@productbrain/mcp 0.0.1-beta.973 → 0.0.1-beta.9754

package/dist/http.js

@@ -1,21 +1,25 @@
 import {
-  DEFAULT_CLOUD_URL,
   SERVER_VERSION,
-  bootstrapHttp,
   createProductBrainServer,
-  getKeyState,
-  hashKey,
-  initFeatureFlags,
-  runWithAuth
-} from "./chunk-JJJO3SDX.js";
+  initFeatureFlags
+} from "./chunk-ETBTCCMU.js";
 import {
+  DEFAULT_CLOUD_URL,
+  apiKeysUrl,
+  bootstrapHttp,
+  checkKeyAgainstCandidates,
+  forgetStreamLifecycle,
+  getKeyState,
   getPostHogClient,
+  hashKey,
   initAnalytics,
+  parseFallbackUrls,
+  runWithAuth,
   shutdownAnalytics
-} from "./chunk-YMF3IQ5E.js";
+} from "./chunk-ZKRYGHNU.js";
 
 // src/http.ts
-import { createHash, randomUUID as randomUUID2 } from "crypto";
+import { createHash, randomUUID } from "crypto";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
@@ -54,61 +58,288 @@ function appLogoMarkup(opts = {}) {
   return `<span class="${cls}"><span class="pb-logo__mark"><span class="pb-logo__core"></span></span>${wordmark}</span>`;
 }
 
-// src/lib/refresh-token.ts
-import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
-var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
-var PREFIX = "pb_rt_";
-var secret = (() => {
-  const fromEnv = process.env.MCP_REFRESH_SECRET;
-  if (fromEnv && fromEnv.length > 0) return Buffer.from(fromEnv, "utf8");
-  if (process.env.NODE_ENV === "production") {
-    console.warn(
-      "[HTTP] WARNING MCP_REFRESH_SECRET not set \u2014 refresh tokens will not survive restart"
-    );
+// src/sessionCap.ts
+function planKeyAdmission(sessions2, keyHash, cap, now, opts) {
+  if (cap < 1) {
+    throw new RangeError(`cap must be >= 1, got ${cap}`);
   }
-  return randomBytes(32);
-})();
-function sign(payloadB64) {
-  return createHmac("sha256", secret).update(payloadB64).digest();
-}
-function signRefreshToken(apiKey) {
-  const payload = {
-    k: apiKey,
-    i: Date.now(),
-    j: randomUUID()
+  const { ttlMs, graceMs } = opts;
+  const isProtected = (s) => s.inFlight > 0 || now - s.lastAccess < graceMs;
+  const keyEntries = [];
+  for (const [id, session] of sessions2) {
+    if (session.keyHash === keyHash) {
+      keyEntries.push([id, session]);
+    }
+  }
+  const evictSet = /* @__PURE__ */ new Set();
+  for (const [id, session] of keyEntries) {
+    if (!isProtected(session) && now - session.lastAccess >= ttlMs) {
+      evictSet.add(id);
+    }
+  }
+  let survivors = keyEntries.filter(([id]) => !evictSet.has(id));
+  if (survivors.length >= cap) {
+    const idleSurvivors = survivors.filter(([, s]) => !isProtected(s)).sort(([, a], [, b]) => a.lastAccess - b.lastAccess);
+    for (const [id] of idleSurvivors) {
+      if (survivors.length < cap) break;
+      evictSet.add(id);
+      survivors = survivors.filter(([sid]) => sid !== id);
+    }
+  }
+  const evict = Array.from(evictSet);
+  const admit = survivors.length < cap;
+  let retryAfterSeconds = 0;
+  let retryIsPoll = false;
+  if (!admit) {
+    const graceBlockers = survivors.filter(([, s]) => s.inFlight === 0);
+    if (graceBlockers.length > 0) {
+      const minLastAccess = Math.min(...graceBlockers.map(([, s]) => s.lastAccess));
+      const msRemaining = graceMs - (now - minLastAccess);
+      retryAfterSeconds = Math.max(1, Math.ceil(msRemaining / 1e3));
+    } else {
+      retryAfterSeconds = 5;
+      retryIsPoll = true;
+    }
+  }
+  return { evict, admit, retryAfterSeconds, retryIsPoll };
+}
+function countKeySessions(sessions2, keyHash) {
+  let count = 0;
+  for (const session of sessions2.values()) {
+    if (session.keyHash === keyHash) count++;
+  }
+  return count;
+}
+
+// src/httpErrors.ts
+function clampSeconds(s) {
+  return Math.max(0, Math.round(s));
+}
+function build(reason, message, p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return {
+    status: 429,
+    headers: { "Retry-After": String(seconds) },
+    body: {
+      jsonrpc: "2.0",
+      id: p.id ?? null,
+      error: {
+        code: -32e3,
+        message,
+        data: {
+          reason,
+          retryAfterSeconds: seconds,
+          limit: p.limit,
+          current: p.current
+        }
+      }
+    }
   };
-  const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-  const sigB64 = sign(payloadB64).toString("base64url");
-  return `${PREFIX}${payloadB64}.${sigB64}`;
-}
-function verifyRefreshToken(token) {
-  if (typeof token !== "string" || !token.startsWith(PREFIX)) return null;
-  const body = token.slice(PREFIX.length);
-  const dot = body.indexOf(".");
-  if (dot <= 0 || dot === body.length - 1) return null;
-  const payloadB64 = body.slice(0, dot);
-  const sigB64 = body.slice(dot + 1);
-  let providedSig;
+}
+function buildRateLimitError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return build(
+    "rate_limited",
+    `Too many requests \u2014 retry after ${seconds} s.`,
+    p
+  );
+}
+function buildAuthLockoutError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return build(
+    "auth_lockout",
+    `Too many failed auth attempts \u2014 locked out, retry after ${seconds} s.`,
+    p
+  );
+}
+function buildSessionCapError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  const message = p.poll ? "Server busy \u2014 all sessions active; retry shortly." : `Too many active sessions for this key \u2014 retry after ${seconds} s.`;
+  return build("session_cap", message, p);
+}
+function send429(res, built) {
+  if (res.headersSent) return;
+  for (const [k, v] of Object.entries(built.headers)) {
+    res.setHeader(k, v);
+  }
+  res.status(built.status).json(built.body);
+}
+
+// src/authLockout.ts
+var AUTH_FAILURE_MAX = 10;
+var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
+var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
+var MAX_AUTH_FAILURE_ENTRIES = 1e4;
+function resolveBearerAuth(authorizationHeader) {
+  if (typeof authorizationHeader !== "string" || authorizationHeader.trim() === "") {
+    return { status: "absent" };
+  }
+  if (!authorizationHeader.startsWith("Bearer ")) {
+    return { status: "rejected" };
+  }
+  const token = authorizationHeader.slice(7).trim();
+  if (token === "") {
+    return { status: "rejected" };
+  }
+  if (token.startsWith("pb_sk_")) {
+    return { status: "ok", apiKey: token };
+  }
+  return { status: "rejected" };
+}
+function resolvePastedKey(apiKey) {
+  if (apiKey === "") return { status: "absent" };
+  return apiKey.startsWith("pb_sk_") ? { status: "ok", apiKey } : { status: "rejected" };
+}
+function isCrossSiteFormPost(origin, secFetchSite, ownOrigin) {
+  if (secFetchSite === "cross-site") return true;
+  if (typeof origin !== "string" || origin === "") return false;
   try {
-    providedSig = Buffer.from(sigB64, "base64url");
+    return new URL(origin).origin !== new URL(ownOrigin).origin;
   } catch {
-    return null;
+    return true;
+  }
+}
+function checkAuthBlock(failures, ip, now) {
+  const rec = failures.get(ip);
+  if (!rec) return false;
+  return rec.blockedUntil > now;
+}
+function authLockoutError(failures, ip, now, id = null) {
+  const rec = failures.get(ip);
+  if (!rec || !checkAuthBlock(failures, ip, now)) return null;
+  const retryAfterSeconds = Math.max(0, Math.ceil((rec.blockedUntil - now) / 1e3));
+  return buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec.count, id });
+}
+function recordAuthFailure(failures, ip, now) {
+  const rec = failures.get(ip);
+  if (!rec) {
+    failures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });
+    return;
+  }
+  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
+    rec.count = 1;
+    rec.firstFailure = now;
+    rec.blockedUntil = 0;
+  } else {
+    rec.count++;
+    if (rec.count >= AUTH_FAILURE_MAX) {
+      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
+    }
+  }
+}
+function keyVerdictGate(verdict, failures, ip, now) {
+  if (verdict === "ok" || verdict === "rate_limited") return "admit";
+  if (verdict === "rejected") {
+    recordAuthFailure(failures, ip, now);
+    return "unauthorized";
+  }
+  return "unavailable";
+}
+
+// src/lib/oauthRedirectAllowlist.ts
+var DEFAULT_OAUTH_REDIRECT_URIS = [
+  "https://claude.ai/api/mcp/auth_callback",
+  "https://claude.com/api/mcp/auth_callback",
+  "https://chatgpt.com/connector_platform_oauth_redirect"
+];
+var CHATGPT_CONNECTOR_CALLBACK = /^https:\/\/chatgpt\.com\/connector\/oauth\/[A-Za-z0-9_-]+$/;
+var LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+var MAX_REDIRECT_URI_LENGTH = 2048;
+var MAX_REGISTRATION_REDIRECTS = 10;
+var OPERATOR_ENTRY_FORM = "OAUTH_REDIRECT_HOST_ALLOWLIST entries must be full https redirect URIs such as https://partner.example/oauth/callback (no bare host, no query, no fragment)";
+function exactForm(url) {
+  return `${url.origin}${url.pathname}`;
+}
+function parseRedirectUriAllowlist(raw) {
+  if (!raw) return { uris: [], configError: null };
+  const uris = [];
+  for (const part of raw.split(",")) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    let url = null;
+    try {
+      url = trimmed.includes("://") ? new URL(trimmed) : null;
+    } catch {
+      url = null;
+    }
+    const valid = url !== null && url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash && (url.port === "" || url.port === "443") && url.pathname !== "/";
+    if (!valid || url === null) {
+      return { uris: [], configError: `${OPERATOR_ENTRY_FORM}; got "${trimmed}"` };
+    }
+    uris.push(exactForm(url));
   }
-  const expectedSig = sign(payloadB64);
-  if (providedSig.length !== expectedSig.length) return null;
-  if (!timingSafeEqual(providedSig, expectedSig)) return null;
-  let payload;
+  return { uris, configError: null };
+}
+function resolveOAuthRedirectAllowlist(opts = {}) {
+  const parsed = parseRedirectUriAllowlist(opts.explicitAllowlist);
+  return {
+    uris: [.../* @__PURE__ */ new Set([...DEFAULT_OAUTH_REDIRECT_URIS, ...parsed.uris])],
+    configError: parsed.configError
+  };
+}
+function checkRedirectUri(redirectUri, allowlist) {
+  if (allowlist.configError) return `OAuth is misconfigured: ${allowlist.configError}`;
+  if (typeof redirectUri !== "string" || redirectUri.length === 0) {
+    return "redirect_uri is required";
+  }
+  if (redirectUri.length > MAX_REDIRECT_URI_LENGTH) {
+    return `redirect_uri is longer than ${MAX_REDIRECT_URI_LENGTH} characters`;
+  }
+  let url;
   try {
-    const json = Buffer.from(payloadB64, "base64url").toString("utf8");
-    payload = JSON.parse(json);
+    url = new URL(redirectUri);
   } catch {
-    return null;
+    return "redirect_uri is not a valid absolute URL";
   }
-  if (!payload || typeof payload.k !== "string" || typeof payload.i !== "number" || typeof payload.j !== "string") {
-    return null;
+  if (url.username || url.password) return "redirect_uri must not contain credentials";
+  if (url.hash) return "redirect_uri must not contain a fragment";
+  const host = url.hostname.toLowerCase();
+  if (url.protocol === "http:") {
+    return LOOPBACK_HOSTS.includes(host) ? null : "redirect_uri must use https (http is allowed only for localhost, 127.0.0.1 or [::1])";
+  }
+  if (url.protocol === "https:") {
+    if (url.port && url.port !== "443") return "redirect_uri must use the default https port (443)";
+    if (url.search) return "redirect_uri must not contain a query";
+    const exact = exactForm(url);
+    return allowlist.uris.includes(exact) || CHATGPT_CONNECTOR_CALLBACK.test(exact) ? null : "redirect_uri is not an allowed callback (an operator can add the full URI with OAUTH_REDIRECT_HOST_ALLOWLIST)";
+  }
+  return "redirect_uri scheme is not allowed (use https, or http on loopback)";
+}
+function checkRegistrationRedirects(redirectUris, allowlist) {
+  if (!Array.isArray(redirectUris) || redirectUris.length === 0) return "redirect_uris is required";
+  if (redirectUris.length > MAX_REGISTRATION_REDIRECTS) {
+    return `redirect_uris may hold at most ${MAX_REGISTRATION_REDIRECTS} entries`;
+  }
+  for (const uri of redirectUris) {
+    const reason = checkRedirectUri(uri, allowlist);
+    if (reason) return reason;
+  }
+  return null;
+}
+
+// src/lib/oauthAuthCode.ts
+function normalisePastedKey(raw) {
+  if (typeof raw !== "string") return "";
+  const trimmed = raw.trim();
+  const first = trimmed[0];
+  if (trimmed.length >= 2 && (first === '"' || first === "'" || first === "`") && trimmed.endsWith(first)) {
+    return trimmed.slice(1, -1).trim();
   }
-  if (Date.now() - payload.i > REFRESH_TOKEN_TTL_MS) return null;
-  return { apiKey: payload.k };
+  return trimmed;
+}
+function pendingCodeRefusal(pending, redirectUri, now) {
+  if (!pending) return "unknown_code";
+  if (pending.redirectUri !== redirectUri) return "redirect_mismatch";
+  if (now > pending.expiresAt) return "expired";
+  return null;
+}
+function tokenResponse(apiKey) {
+  return {
+    access_token: apiKey,
+    token_type: "Bearer",
+    // 1 year: validity is enforced by Convex on every call, not by this clock.
+    expires_in: 365 * 24 * 3600
+  };
 }
 
 // src/http.ts
@@ -116,6 +347,10 @@ bootstrapHttp();
 initAnalytics();
 initFeatureFlags(getPostHogClient());
 var PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? "3002", 10);
+function keyCheckCandidates() {
+  const primaryUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_CLOUD_URL).replace(/\/$/, "");
+  return [primaryUrl, ...parseFallbackUrls(process.env.CONVEX_FALLBACK_URLS).map((u) => u.replace(/\/$/, ""))];
+}
 function baseUrl(req) {
   const proto = req.headers["x-forwarded-proto"] ?? req.protocol ?? "http";
   const host = req.headers.host ?? `localhost:${PORT}`;
@@ -125,6 +360,7 @@ var app = express();
 app.set("trust proxy", 1);
 app.use(express.json());
 var ALLOWED_ORIGINS = (process.env.CORS_ORIGINS ?? "https://claude.ai").split(",").map((o) => o.trim()).filter(Boolean);
+var OAUTH_REDIRECT_ALLOWLIST = resolveOAuthRedirectAllowlist({ explicitAllowlist: process.env.OAUTH_REDIRECT_HOST_ALLOWLIST });
 app.use((_req, res, next) => {
   const origin = _req.headers.origin;
   if (origin && ALLOWED_ORIGINS.includes(origin)) {
@@ -135,7 +371,7 @@ app.use((_req, res, next) => {
     "Access-Control-Allow-Headers",
     "Content-Type, Authorization, Mcp-Session-Id, Last-Event-Id"
   );
-  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
+  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id, Retry-After");
   if (_req.method === "OPTIONS") {
     res.status(204).end();
     return;
@@ -159,7 +395,8 @@ app.get("/.well-known/oauth-authorization-server", (req, res) => {
     token_endpoint: `${base}/oauth/token`,
     registration_endpoint: `${base}/register`,
     response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code", "refresh_token"],
+    grant_types_supported: ["authorization_code"],
+    // TEN-4548: no refresh grant (lib/oauthAuthCode.ts tokenResponse)
     code_challenge_methods_supported: ["S256"],
     token_endpoint_auth_methods_supported: ["none"],
     scopes_supported: ["mcp:tools", "mcp:resources"]
@@ -187,14 +424,12 @@ app.post(
       return;
     }
     const { redirect_uris, client_name } = req.body;
-    if (!Array.isArray(redirect_uris) || redirect_uris.length === 0) {
-      res.status(400).json({
-        error: "invalid_client_metadata",
-        error_description: "redirect_uris is required"
-      });
+    const refusal = checkRegistrationRedirects(redirect_uris, OAUTH_REDIRECT_ALLOWLIST);
+    if (refusal) {
+      res.status(400).json({ error: "invalid_redirect_uri", error_description: refusal });
       return;
     }
-    const clientId = `pb_client_${randomUUID2()}`;
+    const clientId = `pb_client_${randomUUID()}`;
     const client = {
       client_id: clientId,
       redirect_uris,
@@ -213,9 +448,6 @@ app.post(
   }
 );
 var pendingCodes = /* @__PURE__ */ new Map();
-var ACCESS_TOKEN_TTL = 3600;
-var ACCESS_TOKEN_TTL_MS = ACCESS_TOKEN_TTL * 1e3;
-var accessTokens = /* @__PURE__ */ new Map();
 setInterval(() => {
   const now = Date.now();
   for (const [code, auth] of pendingCodes) {
@@ -224,9 +456,6 @@ setInterval(() => {
   for (const [id, client] of registeredClients) {
     if (now - client.registeredAt > 24 * 60 * 6e4) registeredClients.delete(id);
   }
-  for (const [token, entry] of accessTokens) {
-    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) accessTokens.delete(token);
-  }
   for (const [ip, rec] of authFailures) {
     if (rec.blockedUntil < now && rec.firstFailure + AUTH_FAILURE_WINDOW_MS < now) {
       authFailures.delete(ip);
@@ -609,7 +838,7 @@ function errorPanelInner(title, trustedDetailHtml, retryUrl) {
 <p class="err-msg" data-field="err-msg">${trustedDetailHtml}</p>
 <div class="err-actions">
   <a href="${esc(retryUrl)}" class="btn-secondary" data-retry-link>&larr; Try again</a>
-  <a href="https://productbrain.io" target="_blank" rel="noopener noreferrer" class="btn-secondary">Get an API key &rarr;</a>
+  <a href="${esc(apiKeysUrl())}" target="_blank" rel="noopener noreferrer" class="btn-secondary">Get an API key &rarr;</a>
 </div>`;
 }
 var cmdScript = `
@@ -657,7 +886,7 @@ function authorizeFormPage(params) {
     <div class="hint" id="hint" hidden></div>
     <button type="submit" class="btn-primary" id="sb" disabled><span id="bt">Connect</span></button>
   </form>
-  <div class="small-link"><a href="https://productbrain.io" target="_blank" rel="noopener noreferrer">No key? Generate one &rarr;</a></div>
+  <div class="small-link"><a href="${esc(apiKeysUrl())}" target="_blank" rel="noopener noreferrer">No key? Generate one &rarr;</a></div>
 </div>
 
 <!-- \u2500\u2500\u2500 VERIFYING \u2500\u2500\u2500 -->
@@ -738,7 +967,6 @@ ${cmdScript}
     e.preventDefault();
     var v=k.value.trim();
     if(!v){iw.classList.add('has-error');hint.classList.add('is-error');hint.textContent='Paste your key first';hint.removeAttribute('hidden');return}
-    if(v.indexOf('pb_sk_')!==0){iw.classList.add('has-error');hint.classList.add('is-error');hint.textContent='Key must start with pb_sk_';hint.removeAttribute('hidden');return}
     sb.disabled=true;bt.textContent='Verifying';
     show(pVerify);
 
@@ -796,6 +1024,11 @@ ${errorPanelInner(title, trustedDetailHtml, retryUrl)}
 }
 app.get("/authorize", authLimiter, (req, res) => {
   const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.query;
+  const refusal = checkRedirectUri(redirect_uri, OAUTH_REDIRECT_ALLOWLIST);
+  if (refusal) {
+    res.status(400).json({ error: "invalid_request", error_description: refusal });
+    return;
+  }
   const cid = String(client_id ?? "");
   const clientName = cid && registeredClients.has(cid) ? registeredClients.get(cid).client_name : void 0;
   res.type("html").send(authorizeFormPage({
@@ -812,7 +1045,8 @@ app.post(
   authLimiter,
   express.urlencoded({ extended: false }),
   async (req, res) => {
-    const { api_key, redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.body;
+    const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.body;
+    const api_key = normalisePastedKey(req.body.api_key);
     const wantsJson = String(req.headers["accept"] ?? "").includes("application/json");
     const retryParams = new URLSearchParams({
       redirect_uri: redirect_uri ?? "",
@@ -829,36 +1063,42 @@ app.post(
         res.status(status).type("html").send(authorizeErrorPage(title, trustedDetailHtml, retryUrl));
       }
     }
-    if (!api_key?.startsWith("pb_sk_")) {
-      sendError(
-        "Invalid key format",
-        "API keys start with <code>pb_sk_</code>. Check your key and try again."
-      );
+    if (isCrossSiteFormPost(req.headers["origin"], req.headers["sec-fetch-site"], baseUrl(req))) {
+      sendError("Request refused", "This form only accepts keys sent from its own sign-in page. Open the connect link again.", 403);
+      return;
+    }
+    const reqIp = req.ip ?? "unknown";
+    const nowTs = Date.now();
+    const lockout = authLockoutError(authFailures, reqIp, nowTs);
+    if (lockout) {
+      const retryAfter = lockout.headers["Retry-After"];
+      res.setHeader("Retry-After", retryAfter);
+      sendError("Too many attempts", `Too many keys from this network were not recognized. Try again in ${retryAfter}s.`, 429);
+      return;
+    }
+    const pasted = resolvePastedKey(api_key);
+    if (pasted.status !== "ok") {
+      if (pasted.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
+      sendError("Invalid key format", "API keys start with <code>pb_sk_</code>. Check your key and try again.");
       return;
     }
     if (!client_id) {
-      res.status(400).json({
-        error: "invalid_request",
-        error_description: "client_id is required"
-      });
+      res.status(400).json({ error: "invalid_request", error_description: "client_id is required" });
+      return;
+    }
+    const redirectRefusal = checkRedirectUri(redirect_uri, OAUTH_REDIRECT_ALLOWLIST);
+    if (redirectRefusal) {
+      res.status(400).json({ error: "invalid_request", error_description: redirectRefusal });
       return;
     }
     if (!registeredClients.has(client_id)) {
-      if (typeof redirect_uri === "string" && redirect_uri.startsWith("https://")) {
-        registeredClients.set(client_id, {
-          client_id,
-          redirect_uris: [redirect_uri],
-          registeredAt: Date.now()
-        });
-        process.stderr.write(`[authorize] auto-re-registered stale client_id after restart
-`);
-      } else {
-        res.status(400).json({
-          error: "invalid_request",
-          error_description: "Unknown client_id and redirect_uri is not a valid https URL"
-        });
+      if (registeredClients.size >= MAX_REGISTERED_CLIENTS) {
+        res.status(503).json({ error: "server_error", error_description: "Registration limit reached. Try again later." });
         return;
       }
+      registeredClients.set(client_id, { client_id, redirect_uris: [redirect_uri], registeredAt: Date.now() });
+      process.stderr.write(`[authorize] auto-re-registered stale client_id after restart
+`);
     }
     const client = registeredClients.get(client_id);
     if (!client.redirect_uris.includes(redirect_uri)) {
@@ -869,48 +1109,25 @@ app.post(
       return;
     }
     let workspaceName = "Your Workspace";
-    try {
-      const primaryUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_CLOUD_URL).replace(/\/$/, "");
-      const fallbackUrls = (process.env.CONVEX_FALLBACK_URLS ?? "").split(",").map((u) => u.trim().replace(/\/$/, "")).filter(Boolean);
-      const candidates = [primaryUrl, ...fallbackUrls];
-      let foundUrl;
-      let anyDefinitiveReject = false;
-      for (const url2 of candidates) {
-        let checkData = null;
-        try {
-          const checkRes = await fetch(`${url2}/api/key-check`, {
-            method: "POST",
-            headers: { "Authorization": `Bearer ${api_key}`, "Content-Type": "application/json" },
-            signal: AbortSignal.timeout(5e3)
-          });
-          checkData = await checkRes.json();
-        } catch {
-          continue;
-        }
-        if (checkData.ok) {
-          if (checkData.workspaceName) workspaceName = checkData.workspaceName;
-          foundUrl = checkData.deploymentUrl ?? url2;
-          break;
-        }
-        anyDefinitiveReject = true;
-      }
-      if (!foundUrl) {
-        if (anyDefinitiveReject) {
-          sendError(
-            "Key not recognized",
-            "This API key wasn't found in Product Brain. Check your API Keys in Cortex and try again.",
-            401
-          );
-          return;
-        }
-        process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
-      } else {
-        getKeyState(api_key).deploymentUrl = foundUrl;
-      }
-    } catch {
+    const check = await checkKeyAgainstCandidates(keyCheckCandidates(), api_key, 5e3);
+    const gate = keyVerdictGate(check.verdict, authFailures, reqIp, nowTs);
+    if (check.verdict === "ok") {
+      if (check.workspaceName) workspaceName = check.workspaceName;
+      getKeyState(api_key).deploymentUrl = check.deploymentUrl;
+    } else if (check.verdict === "rate_limited") {
+      sendError(
+        "Rate limited",
+        `This API key is valid but temporarily rate limited. Try again in ${check.retryAfterSeconds ?? 60}s.`,
+        429
+      );
+      return;
+    } else if (gate === "unauthorized") {
+      sendError("Key not recognized", "This API key wasn't found in Product Brain. Check your API Keys in Cortex and try again.", 401);
+      return;
+    } else {
       process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
     }
-    const code = randomUUID2();
+    const code = randomUUID();
     pendingCodes.set(code, {
       apiKey: api_key,
       codeChallenge: code_challenge,
@@ -929,41 +1146,25 @@ app.post(
     }
   }
 );
-function issueTokens(apiKey) {
-  return {
-    access_token: apiKey,
-    token_type: "Bearer",
-    // 1-year TTL: actual validity enforced by Convex, not by expiry clock.
-    // Long TTL prevents unnecessary refresh cycles after restarts.
-    expires_in: 365 * 24 * 3600,
-    refresh_token: signRefreshToken(apiKey)
-  };
-}
 app.post(
   "/oauth/token",
   authLimiter,
   express.urlencoded({ extended: false }),
   express.json(),
   (req, res) => {
-    const { grant_type, code, code_verifier, redirect_uri, refresh_token } = req.body;
-    if (grant_type === "refresh_token") {
-      const verified = verifyRefreshToken(refresh_token);
-      if (!verified) {
-        res.status(400).json({
-          error: "invalid_grant",
-          error_description: "Invalid or expired refresh token"
-        });
-        return;
-      }
-      res.json(issueTokens(verified.apiKey));
-      return;
-    }
+    const { grant_type, code, code_verifier, redirect_uri } = req.body;
     if (grant_type !== "authorization_code") {
       res.status(400).json({ error: "unsupported_grant_type" });
       return;
     }
     const pending = pendingCodes.get(code);
-    if (!pending || pending.redirectUri !== redirect_uri) {
+    const codeRefusal = pendingCodeRefusal(pending, redirect_uri, Date.now());
+    if (codeRefusal === "expired") {
+      pendingCodes.delete(code);
+      res.status(400).json({ error: "invalid_grant", error_description: "authorization code expired" });
+      return;
+    }
+    if (codeRefusal || !pending) {
       res.status(400).json({ error: "invalid_grant" });
       return;
     }
@@ -977,7 +1178,7 @@ app.post(
       return;
     }
     pendingCodes.delete(code);
-    res.json(issueTokens(pending.apiKey));
+    res.json(tokenResponse(pending.apiKey));
   }
 );
 var mcpLimiter = rateLimit({
@@ -985,85 +1186,63 @@ var mcpLimiter = rateLimit({
   max: 120,
   standardHeaders: true,
   legacyHeaders: false,
-  message: { error: "Too many requests. Try again later." }
+  handler: (req, res) => {
+    const r = req.rateLimit;
+    const reset = r?.resetTime?.getTime?.() ?? Date.now() + 6e4;
+    send429(res, buildRateLimitError({
+      retryAfterSeconds: Math.max(1, Math.ceil((reset - Date.now()) / 1e3)),
+      limit: r?.limit ?? 120,
+      current: r?.used ?? 0,
+      id: req.body?.id ?? null
+      // mirror the JSON-RPC id when a POST body is present
+    }));
+  }
 });
 var authFailures = /* @__PURE__ */ new Map();
-var AUTH_FAILURE_MAX = 10;
-var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
-var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
-var MAX_AUTH_FAILURE_ENTRIES = 1e4;
-function checkAuthBlock(ip) {
-  const rec = authFailures.get(ip);
-  if (!rec) return false;
-  return rec.blockedUntil > Date.now();
-}
-function recordAuthFailure(ip) {
-  const now = Date.now();
-  const rec = authFailures.get(ip);
-  if (!rec) {
-    authFailures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });
-    return;
-  }
-  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
-    rec.count = 1;
-    rec.firstFailure = now;
-    rec.blockedUntil = 0;
-  } else {
-    rec.count++;
-    if (rec.count >= AUTH_FAILURE_MAX) {
-      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
-    }
-  }
-}
 app.get("/health", (_req, res) => {
   res.json({ status: "ok", version: SERVER_VERSION, transport: "http" });
 });
 var sessions = /* @__PURE__ */ new Map();
 var SESSION_TTL_MS = 30 * 60 * 1e3;
 var MAX_SESSIONS = 200;
-var MAX_SESSIONS_PER_KEY = 5;
+var EVICT_GRACE_MS = 6e4;
+var MAX_SESSIONS_PER_KEY = Math.max(
+  1,
+  Math.min(MAX_SESSIONS - 1, Number(process.env.MCP_MAX_SESSIONS_PER_KEY) || 25)
+);
 function evictStaleSessions() {
   const now = Date.now();
   for (const [id, entry] of sessions) {
     if (now - entry.lastAccess > SESSION_TTL_MS) {
-      logSessionLifecycle("session_deleted", id, "ttl");
+      logSessionLifecycle(
+        "session_deleted",
+        id,
+        entry.inFlight > 0 ? "inflight_leak" : "ttl"
+      );
       entry.transport.close().catch(() => {
       });
       sessions.delete(id);
     }
   }
   if (sessions.size > MAX_SESSIONS) {
-    const sorted = [...sessions.entries()].sort(
-      (a, b) => a[1].lastAccess - b[1].lastAccess
-    );
-    for (let i = 0; i < sorted.length - MAX_SESSIONS; i++) {
+    const sorted = [...sessions.entries()].filter(([, e]) => e.inFlight === 0).sort((a, b) => a[1].lastAccess - b[1].lastAccess);
+    const overflow = sessions.size - MAX_SESSIONS;
+    for (let i = 0; i < Math.min(overflow, sorted.length); i++) {
       logSessionLifecycle("session_deleted", sorted[i][0], "eviction");
       sorted[i][1].transport.close().catch(() => {
       });
       sessions.delete(sorted[i][0]);
     }
-  }
-}
-setInterval(evictStaleSessions, 6e4);
-function extractBearerKey(req) {
-  const header = req.headers?.authorization;
-  if (typeof header !== "string" || !header.startsWith("Bearer ")) return null;
-  const token = header.slice(7).trim();
-  if (token.startsWith("pb_sk_")) {
-    return token;
-  }
-  if (token.startsWith("pb_at_")) {
-    const entry = accessTokens.get(token);
-    if (!entry) return null;
-    const now = Date.now();
-    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) {
-      accessTokens.delete(token);
-      return null;
+    if (sessions.size > MAX_SESSIONS) {
+      const ts = (/* @__PURE__ */ new Date()).toISOString();
+      process.stderr.write(
+        `[HTTP] ${ts} session_cap_breach size=${sessions.size} max=${MAX_SESSIONS} reason=all_inflight (no idle sessions to evict; TTL backstop will reclaim)
+`
+      );
     }
-    return entry.apiKey;
   }
-  return null;
 }
+setInterval(evictStaleSessions, 6e4);
 function send401(req, res) {
   const base = baseUrl(req);
   res.status(401).set(
@@ -1086,21 +1265,24 @@ function logSessionLifecycle(event, sessionId, reason) {
 }
 app.post("/mcp", mcpLimiter, async (req, res) => {
   const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+  const nowTs = Date.now();
+  const lockout = authLockoutError(authFailures, reqIp, nowTs, req.body?.id ?? null);
+  if (lockout) {
+    send429(res, lockout);
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  if (auth.status !== "ok") {
     logRequest("POST", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   const reqStart = Date.now();
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       if (sessionId && sessions.has(sessionId)) {
         const entry = sessions.get(sessionId);
         if (entry.keyHash !== hashKey(apiKey)) {
@@ -1111,41 +1293,98 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
           });
           return;
         }
-        entry.lastAccess = Date.now();
-        await entry.transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", sessionId, Date.now() - reqStart);
+        try {
+          entry.inFlight++;
+          entry.lastAccess = Date.now();
+          await entry.transport.handleRequest(req, res, req.body);
+          logRequest("POST", "ok", sessionId, Date.now() - reqStart);
+        } finally {
+          entry.inFlight--;
+          entry.lastAccess = Date.now();
+        }
       } else if (!sessionId && isInitializeRequest(req.body)) {
-        const keyH = hashKey(apiKey);
-        let keySessionCount = 0;
-        for (const entry of sessions.values()) {
-          if (entry.keyHash === keyH) keySessionCount++;
+        const check = await checkKeyAgainstCandidates(keyCheckCandidates(), apiKey, 5e3);
+        const gate = keyVerdictGate(check.verdict, authFailures, reqIp, Date.now());
+        if (gate === "unauthorized") {
+          logRequest("POST", "auth_fail");
+          send401(req, res);
+          return;
         }
-        if (keySessionCount >= MAX_SESSIONS_PER_KEY) {
-          res.status(429).json({
+        if (gate === "unavailable") {
+          res.status(503).json({
             jsonrpc: "2.0",
-            error: { code: -32e3, message: "Too many sessions for this API key" },
-            id: null
+            error: { code: -32e3, message: "Product Brain could not verify this API key right now. Retry shortly." },
+            id: req.body?.id ?? null
+          });
+          return;
+        }
+        if (check.verdict === "ok" || check.verdict === "rate_limited") getKeyState(apiKey).deploymentUrl = check.deploymentUrl;
+        const keyH = hashKey(apiKey);
+        const plan = planKeyAdmission(
+          sessions,
+          keyH,
+          MAX_SESSIONS_PER_KEY,
+          Date.now(),
+          { ttlMs: SESSION_TTL_MS, graceMs: EVICT_GRACE_MS }
+        );
+        for (const sid2 of plan.evict) {
+          const victim = sessions.get(sid2);
+          sessions.delete(sid2);
+          victim?.transport.close().catch(() => {
           });
+          logSessionLifecycle("session_deleted", sid2, "lru_evict");
+        }
+        if (!plan.admit) {
+          send429(res, buildSessionCapError({
+            retryAfterSeconds: plan.retryAfterSeconds,
+            limit: MAX_SESSIONS_PER_KEY,
+            current: countKeySessions(sessions, keyH),
+            poll: plan.retryIsPoll,
+            id: req.body?.id ?? null
+          }));
           return;
         }
+        const sid = randomUUID();
+        let initialized = false;
         const transport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID2(),
-          onsessioninitialized: (sid) => {
-            sessions.set(sid, { transport, lastAccess: Date.now(), keyHash: keyH });
-            logSessionLifecycle("session_created", sid);
+          sessionIdGenerator: () => sid,
+          onsessioninitialized: (s) => {
+            initialized = true;
+            logSessionLifecycle("session_created", s);
           }
+          // log only — no map write
         });
+        const reserved = { transport, lastAccess: Date.now(), keyHash: keyH, inFlight: 1 };
+        sessions.set(sid, reserved);
         transport.onclose = () => {
-          const sid = transport.sessionId;
-          if (sid) {
-            logSessionLifecycle("session_deleted", sid, "onclose");
-            sessions.delete(sid);
+          const s = transport.sessionId ?? sid;
+          forgetStreamLifecycle(keyH, s);
+          if (sessions.has(s)) {
+            sessions.delete(s);
+            logSessionLifecycle("session_deleted", s, "onclose");
           }
         };
-        const server = createProductBrainServer();
-        await server.connect(transport);
-        await transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+        try {
+          const server = createProductBrainServer();
+          await server.connect(transport);
+          await transport.handleRequest(req, res, req.body);
+          logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+        } catch (e) {
+          transport.onclose = void 0;
+          sessions.delete(sid);
+          throw e;
+        } finally {
+          if (!initialized) {
+            transport.onclose = void 0;
+            if (sessions.delete(sid)) logSessionLifecycle("session_deleted", sid, "init_rejected");
+          } else {
+            const e = sessions.get(sid);
+            if (e) {
+              e.inFlight--;
+              e.lastAccess = Date.now();
+            }
+          }
+        }
       } else if (sessionId) {
         process.stderr.write(
           `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale sessionId=${sessionId} (likely server restart \u2014 instructing client to re-initialise)
@@ -1181,17 +1420,20 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
 });
 app.get("/mcp", mcpLimiter, async (req, res) => {
   const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+  const nowTs = Date.now();
+  const lockout = authLockoutError(authFailures, reqIp, nowTs, req.body?.id ?? null);
+  if (lockout) {
+    send429(res, lockout);
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  if (auth.status !== "ok") {
     logRequest("GET", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   if (!sessionId) {
     res.status(400).send("Missing Mcp-Session-Id header");
@@ -1206,7 +1448,7 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
     return;
   }
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       const entry = sessions.get(sessionId);
       if (entry.keyHash !== hashKey(apiKey)) {
         res.status(403).json({
@@ -1226,17 +1468,20 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
 });
 app.delete("/mcp", mcpLimiter, async (req, res) => {
   const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+  const nowTs = Date.now();
+  const lockout = authLockoutError(authFailures, reqIp, nowTs, req.body?.id ?? null);
+  if (lockout) {
+    send429(res, lockout);
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  if (auth.status !== "ok") {
     logRequest("DELETE", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   if (!sessionId) {
     res.status(400).send("Missing Mcp-Session-Id header");
@@ -1251,7 +1496,7 @@ app.delete("/mcp", mcpLimiter, async (req, res) => {
     return;
   }
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       const entry = sessions.get(sessionId);
       if (entry.keyHash !== hashKey(apiKey)) {
         res.status(403).json({