@productbrain/mcp 0.0.1-beta.9452 → 0.0.1-beta.9469

package/dist/cli/index.js

@@ -3,7 +3,7 @@
 // src/cli/index.ts
 var subcommand = process.argv[2];
 if (subcommand === "setup") {
-  const { runSetup } = await import("../setup-6UYW6XKO.js");
+  const { runSetup } = await import("../setup-YETABTTN.js");
   await runSetup();
 } else {
   await import("../index.js");

package/dist/http.js

@@ -2,19 +2,21 @@ import {
   SERVER_VERSION,
   createProductBrainServer,
   initFeatureFlags
-} from "./chunk-NCTCZQHK.js";
+} from "./chunk-BCQ7KBLE.js";
 import {
   DEFAULT_CLOUD_URL,
   apiKeysUrl,
   bootstrapHttp,
+  checkKeyAgainstCandidates,
   forgetStreamLifecycle,
   getKeyState,
   getPostHogClient,
   hashKey,
   initAnalytics,
+  parseFallbackUrls,
   runWithAuth,
   shutdownAnalytics
-} from "./chunk-Q77SFDBZ.js";
+} from "./chunk-FVH3B7MF.js";
 
 // src/http.ts
 import { createHash, randomUUID } from "crypto";
@@ -206,6 +208,14 @@ function recordAuthFailure(failures, ip, now) {
     }
   }
 }
+function initializeKeyGate(verdict, failures, ip, now) {
+  if (verdict === "ok" || verdict === "rate_limited") return "admit";
+  if (verdict === "rejected") {
+    recordAuthFailure(failures, ip, now);
+    return "unauthorized";
+  }
+  return "unavailable";
+}
 
 // src/lib/oauthRedirectAllowlist.ts
 var DEFAULT_OAUTH_REDIRECT_URIS = [
@@ -309,6 +319,10 @@ bootstrapHttp();
 initAnalytics();
 initFeatureFlags(getPostHogClient());
 var PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? "3002", 10);
+function keyCheckCandidates() {
+  const primaryUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_CLOUD_URL).replace(/\/$/, "");
+  return [primaryUrl, ...parseFallbackUrls(process.env.CONVEX_FALLBACK_URLS).map((u) => u.replace(/\/$/, ""))];
+}
 function baseUrl(req) {
   const proto = req.headers["x-forwarded-proto"] ?? req.protocol ?? "http";
   const host = req.headers.host ?? `localhost:${PORT}`;
@@ -1055,58 +1069,25 @@ app.post(
       return;
     }
     let workspaceName = "Your Workspace";
-    try {
-      const primaryUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_CLOUD_URL).replace(/\/$/, "");
-      const fallbackUrls = (process.env.CONVEX_FALLBACK_URLS ?? "").split(",").map((u) => u.trim().replace(/\/$/, "")).filter(Boolean);
-      const candidates = [primaryUrl, ...fallbackUrls];
-      let foundUrl;
-      let anyDefinitiveReject = false;
-      let rateLimitedRetryAfter;
-      for (const url2 of candidates) {
-        let checkData = null;
-        try {
-          const checkRes = await fetch(`${url2}/api/key-check`, {
-            method: "POST",
-            headers: { "Authorization": `Bearer ${api_key}`, "Content-Type": "application/json" },
-            signal: AbortSignal.timeout(5e3)
-          });
-          checkData = await checkRes.json();
-        } catch {
-          continue;
-        }
-        if (checkData.ok) {
-          if (checkData.workspaceName) workspaceName = checkData.workspaceName;
-          foundUrl = checkData.deploymentUrl ?? url2;
-          break;
-        }
-        if (checkData.error === "rate_limited") {
-          rateLimitedRetryAfter = checkData.retryAfterSeconds;
-          continue;
-        }
-        anyDefinitiveReject = true;
-      }
-      if (!foundUrl) {
-        if (rateLimitedRetryAfter != null && !anyDefinitiveReject) {
-          sendError(
-            "Rate limited",
-            `This API key is valid but temporarily rate limited. Try again in ${rateLimitedRetryAfter}s.`,
-            429
-          );
-          return;
-        }
-        if (anyDefinitiveReject) {
-          sendError(
-            "Key not recognized",
-            "This API key wasn't found in Product Brain. Check your API Keys in Cortex and try again.",
-            401
-          );
-          return;
-        }
-        process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
-      } else {
-        getKeyState(api_key).deploymentUrl = foundUrl;
-      }
-    } catch {
+    const check = await checkKeyAgainstCandidates(keyCheckCandidates(), api_key, 5e3);
+    if (check.verdict === "ok") {
+      if (check.workspaceName) workspaceName = check.workspaceName;
+      getKeyState(api_key).deploymentUrl = check.deploymentUrl;
+    } else if (check.verdict === "rate_limited") {
+      sendError(
+        "Rate limited",
+        `This API key is valid but temporarily rate limited. Try again in ${check.retryAfterSeconds ?? 60}s.`,
+        429
+      );
+      return;
+    } else if (check.verdict === "rejected") {
+      sendError(
+        "Key not recognized",
+        "This API key wasn't found in Product Brain. Check your API Keys in Cortex and try again.",
+        401
+      );
+      return;
+    } else {
       process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
     }
     const code = randomUUID();
@@ -1286,6 +1267,22 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
           entry.lastAccess = Date.now();
         }
       } else if (!sessionId && isInitializeRequest(req.body)) {
+        const check = await checkKeyAgainstCandidates(keyCheckCandidates(), apiKey, 5e3);
+        const gate = initializeKeyGate(check.verdict, authFailures, reqIp, Date.now());
+        if (gate === "unauthorized") {
+          logRequest("POST", "auth_fail");
+          send401(req, res);
+          return;
+        }
+        if (gate === "unavailable") {
+          res.status(503).json({
+            jsonrpc: "2.0",
+            error: { code: -32e3, message: "Product Brain could not verify this API key right now. Retry shortly." },
+            id: req.body?.id ?? null
+          });
+          return;
+        }
+        if (check.verdict === "ok" || check.verdict === "rate_limited") getKeyState(apiKey).deploymentUrl = check.deploymentUrl;
         const keyH = hashKey(apiKey);
         const plan = planKeyAdmission(
           sessions,