash === keyHash) {
+      keyEntries.push([id, session]);
+    }
+  }
+  const evictSet = /* @__PURE__ */ new Set();
+  for (const [id, session] of keyEntries) {
+    if (!isProtected(session) && now - session.lastAccess >= ttlMs) {
+      evictSet.add(id);
+    }
+  }
+  let survivors = keyEntries.filter(([id]) => !evictSet.has(id));
+  if (survivors.length >= cap) {
+    const idleSurvivors = survivors.filter(([, s]) => !isProtected(s)).sort(([, a], [, b]) => a.lastAccess - b.lastAccess);
+    for (const [id] of idleSurvivors) {
+      if (survivors.length < cap) break;
+      evictSet.add(id);
+      survivors = survivors.filter(([sid]) => sid !== id);
+    }
+  }
+  const evict = Array.from(evictSet);
+  const admit = survivors.length < cap;
+  let retryAfterSeconds = 0;
+  let retryIsPoll = false;
+  if (!admit) {
+    const graceBlockers = survivors.filter(([, s]) => s.inFlight === 0);
+    if (graceBlockers.length > 0) {
+      const minLastAccess = Math.min(...graceBlockers.map(([, s]) => s.lastAccess));
+      const msRemaining = graceMs - (now - minLastAccess);
+      retryAfterSeconds = Math.max(1, Math.ceil(msRemaining / 1e3));
+    } else {
+      retryAfterSeconds = 5;
+      retryIsPoll = true;
+    }
+  }
+  return { evict, admit, retryAfterSeconds, retryIsPoll };
+}
+function countKeySessions(sessions2, keyHash) {
+  let count = 0;
+  for (const session of sessions2.values()) {
+    if (session.keyHash === keyHash) count++;
+  }
+  return count;
+}
+
+// src/httpErrors.ts
+function clampSeconds(s) {
+  return Math.max(0, Math.round(s));
+}
+function build(reason, message, p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return {
+    status: 429,
+    headers: { "Retry-After": String(seconds) },
+    body: {
+      jsonrpc: "2.0",
+      id: p.id ?? null,
+      error: {
+        code: -32e3,
+        message,
+        data: {
+          reason,
+          retryAfterSeconds: seconds,
+          limit: p.limit,
+          current: p.current
+        }
+      }
+    }
+  };
+}
+function buildRateLimitError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return build(
+    "rate_limited",
+    `Too many requests \u2014 retry after ${seconds} s.`,
+    p
+  );
+}
+function buildAuthLockoutError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return build(
+    "auth_lockout",
+    `Too many failed auth attempts \u2014 locked out, retry after ${seconds} s.`,
+    p
+  );
+}
+function buildSessionCapError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  const message = p.poll ? "Server busy \u2014 all sessions active; retry shortly." : `Too many active sessions for this key \u2014 retry after ${seconds} s.`;
+  return build("session_cap", message, p);
+}
+function send429(res, built) {
+  if (res.headersSent) return;
+  for (const [k, v] of Object.entries(built.headers)) {
+    res.setHeader(k, v);
+  }
+  res.status(built.status).json(built.body);
+}
+
+// src/authLockout.ts
+var AUTH_FAILURE_MAX = 10;
+var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
+var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
+var MAX_AUTH_FAILURE_ENTRIES = 1e4;
+function resolveBearerAuth(authorizationHeader, accessTokens2, now, accessTokenTtlMs) {
+  if (typeof authorizationHeader !== "string" || authorizationHeader.trim() === "") {
+    return { status: "absent" };
+  }
+  if (!authorizationHeader.startsWith("Bearer ")) {
+    return { status: "rejected" };
+  }
+  const token = authorizationHeader.slice(7).trim();
+  if (token === "") {
+    return { status: "rejected" };
+  }
+  if (token.startsWith("pb_sk_")) {
+    return { status: "ok", apiKey: token };
+  }
+  if (token.startsWith("pb_at_")) {
+    const entry = accessTokens2.get(token);
+    if (!entry) return { status: "rejected" };
+    if (now - entry.createdAt > accessTokenTtlMs) {
+      accessTokens2.delete(token);
+      return { status: "rejected" };
+    }
+    return { status: "ok", apiKey: entry.apiKey };
+  }
+  return { status: "rejected" };
+}
+function checkAuthBlock(failures, ip, now) {
+  const rec = failures.get(ip);
+  if (!rec) return false;
+  return rec.blockedUntil > now;
+}
+function recordAuthFailure(failures, ip, now) {
+  const rec = failures.get(ip);
+  if (!rec) {
+    failures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });
+    return;
+  }
+  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
+    rec.count = 1;
+    rec.firstFailure = now;
+    rec.blockedUntil = 0;
+  } else {
+    rec.count++;
+    if (rec.count >= AUTH_FAILURE_MAX) {
+      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
+    }
+  }
+}
+
+// src/lib/oauthRedirectAllowlist.ts
+var DEFAULT_OAUTH_REDIRECT_HOSTS = [
+  "claude.ai",
+  "claude.com",
+  "chatgpt.com"
+];
+var LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+var MAX_REDIRECT_URI_LENGTH = 2048;
+var MAX_REGISTRATION_REDIRECTS = 10;
+function parseHostAllowlist(raw) {
+  if (!raw) return [];
+  const hosts = [];
+  for (const part of raw.split(",")) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    try {
+      const asUrl = trimmed.includes("://") ? new URL(trimmed) : new URL(`https://${trimmed}`);
+      const host = asUrl.hostname.toLowerCase();
+      if (host) hosts.push(host);
+    } catch {
+    }
+  }
+  return hosts;
+}
+function resolveOAuthRedirectHosts(opts = {}) {
+  const hosts = new Set(DEFAULT_OAUTH_REDIRECT_HOSTS);
+  for (const h of parseHostAllowlist(opts.explicitAllowlist)) hosts.add(h);
+  return [...hosts];
+}
+function checkRedirectUri(redirectUri, allowedHosts) {
+  if (typeof redirectUri !== "string" || redirectUri.length === 0) {
+    return "redirect_uri is required";
+  }
+  if (redirectUri.length > MAX_REDIRECT_URI_LENGTH) {
+    return `redirect_uri is longer than ${MAX_REDIRECT_URI_LENGTH} characters`;
+  }
+  let url;
+  try {
+    url = new URL(redirectUri);
+  } catch {
+    return "redirect_uri is not a valid absolute URL";
+  }
+  if (url.username || url.password) return "redirect_uri must not contain credentials";
+  if (url.hash) return "redirect_uri must not contain a fragment";
+  const host = url.hostname.toLowerCase();
+  if (url.protocol === "http:") {
+    return LOOPBACK_HOSTS.includes(host) ? null : "redirect_uri must use https (http is allowed only for localhost, 127.0.0.1 or [::1])";
+  }
+  if (url.protocol === "https:") {
+    if (url.port && url.port !== "443") return "redirect_uri must use the default https port (443)";
+    return allowedHosts.includes(host) ? null : "redirect_uri host is not allowed (an operator can add it with OAUTH_REDIRECT_HOST_ALLOWLIST)";
+  }
+  return "redirect_uri scheme is not allowed (use https, or http on loopback)";
+}
+function checkRegistrationRedirects(redirectUris, allowedHosts) {
+  if (!Array.isArray(redirectUris) || redirectUris.length === 0) return "redirect_uris is required";
+  if (redirectUris.length > MAX_REGISTRATION_REDIRECTS) {
+    return `redirect_uris may hold at most ${MAX_REGISTRATION_REDIRECTS} entries`;
+  }
+  for (const uri of redirectUris) {
+    const reason = checkRedirectUri(uri, allowedHosts);
+    if (reason) return reason;
+  }
+  return null;
+}
+
+// src/http.ts
 bootstrapHttp();
 initAnalytics();
 initFeatureFlags(getPostHogClient());
@@ -31,10 +350,11 @@ function baseUrl(req) {
 var app = express();
 app.set("trust proxy", 1);
 app.use(express.json());
-var ALLOWED_ORIGINS = process.env.CORS_ORIGINS?.split(",").map((o) => o.trim()).filter(Boolean);
+var ALLOWED_ORIGINS = (process.env.CORS_ORIGINS ?? "https://claude.ai").split(",").map((o) => o.trim()).filter(Boolean);
+var OAUTH_REDIRECT_HOSTS = resolveOAuthRedirectHosts({ explicitAllowlist: process.env.OAUTH_REDIRECT_HOST_ALLOWLIST });
 app.use((_req, res, next) => {
   const origin = _req.headers.origin;
-  if (ALLOWED_ORIGINS && origin && ALLOWED_ORIGINS.includes(origin)) {
+  if (origin && ALLOWED_ORIGINS.includes(origin)) {
     res.setHeader("Access-Control-Allow-Origin", origin);
   }
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
@@ -42,7 +362,7 @@ app.use((_req, res, next) => {
     "Access-Control-Allow-Headers",
     "Content-Type, Authorization, Mcp-Session-Id, Last-Event-Id"
   );
-  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
+  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id, Retry-After");
   if (_req.method === "OPTIONS") {
     res.status(204).end();
     return;
@@ -72,20 +392,34 @@ app.get("/.well-known/oauth-authorization-server", (req, res) => {
     scopes_supported: ["mcp:tools", "mcp:resources"]
   });
 });
+var authLimiter = rateLimit({
+  windowMs: 6e4,
+  max: 20,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: "Too many auth requests. Try again later." }
+});
 var registeredClients = /* @__PURE__ */ new Map();
+var MAX_REGISTERED_CLIENTS = 500;
 app.post(
   "/register",
+  authLimiter,
   express.json(),
   (req, res) => {
-    const { redirect_uris, client_name } = req.body;
-    if (!Array.isArray(redirect_uris) || redirect_uris.length === 0) {
-      res.status(400).json({
-        error: "invalid_client_metadata",
-        error_description: "redirect_uris is required"
+    if (registeredClients.size >= MAX_REGISTERED_CLIENTS) {
+      res.status(503).json({
+        error: "server_error",
+        error_description: "Registration limit reached. Try again later."
       });
       return;
     }
-    const clientId = `pb_client_${randomUUID()}`;
+    const { redirect_uris, client_name } = req.body;
+    const refusal = checkRegistrationRedirects(redirect_uris, OAUTH_REDIRECT_HOSTS);
+    if (refusal) {
+      res.status(400).json({ error: "invalid_redirect_uri", error_description: refusal });
+      return;
+    }
+    const clientId = `pb_client_${randomUUID2()}`;
     const client = {
       client_id: clientId,
       redirect_uris,
@@ -105,8 +439,8 @@ app.post(
 );
 var pendingCodes = /* @__PURE__ */ new Map();
 var ACCESS_TOKEN_TTL = 3600;
-var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
-var refreshTokens = /* @__PURE__ */ new Map();
+var ACCESS_TOKEN_TTL_MS = ACCESS_TOKEN_TTL * 1e3;
+var accessTokens = /* @__PURE__ */ new Map();
 setInterval(() => {
   const now = Date.now();
   for (const [code, auth] of pendingCodes) {
@@ -115,67 +449,705 @@ setInterval(() => {
   for (const [id, client] of registeredClients) {
     if (now - client.registeredAt > 24 * 60 * 6e4) registeredClients.delete(id);
   }
-  for (const [token, entry] of refreshTokens) {
-    if (now - entry.createdAt > REFRESH_TOKEN_TTL_MS) refreshTokens.delete(token);
+  for (const [token, entry] of accessTokens) {
+    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) accessTokens.delete(token);
+  }
+  for (const [ip, rec] of authFailures) {
+    if (rec.blockedUntil < now && rec.firstFailure + AUTH_FAILURE_WINDOW_MS < now) {
+      authFailures.delete(ip);
+    }
+  }
+  if (authFailures.size > MAX_AUTH_FAILURE_ENTRIES) {
+    const sorted = [...authFailures.entries()].sort((a, b) => a[1].firstFailure - b[1].firstFailure);
+    for (let i = 0; i < sorted.length - MAX_AUTH_FAILURE_ENTRIES; i++) {
+      authFailures.delete(sorted[i][0]);
+    }
   }
 }, 6e4);
 function esc(s) {
   return String(s ?? "").replace(
-    /[&"<>]/g,
-    (c) => ({ "&": "&amp;", '"': "&quot;", "<": "&lt;", ">": "&gt;" })[c]
+    /[&"'<>]/g,
+    (c) => ({ "&": "&amp;", '"': "&quot;", "'": "&#39;", "<": "&lt;", ">": "&gt;" })[c]
   );
 }
-app.get("/authorize", (req, res) => {
-  const { redirect_uri, code_challenge, code_challenge_method, state } = req.query;
-  res.type("html").send(`<!DOCTYPE html>
-<html lang="en"><head>
+function authPageShell(title, bodyContent, headExtra = "") {
+  return `<!DOCTYPE html>
+<html lang="en" data-theme="parchment-dark"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Authorize \u2014 Product Brain</title>
+<title>${esc(title)} \u2014 Product Brain</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Source+Serif+4:opsz,wght@8..60,600&family=IBM+Plex+Sans:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500;700&display=swap">
+${headExtra}
 <style>
-*{margin:0;padding:0;box-sizing:border-box}
-body{font-family:-apple-system,system-ui,sans-serif;background:#0a0a0a;color:#e5e5e5;
-  display:flex;align-items:center;justify-content:center;min-height:100vh;padding:1rem}
-.card{background:#1a1a1a;border:1px solid #333;border-radius:12px;padding:2rem;max-width:400px;width:100%}
-h1{font-size:1.2rem;margin-bottom:.25rem}
-.sub{color:#999;font-size:.85rem;margin-bottom:1.5rem}
-label{display:block;font-size:.85rem;margin-bottom:.4rem;color:#ccc}
-input[type=password]{width:100%;padding:.6rem .75rem;background:#111;border:1px solid #444;
-  border-radius:8px;color:#e5e5e5;font:.85rem/1.4 monospace}
-input:focus{outline:none;border-color:#7c3aed}
-button{width:100%;padding:.6rem;background:#7c3aed;color:#fff;border:none;
-  border-radius:8px;font-size:.85rem;cursor:pointer;margin-top:1rem}
-button:hover{background:#6d28d9}
-.err{color:#ef4444;font-size:.8rem;margin-top:.5rem;display:none}
-</style></head><body>
-<div class="card">
-<h1>Product Brain</h1>
-<p class="sub">Enter your API key to connect Claude to your workspace.</p>
-<form method="POST" action="/authorize">
-  <input type="hidden" name="redirect_uri" value="${esc(redirect_uri)}">
-  <input type="hidden" name="code_challenge" value="${esc(code_challenge)}">
-  <input type="hidden" name="code_challenge_method" value="${esc(code_challenge_method)}">
-  <input type="hidden" name="state" value="${esc(state)}">
-  <label for="k">API Key</label>
-  <input type="password" id="k" name="api_key" placeholder="pb_sk_\u2026" required autofocus>
-  <p class="err" id="e">Key must start with pb_sk_</p>
-  <button type="submit">Authorize</button>
-</form>
+:root{
+  --bg:#1a1917;--bg-warm:#201f1c;--surface:#262521;
+  --fg1:#e4e0d8;--fg2:#c4bfb4;--fg3:#9a9589;--fg4:#6a6560;--fg-bright:#ffffff;
+  --border:rgba(255,255,255,0.07);--border-light:rgba(255,255,255,0.04);
+  --accent:#c9b99a;
+  --btn-bg:#ffffff;--btn-fg:#1a1917;--btn-hover:#e4e0d8;
+  --green:#4ade80;--rose:#ef4444;
+  --ghost:rgba(38,37,33,0.55);
+  --radius-md:7px;--radius-lg:10px;
+  --font-display:"Source Serif 4",ui-serif,Georgia,serif;
+  --font-body:"IBM Plex Sans",ui-sans-serif,system-ui,sans-serif;
+  --font-mono:"IBM Plex Mono",ui-monospace,"SF Mono",Menlo,monospace;
+}
+*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
+html,body{height:100%}
+body{
+  font-family:var(--font-body);font-size:13px;line-height:1.45;
+  color:var(--fg1);background:var(--bg);
+  min-height:100vh;display:grid;place-items:center;padding:24px;
+  -webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;
+  position:relative;overflow:hidden;
+}
+body::before{
+  content:"";position:fixed;inset:0;
+  background:radial-gradient(900px 600px at 50% 50%,rgba(228,224,216,0.025),transparent 60%);
+  pointer-events:none;z-index:0;
+}
+.top-mark{position:fixed;top:22px;left:24px;z-index:5;opacity:0.7}
+${appLogoStyles}
+.stage{
+  width:100%;max-width:460px;text-align:center;
+  position:relative;z-index:1;
+  display:grid;
+}
+.panel{
+  grid-area:1/1;
+  transition:opacity 280ms ease-out,transform 380ms cubic-bezier(.2,.6,.2,1),filter 380ms ease-out;
+}
+.panel[hidden]{
+  display:block !important;
+  opacity:0;transform:scale(0.96) translateY(-2px);filter:blur(6px);
+  pointer-events:none;
+}
+.panel:not([hidden]){opacity:1;transform:scale(1);filter:none;pointer-events:auto}
+
+/* eyebrows */
+.eyebrow{
+  font-family:var(--font-mono);font-size:10px;font-weight:700;
+  letter-spacing:0.28em;text-transform:uppercase;color:var(--fg4);
+  margin-bottom:24px;display:inline-flex;align-items:center;gap:7px;
+}
+.eyebrow .dot{width:5px;height:5px;border-radius:50%;background:currentColor}
+.eyebrow.danger{color:var(--rose)}
+.eyebrow.success{color:var(--green)}
+.eyebrow.success .dot{box-shadow:0 0 0 3px rgba(74,222,128,0.18)}
+
+/* form input */
+.input-wrap{
+  display:flex;align-items:center;background:rgba(0,0,0,0.22);
+  border:1px solid var(--border);border-radius:var(--radius-md);
+  transition:border-color 200ms ease-out,box-shadow 200ms ease-out;
+}
+.input-wrap:focus-within{
+  border-color:rgba(228,224,216,0.45);
+  box-shadow:0 0 0 3px rgba(228,224,216,0.10);
+}
+.input-wrap.has-error{
+  border-color:rgba(239,68,68,0.55);
+  box-shadow:0 0 0 3px rgba(239,68,68,0.12);
+  animation:shake 360ms cubic-bezier(.36,.07,.19,.97);
+}
+@keyframes shake{
+  10%,90%{transform:translateX(-1px)}20%,80%{transform:translateX(2px)}
+  30%,50%,70%{transform:translateX(-4px)}40%,60%{transform:translateX(4px)}
+}
+.input{
+  flex:1;min-width:0;background:transparent;border:0;outline:none;
+  padding:16px;
+  font-family:var(--font-mono);font-size:14px;color:var(--fg1);letter-spacing:0.02em;
+}
+.input::placeholder{color:var(--fg4)}
+.hint{
+  margin-top:10px;font-family:var(--font-mono);font-size:10.5px;
+  letter-spacing:0.16em;text-transform:uppercase;
+  text-align:left;padding-left:4px;height:14px;color:var(--fg4);
+  transition:color 160ms ease-out;
+}
+.hint.is-error{color:var(--rose)}
+
+/* primary button */
+.btn-primary{
+  width:100%;height:48px;margin-top:14px;
+  border:0;border-radius:var(--radius-md);
+  background:var(--btn-bg);color:var(--btn-fg);
+  font-family:var(--font-body);font-size:14.5px;font-weight:600;letter-spacing:-0.005em;
+  cursor:pointer;display:inline-flex;align-items:center;justify-content:center;gap:10px;
+  transition:background 140ms ease-out,transform 80ms ease-out,opacity 200ms ease-out;
+  position:relative;overflow:hidden;
+}
+.btn-primary:hover:not([disabled]){background:var(--btn-hover)}
+.btn-primary:active:not([disabled]){transform:translateY(1px)}
+.btn-primary[disabled]{opacity:0.45;cursor:default}
+.spin{
+  width:14px;height:14px;border-radius:50%;
+  border:1.5px solid currentColor;border-top-color:transparent;
+  animation:spin 700ms linear infinite;opacity:0.85;
+}
+@keyframes spin{to{transform:rotate(360deg)}}
+
+/* secondary link */
+.small-link{
+  margin-top:18px;font-family:var(--font-mono);font-size:11px;
+  letter-spacing:0.18em;text-transform:uppercase;color:var(--fg4);
+}
+.small-link a{
+  color:var(--fg3);text-decoration:none;border-bottom:1px dotted currentColor;
+  padding-bottom:1px;transition:color 140ms;
+}
+.small-link a:hover{color:var(--fg1)}
+
+/* orb */
+.orb-wrap{
+  position:relative;width:160px;height:160px;margin:0 auto 36px;
+  display:grid;place-items:center;
+}
+.orb-ring{position:absolute;border-radius:50%}
+.orb-ring.r1{inset:0;border:1px solid rgba(228,224,216,0.06);animation:drift1 40s linear infinite}
+.orb-ring.r2{inset:18px;border:1px dashed rgba(228,224,216,0.10);animation:drift2 28s linear infinite}
+.orb-ring.r3{inset:38px;border:1px solid rgba(74,222,128,0.20);animation:ringPulse 3.4s ease-in-out infinite}
+@keyframes drift1{to{transform:rotate(360deg)}}
+@keyframes drift2{to{transform:rotate(-360deg)}}
+@keyframes ringPulse{0%,100%{opacity:0.6}50%{opacity:1}}
+
+.orb-wrap.is-verifying .orb-ring.r3{
+  border-color:rgba(228,224,216,0.20);
+  animation:ringPulse 1.1s ease-in-out infinite;
+}
+.orb-wrap.is-verifying .orb-core{
+  box-shadow:0 0 0 6px rgba(228,224,216,0.04),0 0 22px rgba(228,224,216,0.10),inset 0 0 16px rgba(228,224,216,0.06);
+  animation:corePulseNeutral 1.6s ease-in-out infinite;
+}
+.orb-wrap.is-verifying .orb-dot{background:var(--fg3);box-shadow:0 0 10px rgba(228,224,216,0.4)}
+@keyframes corePulseNeutral{
+  0%,100%{box-shadow:0 0 0 6px rgba(228,224,216,0.04),0 0 22px rgba(228,224,216,0.10),inset 0 0 16px rgba(228,224,216,0.06)}
+  50%{box-shadow:0 0 0 9px rgba(228,224,216,0.07),0 0 32px rgba(228,224,216,0.18),inset 0 0 22px rgba(228,224,216,0.10)}
+}
+
+.orb-wrap.is-error .orb-ring.r3{border-color:rgba(239,68,68,0.30);animation:none;opacity:1}
+.orb-wrap.is-error .orb-ring.r1,.orb-wrap.is-error .orb-ring.r2{animation-play-state:paused}
+.orb-wrap.is-error .orb-core{
+  box-shadow:0 0 0 6px rgba(239,68,68,0.05),0 0 22px rgba(239,68,68,0.20),inset 0 0 16px rgba(239,68,68,0.08);
+  animation:none;
+}
+.orb-wrap.is-error .orb-dot{background:var(--rose);box-shadow:0 0 10px rgba(239,68,68,0.6)}
+
+.sat-orbit{position:absolute;inset:0;pointer-events:none}
+.sat-orbit.o1{animation:drift1 40s linear infinite}
+.sat-orbit.o2{animation:drift2 56s linear infinite}
+.sat{
+  position:absolute;top:50%;left:50%;
+  font-family:var(--font-mono);font-size:9px;font-weight:700;letter-spacing:0.14em;
+  background:var(--bg);padding:2px 6px;border-radius:3px;
+  border:1px solid var(--border-light);
+  transform-origin:0 0;opacity:0;
+}
+.panel:not([hidden])[data-state="connected"] .sat{animation:satIn 600ms ease-out forwards}
+@keyframes satIn{from{opacity:0}to{opacity:1}}
+.sat span{display:inline-block;animation:counter 40s linear infinite}
+.sat-orbit.o2 .sat span{animation:counter2 56s linear infinite}
+@keyframes counter{to{transform:rotate(-360deg)}}
+@keyframes counter2{to{transform:rotate(360deg)}}
+
+.orb-core{
+  position:relative;width:60px;height:60px;border-radius:50%;
+  background:radial-gradient(circle at 50% 45%,#1a1a1a 0%,#0c0c0c 60%,#050505 100%);
+  border:1px solid rgba(255,255,255,0.06);
+  display:grid;place-items:center;
+  box-shadow:0 0 0 6px rgba(74,222,128,0.04),0 0 28px rgba(74,222,128,0.20),inset 0 0 18px rgba(74,222,128,0.08);
+  animation:corePulse 3.4s ease-in-out infinite;
+}
+@keyframes corePulse{
+  0%,100%{box-shadow:0 0 0 6px rgba(74,222,128,0.04),0 0 24px rgba(74,222,128,0.18),inset 0 0 16px rgba(74,222,128,0.06)}
+  50%{box-shadow:0 0 0 9px rgba(74,222,128,0.06),0 0 40px rgba(74,222,128,0.32),inset 0 0 22px rgba(74,222,128,0.14)}
+}
+.orb-dot{width:10px;height:10px;border-radius:50%;background:#4ade80;box-shadow:0 0 12px rgba(74,222,128,0.7)}
+
+.core-shockwave{
+  position:absolute;inset:0;border-radius:50%;
+  border:1px solid rgba(74,222,128,0.6);
+  opacity:0;pointer-events:none;
+}
+.panel:not([hidden])[data-state="connected"] .core-shockwave{animation:shock 1100ms ease-out 200ms}
+@keyframes shock{
+  0%{opacity:0.7;transform:scale(0.4);border-width:2px}
+  100%{opacity:0;transform:scale(2.4);border-width:1px}
+}
+
+/* titles */
+.ok-title{
+  font-family:var(--font-display);font-weight:600;
+  font-size:38px;line-height:1.05;letter-spacing:-0.025em;
+  color:var(--fg-bright);opacity:0;
+}
+.panel:not([hidden]) .ok-title{animation:rise 600ms ease-out 380ms forwards}
+.ok-lead{
+  margin:18px auto 0;max-width:22em;font-size:16px;line-height:1.55;color:var(--fg2);
+  opacity:0;
+}
+.panel:not([hidden]) .ok-lead{animation:rise 600ms ease-out 500ms forwards}
+.ok-phrase-row{
+  margin-top:14px;display:flex;align-items:center;justify-content:center;
+  opacity:0;
+}
+.panel:not([hidden]) .ok-phrase-row{animation:rise 600ms ease-out 620ms forwards}
+.cmd.is-copied .cmd-quote-part{display:none}
+.success-cta-wrap{
+  margin-top:48px;width:100%;opacity:0;
+}
+.panel:not([hidden]) .success-cta-wrap{animation:rise 600ms ease-out 780ms forwards}
+a.btn-primary.success-cta{color:var(--btn-fg);text-decoration:none}
+
+.cmd{
+  display:inline-flex;align-items:center;gap:8px;vertical-align:middle;
+  font-family:var(--font-mono);font-size:15px;font-weight:500;color:var(--accent);
+  background:rgba(201,185,154,0.08);border:1px solid rgba(201,185,154,0.30);
+  padding:5px 10px 5px 12px;border-radius:6px;letter-spacing:0.02em;
+  cursor:pointer;user-select:none;
+  transition:background 140ms ease-out,border-color 140ms ease-out,color 140ms ease-out;
+}
+.cmd:hover{background:rgba(201,185,154,0.14);border-color:rgba(201,185,154,0.50);color:#dcc9a4}
+.cmd.is-copied{color:var(--green);border-color:rgba(74,222,128,0.35);background:rgba(74,222,128,0.08)}
+.cmd .cmd-icon{
+  width:12px;height:12px;color:currentColor;opacity:0.75;
+  display:inline-grid;place-items:center;
+  transition:opacity 140ms;
+}
+.cmd:hover .cmd-icon{opacity:1}
+.cmd.is-copied .cmd-icon{color:var(--green);opacity:1}
+.cmd .cmd-icon svg{width:12px;height:12px;stroke:currentColor;fill:none;stroke-width:1.5;stroke-linecap:round;stroke-linejoin:round}
+
+/* error specifics */
+.err-title{
+  font-family:var(--font-display);font-weight:600;
+  font-size:32px;line-height:1.1;letter-spacing:-0.02em;
+  color:var(--fg1);margin-bottom:12px;
+}
+.err-msg{
+  font-size:14.5px;line-height:1.55;color:var(--fg3);
+  margin-bottom:28px;
+}
+.err-msg code{
+  font-family:var(--font-mono);font-size:12px;
+  background:rgba(255,255,255,0.06);padding:1px 5px;border-radius:4px;color:var(--fg2);
+}
+.err-actions{display:flex;gap:8px}
+.btn-secondary{
+  flex:1;height:44px;border-radius:var(--radius-md);
+  background:transparent;color:var(--fg2);
+  border:1px solid var(--border);
+  font-family:var(--font-body);font-size:13.5px;font-weight:500;
+  cursor:pointer;text-decoration:none;
+  display:inline-flex;align-items:center;justify-content:center;
+  transition:background 140ms,color 140ms,border-color 140ms;
+}
+.btn-secondary:hover{background:rgba(255,255,255,0.04);color:var(--fg1);border-color:rgba(255,255,255,0.14)}
+
+/* verifying */
+.verifying-eyebrow{
+  font-family:var(--font-mono);font-size:10px;
+  letter-spacing:0.28em;text-transform:uppercase;color:var(--fg3);
+  font-weight:700;margin-bottom:14px;
+}
+.verifying-title{
+  font-family:var(--font-display);font-weight:600;
+  font-size:28px;line-height:1.1;color:var(--fg1);margin-bottom:8px;
+  letter-spacing:-0.02em;
+}
+.verifying-sub{font-size:13px;color:var(--fg3);min-height:1.45em}
+
+/* form heading */
+.form-title{
+  font-family:var(--font-display);font-weight:600;
+  font-size:32px;line-height:1.1;letter-spacing:-0.02em;
+  color:var(--fg1);margin-bottom:10px;
+}
+.form-sub{font-size:13.5px;color:var(--fg3);margin-bottom:28px;line-height:1.55}
+
+@keyframes rise{from{opacity:0;transform:translateY(8px)}to{opacity:1;transform:translateY(0)}}
+
+@media (prefers-reduced-motion: reduce){
+  *,*::before,*::after{
+    animation-duration:0.01ms !important;animation-iteration-count:1 !important;
+    transition-duration:0.01ms !important;
+  }
+}
+</style>
+</head><body>
+<div class="top-mark">${appLogoMarkup({ size: "sm" })}</div>
+<div class="stage">${bodyContent}</div>
+</body></html>`;
+}
+function providerDisplayName(clientName) {
+  const name = (clientName ?? "").trim();
+  if (!name) return "your assistant";
+  return name.length > 40 ? name.slice(0, 40) + "\u2026" : name;
+}
+function successPanelInner(workspaceName, redirectUrl, providerName) {
+  return `
+<div class="orb-wrap">
+  <div class="orb-ring r1"></div>
+  <div class="orb-ring r2"></div>
+  <div class="orb-ring r3"></div>
+  <div class="sat-orbit o1">
+    <span class="sat" style="transform:rotate(20deg) translate(78px) rotate(-20deg);color:#4ade80;animation-delay:600ms"><span>DEC</span></span>
+    <span class="sat" style="transform:rotate(140deg) translate(78px) rotate(-140deg);color:#c9b99a;animation-delay:720ms"><span>WP</span></span>
+    <span class="sat" style="transform:rotate(260deg) translate(78px) rotate(-260deg);color:#f59e0b;animation-delay:840ms"><span>TEN</span></span>
+  </div>
+  <div class="sat-orbit o2">
+    <span class="sat" style="transform:rotate(80deg) translate(54px) rotate(-80deg);color:#60a5fa;animation-delay:960ms"><span>STD</span></span>
+    <span class="sat" style="transform:rotate(220deg) translate(54px) rotate(-220deg);color:#a78bfa;animation-delay:1080ms"><span>INS</span></span>
+  </div>
+  <div class="core-shockwave"></div>
+  <div class="orb-core"><div class="orb-dot"></div></div>
+</div>
+<div class="eyebrow success"><span class="dot"></span>Connected</div>
+<h1 class="ok-title">Product Brain is Live</h1>
+<p class="ok-lead">Return to your assistant, then say</p>
+<div class="ok-phrase-row">
+  <button class="cmd" type="button" data-cmd-pill data-redirect="${esc(redirectUrl)}" aria-label="Copy &quot;Start PB&quot; and return to ${esc(providerName)}">
+    <span class="cmd-quote-part" aria-hidden="true">&ldquo;</span><span data-cmd-text>Start PB</span><span class="cmd-quote-part" aria-hidden="true">&rdquo;</span>
+    <span class="cmd-icon" aria-hidden="true">
+      <svg data-cmd-svg viewBox="0 0 24 24"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M5 15V6a2 2 0 0 1 2-2h9"/></svg>
+    </span>
+  </button>
+</div>
+<div class="success-cta-wrap">
+  <a class="btn-primary success-cta" href="${esc(redirectUrl)}">Continue in ${esc(providerName)}</a>
+</div>
+<!-- workspace name retained as data hook for tests, hidden from view -->
+<span hidden data-field="ws-name">${esc(workspaceName)}</span>`;
+}
+function errorPanelInner(title, trustedDetailHtml, retryUrl) {
+  return `
+<div class="orb-wrap is-error">
+  <div class="orb-ring r1"></div>
+  <div class="orb-ring r2"></div>
+  <div class="orb-ring r3"></div>
+  <div class="orb-core"><div class="orb-dot"></div></div>
+</div>
+<div class="eyebrow danger"><span class="dot"></span>Couldn't connect</div>
+<h2 class="err-title" data-field="err-title">${esc(title)}</h2>
+<p class="err-msg" data-field="err-msg">${trustedDetailHtml}</p>
+<div class="err-actions">
+  <a href="${esc(retryUrl)}" class="btn-secondary" data-retry-link>&larr; Try again</a>
+  <a href="https://productbrain.io" target="_blank" rel="noopener noreferrer" class="btn-secondary">Get an API key &rarr;</a>
+</div>`;
+}
+var cmdScript = `
+(function(){
+  function bindCmd(pill){
+    if(!pill||pill.__bound)return;pill.__bound=true;
+    var textEl=pill.querySelector('[data-cmd-text]');
+    var svgEl=pill.querySelector('[data-cmd-svg]');
+    var redirectUrl=pill.getAttribute('data-redirect')||'';
+    pill.addEventListener('click',function(){
+      var done=function(){
+        pill.classList.add('is-copied');
+        if(textEl)textEl.textContent='Copied';
+        if(svgEl)svgEl.innerHTML='<polyline points="4 12 10 18 20 6"/>';
+        setTimeout(function(){if(redirectUrl)window.location.assign(redirectUrl)},900);
+      };
+      try{
+        if(navigator.clipboard&&navigator.clipboard.writeText){
+          navigator.clipboard.writeText('Start PB').then(done,done);
+        }else{done()}
+      }catch(e){done()}
+    });
+  }
+  document.querySelectorAll('[data-cmd-pill]').forEach(bindCmd);
+})();
+`;
+function authorizeFormPage(params) {
+  const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = params;
+  const providerName = providerDisplayName(params.client_name);
+  const body = `
+<!-- \u2500\u2500\u2500 CONNECT \u2500\u2500\u2500 -->
+<div class="panel" id="p-connect" data-state="connect">
+  <div class="eyebrow">Connect Product Brain</div>
+  <h1 class="form-title">Paste your API key</h1>
+  <p class="form-sub">Give <span data-provider>${esc(providerName)}</span> access to your workspace memory.</p>
+  <form method="POST" action="/authorize" id="f" autocomplete="off">
+    <input type="hidden" name="redirect_uri" value="${esc(redirect_uri)}">
+    <input type="hidden" name="code_challenge" value="${esc(code_challenge)}">
+    <input type="hidden" name="code_challenge_method" value="${esc(code_challenge_method)}">
+    <input type="hidden" name="state" value="${esc(state)}">
+    <input type="hidden" name="client_id" value="${esc(client_id)}">
+    <div class="input-wrap" id="iw">
+      <input type="password" id="k" name="api_key" class="input input-full" placeholder="pb_sk_\u2026" required autofocus spellcheck="false">
+    </div>
+    <div class="hint" id="hint" hidden></div>
+    <button type="submit" class="btn-primary" id="sb" disabled><span id="bt">Connect</span></button>
+  </form>
+  <div class="small-link"><a href="https://productbrain.io" target="_blank" rel="noopener noreferrer">No key? Generate one &rarr;</a></div>
 </div>
-<script>document.querySelector("form").onsubmit=function(e){
-if(!document.getElementById("k").value.startsWith("pb_sk_")){
-e.preventDefault();document.getElementById("e").style.display="block"}}</script>
-</body></html>`);
+
+<!-- \u2500\u2500\u2500 VERIFYING \u2500\u2500\u2500 -->
+<div class="panel" id="p-verifying" data-state="verifying" hidden>
+  <div class="orb-wrap is-verifying">
+    <div class="orb-ring r1"></div>
+    <div class="orb-ring r2"></div>
+    <div class="orb-ring r3"></div>
+    <div class="orb-core"><div class="orb-dot"></div></div>
+  </div>
+  <div class="verifying-eyebrow">Handshake</div>
+  <h2 class="verifying-title">Verifying key\u2026</h2>
+  <p class="verifying-sub" id="verify-sub">Checking workspace \xB7 \u2026</p>
+</div>
+
+<!-- \u2500\u2500\u2500 CONNECTED (filled by JS from JSON response) \u2500\u2500\u2500 -->
+<div class="panel" id="p-connected" data-state="connected" hidden></div>
+
+<!-- \u2500\u2500\u2500 ERROR (filled by JS from JSON response) \u2500\u2500\u2500 -->
+<div class="panel" id="p-error" data-state="error" hidden></div>
+
+<template id="tpl-connected">${successPanelInner("__WS__", "__URL__", "__PROVIDER__")}</template>
+<template id="tpl-error">${errorPanelInner("__TITLE__", "__DETAIL__", "__RETRY__")}</template>
+
+<script>
+${cmdScript}
+(function(){
+  var f=document.getElementById('f'),k=document.getElementById('k'),iw=document.getElementById('iw'),hint=document.getElementById('hint'),sb=document.getElementById('sb'),bt=document.getElementById('bt');
+  var pConnect=document.getElementById('p-connect'),pVerify=document.getElementById('p-verifying'),pOk=document.getElementById('p-connected'),pErr=document.getElementById('p-error');
+  var verifySub=document.getElementById('verify-sub');
+
+  function show(panel){
+    [pConnect,pVerify,pOk,pErr].forEach(function(p){
+      if(p===panel){p.removeAttribute('hidden')}else{p.setAttribute('hidden','')}
+    });
+  }
+
+  function syncInput(){
+    sb.disabled=!k.value.trim();
+    iw.classList.remove('has-error');
+    hint.classList.remove('is-error');
+    hint.textContent='';
+    hint.setAttribute('hidden','');
+  }
+  k.addEventListener('input',syncInput);
+  k.addEventListener('keydown',function(e){
+    if(e.key==='Escape'){k.value='';syncInput()}
+  });
+
+  function showError(title,detailHtml){
+    var tpl=document.getElementById('tpl-error');
+    var html=tpl.innerHTML
+      .replace('__TITLE__',title.replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]}))
+      .replace('__DETAIL__',detailHtml)
+      .replace('__RETRY__','#');
+    pErr.innerHTML=html;
+    var retry=pErr.querySelector('[data-retry-link]');
+    if(retry){retry.addEventListener('click',function(e){e.preventDefault();show(pConnect);k.focus();k.select()})}
+    show(pErr);
+  }
+
+  function showSuccess(workspaceName,redirectUrl,providerName){
+    var tpl=document.getElementById('tpl-connected');
+    var safeWs=String(workspaceName||'').replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]});
+    var safeProv=String(providerName||'your assistant').replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]});
+    var safeUrl=String(redirectUrl||'').replace(/"/g,'&quot;').replace(/[<>]/g,function(c){return{'<':'&lt;','>':'&gt;'}[c]});
+    var html=tpl.innerHTML.split('__WS__').join(safeWs).split('__URL__').join(safeUrl).split('__PROVIDER__').join(safeProv);
+    pOk.innerHTML=html;
+    pOk.querySelectorAll('[data-cmd-pill]').forEach(function(pill){
+      pill.__bound=false;
+    });
+    // Re-run binder
+    var s=document.createElement('script');s.textContent=${JSON.stringify(cmdScript)};document.body.appendChild(s);s.remove();
+    show(pOk);
+  }
+
+  f.addEventListener('submit',function(e){
+    e.preventDefault();
+    var v=k.value.trim();
+    if(!v){iw.classList.add('has-error');hint.classList.add('is-error');hint.textContent='Paste your key first';hint.removeAttribute('hidden');return}
+    if(v.indexOf('pb_sk_')!==0){iw.classList.add('has-error');hint.classList.add('is-error');hint.textContent='Key must start with pb_sk_';hint.removeAttribute('hidden');return}
+    sb.disabled=true;bt.textContent='Verifying';
+    show(pVerify);
+
+    var steps=['Checking workspace \xB7 \u2026','Loading chain \xB7 \u2026','Establishing memory \xB7 \u2026'];
+    var i=0;verifySub.textContent=steps[0];
+    var ti=setInterval(function(){i++;if(i>=steps.length){clearInterval(ti);return}verifySub.textContent=steps[i]},900);
+
+    var minDelay=new Promise(function(r){setTimeout(r,2800)});
+    var fd=new FormData(f);
+    var body=new URLSearchParams();
+    fd.forEach(function(val,key){body.append(key,String(val))});
+
+    var req=fetch('/authorize',{
+      method:'POST',
+      headers:{'Accept':'application/json','Content-Type':'application/x-www-form-urlencoded'},
+      body:body.toString(),
+      credentials:'same-origin'
+    }).then(function(r){return r.json().then(function(j){return{status:r.status,body:j}})});
+
+    Promise.all([req,minDelay]).then(function(arr){
+      clearInterval(ti);
+      var res=arr[0];
+      if(res.body&&res.body.ok){
+        showSuccess(res.body.workspaceName,res.body.redirectUrl,res.body.providerName);
+      }else{
+        showError(res.body&&res.body.title||'Couldn\\'t connect',res.body&&res.body.detail||'Try again, or generate a new key.');
+        sb.disabled=false;bt.textContent='Connect';
+      }
+    }).catch(function(){
+      clearInterval(ti);
+      showError('Network error','We couldn\\'t reach Product Brain. Check your connection and try again.');
+      sb.disabled=false;bt.textContent='Connect';
+    });
+  });
+
+  k.focus();
+})();
+</script>`;
+  return authPageShell("Connect Product Brain", body);
+}
+function authorizeSuccessPage(workspaceName, redirectUrl, providerName) {
+  const body = `
+<div class="panel" data-state="connected">
+${successPanelInner(workspaceName, redirectUrl, providerName)}
+</div>
+<script>${cmdScript}</script>`;
+  return authPageShell("Connected", body);
+}
+function authorizeErrorPage(title, trustedDetailHtml, retryUrl) {
+  const body = `
+<div class="panel" data-state="error">
+${errorPanelInner(title, trustedDetailHtml, retryUrl)}
+</div>`;
+  return authPageShell("Connection error", body);
+}
+app.get("/authorize", authLimiter, (req, res) => {
+  const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.query;
+  const refusal = checkRedirectUri(redirect_uri, OAUTH_REDIRECT_HOSTS);
+  if (refusal) {
+    res.status(400).json({ error: "invalid_request", error_description: refusal });
+    return;
+  }
+  const cid = String(client_id ?? "");
+  const clientName = cid && registeredClients.has(cid) ? registeredClients.get(cid).client_name : void 0;
+  res.type("html").send(authorizeFormPage({
+    redirect_uri: String(redirect_uri ?? ""),
+    code_challenge: String(code_challenge ?? ""),
+    code_challenge_method: String(code_challenge_method ?? "S256"),
+    state: String(state ?? ""),
+    client_id: cid,
+    client_name: clientName
+  }));
 });
 app.post(
   "/authorize",
+  authLimiter,
   express.urlencoded({ extended: false }),
-  (req, res) => {
-    const { api_key, redirect_uri, code_challenge, state } = req.body;
+  async (req, res) => {
+    const { api_key, redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.body;
+    const wantsJson = String(req.headers["accept"] ?? "").includes("application/json");
+    const retryParams = new URLSearchParams({
+      redirect_uri: redirect_uri ?? "",
+      code_challenge: code_challenge ?? "",
+      code_challenge_method: code_challenge_method ?? "S256",
+      ...state ? { state } : {},
+      ...client_id ? { client_id } : {}
+    }).toString();
+    const retryUrl = `/authorize?${retryParams}`;
+    function sendError(title, trustedDetailHtml, status = 400) {
+      if (wantsJson) {
+        res.status(status).json({ ok: false, title, detail: trustedDetailHtml });
+      } else {
+        res.status(status).type("html").send(authorizeErrorPage(title, trustedDetailHtml, retryUrl));
+      }
+    }
     if (!api_key?.startsWith("pb_sk_")) {
-      res.status(400).send("Invalid API key");
+      sendError(
+        "Invalid key format",
+        "API keys start with <code>pb_sk_</code>. Check your key and try again."
+      );
+      return;
+    }
+    if (!client_id) {
+      res.status(400).json({ error: "invalid_request", error_description: "client_id is required" });
+      return;
+    }
+    const redirectRefusal = checkRedirectUri(redirect_uri, OAUTH_REDIRECT_HOSTS);
+    if (redirectRefusal) {
+      res.status(400).json({ error: "invalid_request", error_description: redirectRefusal });
+      return;
+    }
+    if (!registeredClients.has(client_id)) {
+      if (registeredClients.size >= MAX_REGISTERED_CLIENTS) {
+        res.status(503).json({ error: "server_error", error_description: "Registration limit reached. Try again later." });
+        return;
+      }
+      registeredClients.set(client_id, { client_id, redirect_uris: [redirect_uri], registeredAt: Date.now() });
+      process.stderr.write(`[authorize] auto-re-registered stale client_id after restart
+`);
+    }
+    const client = registeredClients.get(client_id);
+    if (!client.redirect_uris.includes(redirect_uri)) {
+      res.status(400).json({
+        error: "invalid_request",
+        error_description: "redirect_uri does not match any registered redirect for this client"
+      });
       return;
     }
-    const code = randomUUID();
+    let workspaceName = "Your Workspace";
+    try {
+      const primaryUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_CLOUD_URL).replace(/\/$/, "");
+      const fallbackUrls = (process.env.CONVEX_FALLBACK_URLS ?? "").split(",").map((u) => u.trim().replace(/\/$/, "")).filter(Boolean);
+      const candidates = [primaryUrl, ...fallbackUrls];
+      let foundUrl;
+      let anyDefinitiveReject = false;
+      let rateLimitedRetryAfter;
+      for (const url2 of candidates) {
+        let checkData = null;
+        try {
+          const checkRes = await fetch(`${url2}/api/key-check`, {
+            method: "POST",
+            headers: { "Authorization": `Bearer ${api_key}`, "Content-Type": "application/json" },
+            signal: AbortSignal.timeout(5e3)
+          });
+          checkData = await checkRes.json();
+        } catch {
+          continue;
+        }
+        if (checkData.ok) {
+          if (checkData.workspaceName) workspaceName = checkData.workspaceName;
+          foundUrl = checkData.deploymentUrl ?? url2;
+          break;
+        }
+        if (checkData.error === "rate_limited") {
+          rateLimitedRetryAfter = checkData.retryAfterSeconds;
+          continue;
+        }
+        anyDefinitiveReject = true;
+      }
+      if (!foundUrl) {
+        if (rateLimitedRetryAfter != null && !anyDefinitiveReject) {
+          sendError(
+            "Rate limited",
+            `This API key is valid but temporarily rate limited. Try again in ${rateLimitedRetryAfter}s.`,
+            429
+          );
+          return;
+        }
+        if (anyDefinitiveReject) {
+          sendError(
+            "Key not recognized",
+            "This API key wasn't found in Product Brain. Check your API Keys in Cortex and try again.",
+            401
+          );
+          return;
+        }
+        process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
+      } else {
+        getKeyState(api_key).deploymentUrl = foundUrl;
+      }
+    } catch {
+      process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
+    }
+    const code = randomUUID2();
     pendingCodes.set(code, {
       apiKey: api_key,
       codeChallenge: code_challenge,
@@ -185,39 +1157,42 @@ app.post(
     const url = new URL(redirect_uri);
     url.searchParams.set("code", code);
     if (state) url.searchParams.set("state", state);
-    res.redirect(302, url.toString());
+    const redirectUrl = url.toString();
+    const providerName = providerDisplayName(client.client_name);
+    if (wantsJson) {
+      res.json({ ok: true, workspaceName, redirectUrl, providerName });
+    } else {
+      res.type("html").send(authorizeSuccessPage(workspaceName, redirectUrl, providerName));
+    }
   }
 );
 function issueTokens(apiKey) {
-  const refreshToken = `pb_rt_${randomUUID()}`;
-  refreshTokens.set(refreshToken, { apiKey, createdAt: Date.now() });
   return {
     access_token: apiKey,
     token_type: "Bearer",
-    expires_in: ACCESS_TOKEN_TTL,
-    refresh_token: refreshToken
+    // 1-year TTL: actual validity enforced by Convex, not by expiry clock.
+    // Long TTL prevents unnecessary refresh cycles after restarts.
+    expires_in: 365 * 24 * 3600,
+    refresh_token: signRefreshToken(apiKey)
   };
 }
 app.post(
   "/oauth/token",
+  authLimiter,
   express.urlencoded({ extended: false }),
   express.json(),
   (req, res) => {
     const { grant_type, code, code_verifier, redirect_uri, refresh_token } = req.body;
     if (grant_type === "refresh_token") {
-      const entry = refreshTokens.get(refresh_token);
-      if (!entry) {
-        res.status(400).json({ error: "invalid_grant", error_description: "Invalid refresh token" });
-        return;
-      }
-      if (Date.now() - entry.createdAt > REFRESH_TOKEN_TTL_MS) {
-        refreshTokens.delete(refresh_token);
-        res.status(400).json({ error: "invalid_grant", error_description: "Refresh token expired" });
+      const verified = verifyRefreshToken(refresh_token);
+      if (!verified) {
+        res.status(400).json({
+          error: "invalid_grant",
+          error_description: "Invalid or expired refresh token"
+        });
         return;
       }
-      const apiKey = entry.apiKey;
-      refreshTokens.delete(refresh_token);
-      res.json(issueTokens(apiKey));
+      res.json(issueTokens(verified.apiKey));
       return;
     }
     if (grant_type !== "authorization_code") {
@@ -247,43 +1222,63 @@ var mcpLimiter = rateLimit({
   max: 120,
   standardHeaders: true,
   legacyHeaders: false,
-  message: { error: "Too many requests. Try again later." }
+  handler: (req, res) => {
+    const r = req.rateLimit;
+    const reset = r?.resetTime?.getTime?.() ?? Date.now() + 6e4;
+    send429(res, buildRateLimitError({
+      retryAfterSeconds: Math.max(1, Math.ceil((reset - Date.now()) / 1e3)),
+      limit: r?.limit ?? 120,
+      current: r?.used ?? 0,
+      id: req.body?.id ?? null
+      // mirror the JSON-RPC id when a POST body is present
+    }));
+  }
 });
+var authFailures = /* @__PURE__ */ new Map();
 app.get("/health", (_req, res) => {
   res.json({ status: "ok", version: SERVER_VERSION, transport: "http" });
 });
 var sessions = /* @__PURE__ */ new Map();
 var SESSION_TTL_MS = 30 * 60 * 1e3;
 var MAX_SESSIONS = 200;
+var EVICT_GRACE_MS = 6e4;
+var MAX_SESSIONS_PER_KEY = Math.max(
+  1,
+  Math.min(MAX_SESSIONS - 1, Number(process.env.MCP_MAX_SESSIONS_PER_KEY) || 25)
+);
 function evictStaleSessions() {
   const now = Date.now();
   for (const [id, entry] of sessions) {
     if (now - entry.lastAccess > SESSION_TTL_MS) {
-      logSessionLifecycle("session_deleted", id, "ttl");
+      logSessionLifecycle(
+        "session_deleted",
+        id,
+        entry.inFlight > 0 ? "inflight_leak" : "ttl"
+      );
       entry.transport.close().catch(() => {
       });
       sessions.delete(id);
     }
   }
   if (sessions.size > MAX_SESSIONS) {
-    const sorted = [...sessions.entries()].sort(
-      (a, b) => a[1].lastAccess - b[1].lastAccess
-    );
-    for (let i = 0; i < sorted.length - MAX_SESSIONS; i++) {
+    const sorted = [...sessions.entries()].filter(([, e]) => e.inFlight === 0).sort((a, b) => a[1].lastAccess - b[1].lastAccess);
+    const overflow = sessions.size - MAX_SESSIONS;
+    for (let i = 0; i < Math.min(overflow, sorted.length); i++) {
       logSessionLifecycle("session_deleted", sorted[i][0], "eviction");
       sorted[i][1].transport.close().catch(() => {
       });
       sessions.delete(sorted[i][0]);
     }
+    if (sessions.size > MAX_SESSIONS) {
+      const ts = (/* @__PURE__ */ new Date()).toISOString();
+      process.stderr.write(
+        `[HTTP] ${ts} session_cap_breach size=${sessions.size} max=${MAX_SESSIONS} reason=all_inflight (no idle sessions to evict; TTL backstop will reclaim)
+`
+      );
+    }
   }
 }
 setInterval(evictStaleSessions, 6e4);
-function extractBearerKey(req) {
-  const header = req.headers?.authorization;
-  if (typeof header !== "string" || !header.startsWith("Bearer ")) return null;
-  const token = header.slice(7).trim();
-  return token.startsWith("pb_sk_") ? token : null;
-}
 function send401(req, res) {
   const base = baseUrl(req);
   res.status(401).set(
@@ -305,40 +1300,121 @@ function logSessionLifecycle(event, sessionId, reason) {
 `);
 }
 app.post("/mcp", mcpLimiter, async (req, res) => {
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const reqIp = req.ip ?? "unknown";
+  const nowTs = Date.now();
+  if (checkAuthBlock(authFailures, reqIp, nowTs)) {
+    const rec = authFailures.get(reqIp);
+    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - nowTs) / 1e3)) : 0;
+    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
+    return;
+  }
+  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  if (auth.status !== "ok") {
     logRequest("POST", "auth_fail");
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   const reqStart = Date.now();
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       if (sessionId && sessions.has(sessionId)) {
         const entry = sessions.get(sessionId);
-        entry.lastAccess = Date.now();
-        await entry.transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", sessionId, Date.now() - reqStart);
+        if (entry.keyHash !== hashKey(apiKey)) {
+          res.status(403).json({
+            jsonrpc: "2.0",
+            error: { code: -32e3, message: "Session key mismatch" },
+            id: null
+          });
+          return;
+        }
+        try {
+          entry.inFlight++;
+          entry.lastAccess = Date.now();
+          await entry.transport.handleRequest(req, res, req.body);
+          logRequest("POST", "ok", sessionId, Date.now() - reqStart);
+        } finally {
+          entry.inFlight--;
+          entry.lastAccess = Date.now();
+        }
       } else if (!sessionId && isInitializeRequest(req.body)) {
+        const keyH = hashKey(apiKey);
+        const plan = planKeyAdmission(
+          sessions,
+          keyH,
+          MAX_SESSIONS_PER_KEY,
+          Date.now(),
+          { ttlMs: SESSION_TTL_MS, graceMs: EVICT_GRACE_MS }
+        );
+        for (const sid2 of plan.evict) {
+          const victim = sessions.get(sid2);
+          sessions.delete(sid2);
+          victim?.transport.close().catch(() => {
+          });
+          logSessionLifecycle("session_deleted", sid2, "lru_evict");
+        }
+        if (!plan.admit) {
+          send429(res, buildSessionCapError({
+            retryAfterSeconds: plan.retryAfterSeconds,
+            limit: MAX_SESSIONS_PER_KEY,
+            current: countKeySessions(sessions, keyH),
+            poll: plan.retryIsPoll,
+            id: req.body?.id ?? null
+          }));
+          return;
+        }
+        const sid = randomUUID2();
+        let initialized = false;
         const transport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID(),
-          onsessioninitialized: (sid) => {
-            sessions.set(sid, { transport, lastAccess: Date.now() });
-            logSessionLifecycle("session_created", sid);
+          sessionIdGenerator: () => sid,
+          onsessioninitialized: (s) => {
+            initialized = true;
+            logSessionLifecycle("session_created", s);
           }
+          // log only — no map write
         });
+        const reserved = { transport, lastAccess: Date.now(), keyHash: keyH, inFlight: 1 };
+        sessions.set(sid, reserved);
         transport.onclose = () => {
-          const sid = transport.sessionId;
-          if (sid) {
-            logSessionLifecycle("session_deleted", sid, "onclose");
-            sessions.delete(sid);
+          const s = transport.sessionId ?? sid;
+          if (sessions.has(s)) {
+            sessions.delete(s);
+            logSessionLifecycle("session_deleted", s, "onclose");
           }
         };
-        const server = createProductBrainServer();
-        await server.connect(transport);
-        await transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+        try {
+          const server = createProductBrainServer();
+          await server.connect(transport);
+          await transport.handleRequest(req, res, req.body);
+          logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+        } catch (e) {
+          transport.onclose = void 0;
+          sessions.delete(sid);
+          throw e;
+        } finally {
+          if (!initialized) {
+            transport.onclose = void 0;
+            if (sessions.delete(sid)) logSessionLifecycle("session_deleted", sid, "init_rejected");
+          } else {
+            const e = sessions.get(sid);
+            if (e) {
+              e.inFlight--;
+              e.lastAccess = Date.now();
+            }
+          }
+        }
+      } else if (sessionId) {
+        process.stderr.write(
+          `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale sessionId=${sessionId} (likely server restart \u2014 instructing client to re-initialise)
+`
+        );
+        res.status(404).json({
+          jsonrpc: "2.0",
+          error: { code: -32001, message: "Session not found \u2014 re-initialise" },
+          id: null
+        });
       } else {
         process.stderr.write(
           `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_invalid no valid session ID (client may have omitted Mcp-Session-Id)
@@ -363,20 +1439,46 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
   }
 });
 app.get("/mcp", mcpLimiter, async (req, res) => {
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const reqIp = req.ip ?? "unknown";
+  const nowTs = Date.now();
+  if (checkAuthBlock(authFailures, reqIp, nowTs)) {
+    const rec = authFailures.get(reqIp);
+    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - nowTs) / 1e3)) : 0;
+    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
+    return;
+  }
+  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  if (auth.status !== "ok") {
     logRequest("GET", "auth_fail");
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
-  if (!sessionId || !sessions.has(sessionId)) {
-    res.status(400).send("Invalid or missing session ID");
+  if (!sessionId) {
+    res.status(400).send("Missing Mcp-Session-Id header");
+    return;
+  }
+  if (!sessions.has(sessionId)) {
+    process.stderr.write(
+      `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale GET sessionId=${sessionId}
+`
+    );
+    res.status(404).send("Session not found \u2014 re-initialise");
     return;
   }
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       const entry = sessions.get(sessionId);
+      if (entry.keyHash !== hashKey(apiKey)) {
+        res.status(403).json({
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Session key mismatch" },
+          id: null
+        });
+        return;
+      }
       entry.lastAccess = Date.now();
       await entry.transport.handleRequest(req, res);
       logRequest("GET", "ok", sessionId);
@@ -386,20 +1488,46 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
   }
 });
 app.delete("/mcp", mcpLimiter, async (req, res) => {
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const reqIp = req.ip ?? "unknown";
+  const nowTs = Date.now();
+  if (checkAuthBlock(authFailures, reqIp, nowTs)) {
+    const rec = authFailures.get(reqIp);
+    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - nowTs) / 1e3)) : 0;
+    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
+    return;
+  }
+  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  if (auth.status !== "ok") {
     logRequest("DELETE", "auth_fail");
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
-  if (!sessionId || !sessions.has(sessionId)) {
-    res.status(400).send("Invalid or missing session ID");
+  if (!sessionId) {
+    res.status(400).send("Missing Mcp-Session-Id header");
+    return;
+  }
+  if (!sessions.has(sessionId)) {
+    process.stderr.write(
+      `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale DELETE sessionId=${sessionId}
+`
+    );
+    res.status(404).send("Session not found \u2014 re-initialise");
     return;
   }
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       const entry = sessions.get(sessionId);
+      if (entry.keyHash !== hashKey(apiKey)) {
+        res.status(403).json({
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Session key mismatch" },
+          id: null
+        });
+        return;
+      }
       await entry.transport.handleRequest(req, res);
       logRequest("DELETE", "ok", sessionId);
     });
@@ -431,8 +1559,11 @@ async function gracefulShutdown() {
   }
   process.exit(0);
 }
-var httpServer = app.listen(PORT, "127.0.0.1", () => {
-  console.log(`Product Brain MCP HTTP server v${SERVER_VERSION} listening on port ${PORT}`);
+var LISTEN_HOST = "0.0.0.0";
+var httpServer = app.listen(PORT, LISTEN_HOST, () => {
+  console.log(
+    `Product Brain MCP HTTP server v${SERVER_VERSION} listening on ${LISTEN_HOST}:${PORT}`
+  );
 });
 httpServer.on("error", (err) => {
   console.error(`[MCP HTTP] Server error: ${err.message}`);