ocean-brain 0.13.0 → 0.13.2

package/server/dist/features/image/http/upload.js

@@ -25,7 +25,7 @@ const createUploadValidationError = (error) => {
   return createAppError(400, "INVALID_IMAGE_UPLOAD", "Uploaded image content is invalid.");
 };
 const createUploadImageHandler = (persistImage = persistUploadedImage) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const { image } = req.body ?? {};
     if (typeof image !== "string") {
       throw createAppError(400, "INVALID_IMAGE_UPLOAD", "No image uploaded");
@@ -50,7 +50,7 @@ const createUploadImageHandler = (persistImage = persistUploadedImage) => {
       buffer: validatedImage.buffer,
       extension: validatedImage.extension
     });
-    res.status(200).json(createUploadResponse(uploadedImage)).end();
+    return reply.status(200).send(createUploadResponse(uploadedImage));
   };
 };
 export {

package/server/dist/features/mcp-admin/http/handlers.js

@@ -9,36 +9,36 @@ const createMcpAdminStatusResponse = async (service) => {
   };
 };
 const createMcpAdminStatusHandler = (service = createMcpAdminService()) => {
-  return async (_req, res) => {
+  return async (_req, reply) => {
     const status = await createMcpAdminStatusResponse(service);
-    res.status(200).json(status).end();
+    return reply.status(200).send(status);
   };
 };
 const createMcpAdminSetEnabledHandler = (service = createMcpAdminService()) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const enabled = req.body?.enabled;
     if (typeof enabled !== "boolean") {
       throw createAppError(400, "INVALID_MCP_ENABLED", "enabled must be a boolean.");
     }
     await service.setEnabled(enabled);
     const status = await createMcpAdminStatusResponse(service);
-    res.status(200).json(status).end();
+    return reply.status(200).send(status);
   };
 };
 const createMcpAdminRotateTokenHandler = (service = createMcpAdminService()) => {
-  return async (_req, res) => {
+  return async (_req, reply) => {
     const result = await service.rotateToken();
-    res.status(200).json({
+    return reply.status(200).send({
       token: result.token,
       message: "Save this token now. It is shown only once."
-    }).end();
+    });
   };
 };
 const createMcpAdminRevokeTokenHandler = (service = createMcpAdminService()) => {
-  return async (_req, res) => {
+  return async (_req, reply) => {
     await service.revokeActiveToken();
     const status = await createMcpAdminStatusResponse(service);
-    res.status(200).json(status).end();
+    return reply.status(200).send(status);
   };
 };
 export {

package/server/dist/features/note/http/mcp.js

@@ -227,7 +227,7 @@ const resolveSeparator = (value) => {
   throw createAppError(400, "INVALID_SEPARATOR", 'Separator must be "\\n" or "\\n\\n".');
 };
 const createMcpCreateNoteHandler = (createNote = createNoteFromMarkdown, emitEvent = emitServerEvent) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const { title, markdown, layout } = req.body ?? {};
     const resolvedLayout = resolveNoteLayout(layout);
     if (typeof title !== "string") {
@@ -251,10 +251,10 @@ const createMcpCreateNoteHandler = (createNote = createNoteFromMarkdown, emitEve
         noteId: note.id,
         updatedAt: note.updatedAt
       });
-      res.status(200).json({
+      return reply.status(200).send({
         created: true,
         note
-      }).end();
+      });
     } catch (error) {
       if (error instanceof InvalidNoteAuthoringInputError) {
         throw createAppError(400, "INVALID_NOTE_INPUT", error.message);
@@ -270,19 +270,19 @@ const createMcpNoteWriteBaselineHandler = (findNoteBaseline = async (id) => mode
     updatedAt: true
   }
 })) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const noteId = resolvePositiveNoteId(req.body?.id);
     const note = await findNoteBaseline(noteId);
     if (!note) {
       throw createAppError(404, "NOTE_NOT_FOUND", "The requested note was not found.");
     }
-    res.status(200).json({
+    return reply.status(200).send({
       note: serializeNoteWriteBaseline(note)
-    }).end();
+    });
   };
 };
 const createMcpPatchNoteMarkdownHandler = (patchMarkdown = patchNoteMarkdown, emitEvent = emitServerEvent) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const { id, expectedUpdatedAt, baseMarkdownSha256, intent, selector, operation, policy } = req.body ?? {};
     const noteId = resolvePositiveNoteId(id);
     const resolvedExpectedUpdatedAt = resolveOptionalString(
@@ -315,11 +315,11 @@ const createMcpPatchNoteMarkdownHandler = (patchMarkdown = patchNoteMarkdown, em
         updatedAt: result.note.updatedAt
       });
     }
-    res.status(200).json(result).end();
+    return reply.status(200).send(result);
   };
 };
 const createMcpAppendNoteMarkdownHandler = (appendMarkdown = appendNoteMarkdown, emitEvent = emitServerEvent) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const { id, expectedUpdatedAt, baseMarkdownSha256, intent, insertion, placement, separator, policy } = req.body ?? {};
     const noteId = resolvePositiveNoteId(id);
     const resolvedExpectedUpdatedAt = resolveOptionalString(
@@ -356,11 +356,11 @@ const createMcpAppendNoteMarkdownHandler = (appendMarkdown = appendNoteMarkdown,
         updatedAt: result.note.updatedAt
       });
     }
-    res.status(200).json(result).end();
+    return reply.status(200).send(result);
   };
 };
 const createMcpReplaceNoteMarkdownHandler = (replaceMarkdown = replaceNoteMarkdown, emitEvent = emitServerEvent) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const { id, expectedUpdatedAt, baseMarkdownSha256, intent, replacement, policy } = req.body ?? {};
     const noteId = resolvePositiveNoteId(id);
     const resolvedExpectedUpdatedAt = resolveOptionalString(
@@ -395,11 +395,11 @@ const createMcpReplaceNoteMarkdownHandler = (replaceMarkdown = replaceNoteMarkdo
         updatedAt: result.note.updatedAt
       });
     }
-    res.status(200).json(result).end();
+    return reply.status(200).send(result);
   };
 };
 const createMcpUpdateNoteMetadataHandler = (updateMetadata = updateNoteMetadata, emitEvent = emitServerEvent) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const { id, expectedUpdatedAt, title, layout, properties } = req.body ?? {};
     const noteId = resolvePositiveNoteId(id);
     const resolvedLayout = resolveNoteLayout(layout);
@@ -431,11 +431,11 @@ const createMcpUpdateNoteMetadataHandler = (updateMetadata = updateNoteMetadata,
         updatedAt: result.note.updatedAt
       });
     }
-    res.status(200).json(result).end();
+    return reply.status(200).send(result);
   };
 };
 const createMcpDeleteNoteHandler = (deleteNote = deleteNoteById, emitEvent = emitServerEvent) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const id = Number(req.body?.id);
     if (!Number.isInteger(id) || id <= 0) {
       throw createAppError(400, "INVALID_NOTE_ID", "A valid note id is required.");
@@ -449,10 +449,10 @@ const createMcpDeleteNoteHandler = (deleteNote = deleteNoteById, emitEvent = emi
       source: "mcp",
       noteId: deletedNote.id
     });
-    res.status(200).json({
+    return reply.status(200).send({
       deleted: true,
       note: deletedNote
-    }).end();
+    });
   };
 };
 export {

package/server/dist/features/search/http/handlers.js

@@ -70,33 +70,33 @@ const parseBaseUrl = (value) => {
   return baseUrl;
 };
 const createSearchAdminStatusHandler = (manager = getDefaultSemanticSearchManager()) => {
-  return async (_req, res) => {
-    res.status(200).json(await manager.getStatus()).end();
+  return async (_req, reply) => {
+    return reply.status(200).send(await manager.getStatus());
   };
 };
 const createSearchAdminSaveConfigHandler = (manager = getDefaultSemanticSearchManager()) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const status = await manager.saveConfig(parseConfig(req.body), parseApiKeyInput(req.body));
-    res.status(200).json(status).end();
+    return reply.status(200).send(status);
   };
 };
 const createSearchAdminTestConnectionHandler = (manager = getDefaultSemanticSearchManager()) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const config = parseConfig({ ...req.body, enabled: true });
     const result = await manager.testConnection(config, parseApiKeyInput(req.body));
-    res.status(200).json(result).end();
+    return reply.status(200).send(result);
   };
 };
 const createSearchAdminListModelsHandler = (listModels = (baseUrl, apiKeyInput) => getDefaultSemanticSearchManager().listModels(baseUrl, apiKeyInput)) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const models = await listModels(parseBaseUrl(req.body), parseApiKeyInput(req.body));
-    res.status(200).json({ models }).end();
+    return reply.status(200).send({ models });
   };
 };
 const createSearchAdminReindexHandler = (manager = getDefaultSemanticSearchManager()) => {
-  return async (_req, res) => {
+  return async (_req, reply) => {
     const result = await manager.startReindex();
-    res.status(result.started ? 202 : 200).json(result).end();
+    return reply.status(result.started ? 202 : 200).send(result);
   };
 };
 export {

package/server/dist/features/search/search-manager.js

@@ -355,6 +355,21 @@ class SemanticSearchManager {
       this.noteSyncReconciliationTimer = null;
     }
   }
+  async close() {
+    this.stopBackgroundSync();
+    const activeOperations = [];
+    if (this.activeReindex) {
+      activeOperations.push(this.activeReindex);
+    }
+    if (this.activeNoteSync) {
+      activeOperations.push(this.activeNoteSync);
+    }
+    if (this.activeReconciliation) {
+      activeOperations.push(this.activeReconciliation);
+    }
+    await Promise.allSettled(activeOperations);
+    await this.dependencies.vectorIndex.close?.();
+  }
   async trySearch(query, limit) {
     const status = await this.getStatus();
     if (!status.available) {
@@ -389,6 +404,7 @@ class SemanticSearchManager {
   }
 }
 let defaultSemanticSearchManager = null;
+let defaultSemanticSearchUnsubscribers = [];
 const getDefaultSemanticSearchManager = () => {
   if (!defaultSemanticSearchManager) {
     defaultSemanticSearchManager = new SemanticSearchManager({
@@ -415,17 +431,29 @@ const getDefaultSemanticSearchManager = () => {
       }),
       apiKeyStore: new FileEmbeddingApiKeyStore(paths.embeddingApiKey)
     });
-    subscribeServerEvents((event) => {
-      void defaultSemanticSearchManager?.scheduleNoteSync(Number(event.noteId)).catch(() => void 0);
-    });
-    subscribeSemanticSearchNoteChanges((noteId) => {
-      void defaultSemanticSearchManager?.scheduleNoteSync(noteId).catch(() => void 0);
-    });
+    defaultSemanticSearchUnsubscribers = [
+      subscribeServerEvents((event) => {
+        void defaultSemanticSearchManager?.scheduleNoteSync(Number(event.noteId)).catch(() => void 0);
+      }),
+      subscribeSemanticSearchNoteChanges((noteId) => {
+        void defaultSemanticSearchManager?.scheduleNoteSync(noteId).catch(() => void 0);
+      })
+    ];
     defaultSemanticSearchManager.startBackgroundSync();
   }
   return defaultSemanticSearchManager;
 };
+const closeDefaultSemanticSearchManager = async () => {
+  const manager = defaultSemanticSearchManager;
+  defaultSemanticSearchManager = null;
+  for (const unsubscribe of defaultSemanticSearchUnsubscribers) {
+    unsubscribe();
+  }
+  defaultSemanticSearchUnsubscribers = [];
+  await manager?.close();
+};
 export {
   SemanticSearchManager,
+  closeDefaultSemanticSearchManager,
   getDefaultSemanticSearchManager
 };

package/server/dist/features/tag/http/mcp.js

@@ -1,14 +1,14 @@
 import { ensureTagByName, InvalidTagNameError } from "../../../features/tag/services/organization.js";
 import { createAppError } from "../../../modules/error-handler.js";
 const createMcpCreateTagHandler = (ensureTag = ensureTagByName) => {
-  return async (req, res) => {
+  return async (req, reply) => {
     const name = req.body?.name;
     if (typeof name !== "string") {
       throw createAppError(400, "INVALID_TAG_NAME", "A tag name is required.");
     }
     try {
       const result = await ensureTag(name);
-      res.status(200).json(result).end();
+      return reply.status(200).send(result);
     } catch (error) {
       if (error instanceof InvalidTagNameError) {
         throw createAppError(400, "INVALID_TAG_NAME", error.message);

package/server/dist/modules/auth-guard.js

@@ -1,76 +1,57 @@
 import { buildUnauthorizedGraphqlPayload, buildUnauthorizedPayload } from "@baejino/auth";
-import session from "express-session";
 import { GraphQLError } from "graphql";
-import lusca from "lusca";
 import { sanitizeRedirectPath } from "./auth-redirect.js";
-import { AUTH_SESSION_IDLE_TIMEOUT_MS, createSessionStore } from "./session-store.js";
 const JSON_HEADERS = { "Content-Type": "application/json" };
-const isAuthenticatedRequest = (req) => Boolean(req.session?.authenticated);
-const createSessionMiddleware = (authConfig) => {
+const CSRF_COOKIE_NAME = "XSRF-TOKEN";
+const isAuthenticatedRequest = (request) => Boolean(request.session?.authenticated);
+const issueCsrfToken = (authConfig, reply) => {
   if (authConfig.mode !== "password") {
-    return (_req, _res, next) => next();
+    return void 0;
   }
-  return session({
-    secret: authConfig.sessionSecret,
-    name: authConfig.cookieName,
-    store: createSessionStore(),
-    resave: false,
-    saveUninitialized: false,
-    rolling: true,
-    cookie: {
-      maxAge: AUTH_SESSION_IDLE_TIMEOUT_MS,
-      httpOnly: true,
-      sameSite: "lax",
-      secure: process.env.NODE_ENV === "production",
-      path: "/"
-    }
+  const token = reply.generateCsrf();
+  reply.setCookie(CSRF_COOKIE_NAME, token, {
+    httpOnly: false,
+    path: "/",
+    sameSite: "lax",
+    secure: process.env.NODE_ENV === "production"
   });
+  return token;
 };
 const createCsrfProtection = (authConfig) => {
   if (authConfig.mode !== "password") {
-    return (_req, _res, next) => next();
+    return (_request, _reply, done) => done();
   }
-  return lusca.csrf({
-    angular: true,
-    cookie: {
-      options: {
-        path: "/",
-        sameSite: "lax",
-        secure: process.env.NODE_ENV === "production"
-      }
-    }
-  });
-};
-const isCsrfTokenError = (error) => error instanceof Error && error.message.startsWith("CSRF token ");
-const buildLoginRedirectPath = (req) => {
-  const nextPath = sanitizeRedirectPath(req.body?.next);
-  return `/login?next=${encodeURIComponent(nextPath)}`;
-};
-const createLoginCsrfFailureHandler = (authConfig) => {
-  return (error, req, res, next) => {
-    if (authConfig.mode !== "password" || !isCsrfTokenError(error) || req.method !== "POST" || req.path !== "/login" || isAuthenticatedRequest(req)) {
-      next(error);
+  return (request, reply, done) => {
+    if (request.method === "GET" || request.method === "HEAD" || request.method === "OPTIONS") {
+      done();
       return;
     }
-    res.redirect(303, buildLoginRedirectPath(req));
+    request.server.csrfProtection(request, reply, done);
   };
 };
+const isCsrfTokenError = (error) => error instanceof Error && ("code" in error ? error.code === "FST_CSRF_INVALID_TOKEN" || error.code === "FST_CSRF_MISSING_SECRET" : error.message.toLowerCase().includes("csrf"));
+const buildLoginCsrfRedirectPath = (request) => {
+  const body = request.body;
+  const nextPath = sanitizeRedirectPath(body?.next);
+  return `/login?next=${encodeURIComponent(nextPath)}`;
+};
+const shouldRedirectLoginCsrfFailure = (error, request, authConfig) => authConfig.mode === "password" && isCsrfTokenError(error) && request.method === "POST" && request.url.split("?")[0] === "/login" && !isAuthenticatedRequest(request);
 const requireSessionForWrite = (authConfig) => {
-  return (req, res, next) => {
-    if (authConfig.mode === "open" || isAuthenticatedRequest(req)) {
-      next();
+  return (request, reply, done) => {
+    if (authConfig.mode === "open" || isAuthenticatedRequest(request)) {
+      done();
       return;
     }
-    res.status(401).set(JSON_HEADERS).json(buildUnauthorizedPayload()).end();
+    void reply.code(401).headers(JSON_HEADERS).send(buildUnauthorizedPayload());
   };
 };
 const requireSessionForGraphql = (authConfig) => {
-  return (req, res, next) => {
-    if (authConfig.mode === "open" || isAuthenticatedRequest(req)) {
-      next();
+  return (request, reply, done) => {
+    if (authConfig.mode === "open" || isAuthenticatedRequest(request)) {
+      done();
       return;
     }
-    res.status(401).set(JSON_HEADERS).json(buildUnauthorizedGraphqlPayload()).end();
+    void reply.code(401).headers(JSON_HEADERS).send(buildUnauthorizedGraphqlPayload());
   };
 };
 const createMutationAuthValidationRule = () => {
@@ -94,11 +75,13 @@ const createMutationAuthValidationRule = () => {
   };
 };
 export {
+  buildLoginCsrfRedirectPath,
   createCsrfProtection,
-  createLoginCsrfFailureHandler,
   createMutationAuthValidationRule,
-  createSessionMiddleware,
   isAuthenticatedRequest,
+  isCsrfTokenError,
+  issueCsrfToken,
   requireSessionForGraphql,
-  requireSessionForWrite
+  requireSessionForWrite,
+  shouldRedirectLoginCsrfFailure
 };

package/server/dist/modules/blocknote.js

@@ -83,10 +83,12 @@ function mapBlockContent(content, mapInline) {
     ...content,
     rows: content.rows?.map((row) => ({
       ...row,
-      cells: row.cells?.map((cell) => ({
-        ...cell,
-        content: cell.content?.map(mapInline)
-      }))
+      cells: row.cells?.map(
+        (cell) => Array.isArray(cell) ? cell.map(mapInline) : {
+          ...cell,
+          content: cell.content?.map(mapInline)
+        }
+      )
     }))
   };
 }
@@ -103,10 +105,15 @@ async function mapBlockContentAsync(content, mapInline) {
       (content.rows ?? []).map(async (row) => ({
         ...row,
         cells: await Promise.all(
-          (row.cells ?? []).map(async (cell) => ({
-            ...cell,
-            content: cell.content ? (await Promise.all(cell.content.map(mapInline))).flat() : cell.content
-          }))
+          (row.cells ?? []).map(async (cell) => {
+            if (Array.isArray(cell)) {
+              return (await Promise.all(cell.map(mapInline))).flat();
+            }
+            return {
+              ...cell,
+              content: cell.content ? (await Promise.all(cell.content.map(mapInline))).flat() : cell.content
+            };
+          })
         )
       }))
     )
@@ -124,7 +131,7 @@ function visitBlockContent(content, visitInline) {
   }
   for (const row of content.rows ?? []) {
     for (const cell of row.cells ?? []) {
-      for (const inline of cell.content ?? []) {
+      for (const inline of Array.isArray(cell) ? cell : cell.content ?? []) {
         visitInline(inline);
       }
     }

package/server/dist/modules/error-handler.js

@@ -1,3 +1,4 @@
+import { buildLoginCsrfRedirectPath, isCsrfTokenError, shouldRedirectLoginCsrfFailure } from "./auth-guard.js";
 class AppError extends Error {
   code;
   status;
@@ -13,42 +14,38 @@ class AppError extends Error {
 const createAppError = (status, code, message, details) => {
   return new AppError(status, code, message, details);
 };
-const hasErrorType = (error, type) => error instanceof Error && "type" in error && error.type === type;
-const createErrorHandler = () => {
-  return (error, _req, res, next) => {
-    if (res.headersSent) {
-      next(error);
+const createErrorHandler = (authConfig) => {
+  return (error, request, reply) => {
+    if (reply.sent) {
+      request.log.error({ error }, "Error occurred after the response was sent");
+      return;
+    }
+    if (shouldRedirectLoginCsrfFailure(error, request, authConfig)) {
+      void reply.redirect(buildLoginCsrfRedirectPath(request), 303);
       return;
     }
     if (error instanceof AppError) {
-      res.status(error.status).json({
+      void reply.status(error.status).send({
         code: error.code,
         message: error.message,
         ...error.details ? { details: error.details } : {}
-      }).end();
-      return;
-    }
-    if (hasErrorType(error, "encoding.unsupported")) {
-      res.status(415).json({
-        code: "UNSUPPORTED_CONTENT_ENCODING",
-        message: "Compressed request bodies are not supported."
-      }).end();
+      });
       return;
     }
-    if (error instanceof Error && error.message.startsWith("CSRF token ")) {
-      res.status(403).json({
+    if (isCsrfTokenError(error)) {
+      void reply.status(403).send({
         code: "CSRF_TOKEN_INVALID",
-        message: error.message
-      }).end();
+        message: error instanceof Error ? error.message : "Invalid CSRF token"
+      });
       return;
     }
     const message = error instanceof Error ? error.stack || error.message : String(error);
     process.stderr.write(`[error] ${message}
 `);
-    res.status(500).json({
+    void reply.status(500).send({
       code: "INTERNAL_SERVER_ERROR",
       message: "Internal Server Error"
-    }).end();
+    });
   };
 };
 export {

package/server/dist/modules/mcp-auth.js

@@ -44,64 +44,58 @@ const readBearerToken = (authorizationHeader) => {
   return authorizationHeader.slice("Bearer ".length).trim() || void 0;
 };
 const createMcpAuthMiddleware = (_authConfig, mcpAdminAuth) => {
-  return async (req, res, next) => {
-    try {
-      const status = await mcpAdminAuth.getStatus();
-      if (!status.enabled) {
-        res.status(403).set(JSON_HEADERS).json({
-          code: "MCP_DISABLED",
-          message: "MCP access is disabled by admin."
-        }).end();
-        return;
-      }
-      const bearerToken = readBearerToken(req.headers.authorization);
-      if (!bearerToken) {
-        res.status(401).set(JSON_HEADERS).json({
-          code: "UNAUTHORIZED",
-          message: "A valid MCP bearer token is required."
-        }).end();
-        return;
-      }
-      const validation = await mcpAdminAuth.validatePresentedToken(bearerToken);
-      if (!validation.ok && validation.reason === "not_configured") {
-        res.status(503).set(JSON_HEADERS).json({
-          code: "MCP_AUTH_NOT_CONFIGURED",
-          message: "MCP bearer auth is not configured."
-        }).end();
-        return;
-      }
-      if (!validation.ok) {
-        res.status(403).set(JSON_HEADERS).json({
-          code: "FORBIDDEN",
-          message: "Invalid MCP bearer token."
-        }).end();
-        return;
-      }
-      const versionInfo = getOceanBrainVersionInfo();
-      const mcpCompatibilityVersion = readMcpCompatibilityVersion(req);
-      const mcpClientVersion = readMcpClientVersion(req);
-      if (!mcpCompatibilityVersion || !isMcpVersionCompatible(versionInfo.mcp.compatibilityVersion, mcpCompatibilityVersion)) {
-        res.status(426).set(JSON_HEADERS).json({
-          code: "MCP_VERSION_INCOMPATIBLE",
-          message: createMcpVersionCompatibilityMessage({
-            serverVersion: versionInfo.version,
-            requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,
-            mcpCompatibilityVersion,
-            mcpClientVersion
-          }),
+  return async (req, reply) => {
+    const status = await mcpAdminAuth.getStatus();
+    if (!status.enabled) {
+      await reply.status(403).headers(JSON_HEADERS).send({
+        code: "MCP_DISABLED",
+        message: "MCP access is disabled by admin."
+      });
+      return;
+    }
+    const bearerToken = readBearerToken(req.headers.authorization);
+    if (!bearerToken) {
+      await reply.status(401).headers(JSON_HEADERS).send({
+        code: "UNAUTHORIZED",
+        message: "A valid MCP bearer token is required."
+      });
+      return;
+    }
+    const validation = await mcpAdminAuth.validatePresentedToken(bearerToken);
+    if (!validation.ok && validation.reason === "not_configured") {
+      await reply.status(503).headers(JSON_HEADERS).send({
+        code: "MCP_AUTH_NOT_CONFIGURED",
+        message: "MCP bearer auth is not configured."
+      });
+      return;
+    }
+    if (!validation.ok) {
+      await reply.status(403).headers(JSON_HEADERS).send({
+        code: "FORBIDDEN",
+        message: "Invalid MCP bearer token."
+      });
+      return;
+    }
+    const versionInfo = getOceanBrainVersionInfo();
+    const mcpCompatibilityVersion = readMcpCompatibilityVersion(req);
+    const mcpClientVersion = readMcpClientVersion(req);
+    if (!mcpCompatibilityVersion || !isMcpVersionCompatible(versionInfo.mcp.compatibilityVersion, mcpCompatibilityVersion)) {
+      await reply.status(426).headers(JSON_HEADERS).send({
+        code: "MCP_VERSION_INCOMPATIBLE",
+        message: createMcpVersionCompatibilityMessage({
           serverVersion: versionInfo.version,
-          mcpVersion: mcpClientVersion ?? mcpCompatibilityVersion ?? null,
-          mcpClientVersion: mcpClientVersion ?? null,
-          mcpCompatibilityVersion: mcpCompatibilityVersion ?? null,
-          requiredMcpVersion: versionInfo.mcpVersionRequirement,
           requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,
-          releaseUrl: versionInfo.releaseUrl
-        }).end();
-        return;
-      }
-      next();
-    } catch (error) {
-      next(error);
+          mcpCompatibilityVersion,
+          mcpClientVersion
+        }),
+        serverVersion: versionInfo.version,
+        mcpVersion: mcpClientVersion ?? mcpCompatibilityVersion ?? null,
+        mcpClientVersion: mcpClientVersion ?? null,
+        mcpCompatibilityVersion: mcpCompatibilityVersion ?? null,
+        requiredMcpVersion: versionInfo.mcpVersionRequirement,
+        requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,
+        releaseUrl: versionInfo.releaseUrl
+      });
     }
   };
 };