@cyanmycelium/mcp-broker 0.4.0 → 1.2.0

package/dist/bin.js

@@ -1,77 +1,15 @@
 #!/usr/bin/env node
-/**
- * Standalone entry-point that starts the mcp-broker WebSocket server.
- *
- * ## Configuration sources (highest priority first)
- *
- * 1. Environment variables (`MCP_BROKER_*`).
- * 2. JSON config file. Resolved in order:
- *    a. `MCP_BROKER_CONFIG` env var.
- *    b. `./.mcp-broker/config.json` in the current working directory.
- *    c. `./mcp-broker.config.json` (legacy, with a deprecation warning).
- * 3. Built-in defaults.
- *
- * ## Path resolution
- *
- * - Env-var paths (`MCP_BROKER_*_DIR`, `MCP_BROKER_TLS_*`) are resolved
- *   against `process.cwd()`.
- * - Config-file paths (`tls.cert`, `www.mounts[*].dir`, `stdioUpstreams[*]`,
- *   `mcpbBundles[*]`) are resolved against the **config file's directory** — so a config in
- *   `./.mcp-broker/config.json` referring to `"certs/cert.pem"` points at
- *   `./.mcp-broker/certs/cert.pem`. The folder is self-contained.
- *
- * ## Local grammar overrides
- *
- * When `.mcp-broker/grammars/<userAgent>/<locale>.json` files exist next to
- * the config file, they are merged **on top of** the packaged grammars. Lets
- * users customize tool/resource descriptions for their organization without
- * forking the package.
- *
- * ## Environment variables
- *
- * | Variable                       | Default  | Notes                                                  |
- * |--------------------------------|----------|--------------------------------------------------------|
- * | MCP_BROKER_CONFIG              | (none)   | Path to a JSON config file (see above).                |
- * | MCP_BROKER_PORT                | 3000     |                                                        |
- * | MCP_BROKER_HOST                | 0.0.0.0  |                                                        |
- * | MCP_BROKER_PROVIDER_PATH       | /provider| Prefix for provider WS                                 |
- * | MCP_BROKER_CLIENT_PATH         | /        | Prefix for raw WS clients                              |
- * | MCP_BROKER_MCP_PATH            | /mcp     | Suffix for Streamable HTTP transport                   |
- * | MCP_BROKER_WWW_DIR             | (none)   | Ergonomic shortcut: mount this directory at "/"        |
- * | MCP_BROKER_BUNDLE_DIR          | (none)   | Ergonomic shortcut: mount this directory at "/bundle"  |
- * | MCP_BROKER_OPEN                | (unset)  | "1" to auto-launch the default browser at the root URL |
- * | MCP_BROKER_TLS_CERT            | (none)   | Path to a PEM TLS certificate                          |
- * | MCP_BROKER_TLS_KEY             | (none)   | Path to a PEM private key                              |
- * | MCP_BROKER_PROTOCOL            | auto     | "http" to force plain, "https" to force TLS, otherwise |
- * |                                |          | TLS is enabled iff cert+key are both set               |
- * | MCP_BROKER_STDIO_PROVIDER      | (none)   | When set, stdin/stdout carry JSON-RPC for the named    |
- * |                                |          | provider (Claude Desktop bridge).                      |
- * | MCP_BROKER_LOCALE              | en       | Locale used for tool descriptions on the `_broker`     |
- * |                                |          | slot. ISO 639-1 base; regional variants accepted.      |
- */
-import * as fs from "fs";
-import * as path from "path";
-import open from "open";
-import { WsTunnelBuilder } from "./index.js";
-import { loadBrokerConfig } from "./config.js";
-import { loadMcpbBundle } from "./mcpb.loader.js";
-// ---------------------------------------------------------------------------
-// Configuration
-// ---------------------------------------------------------------------------
-const { config, baseDir } = loadBrokerConfig();
-const cwd = process.cwd();
-/**
- * Fills an env var from the config file when the env var is not already set.
- * Used for **non-path** scalars — path-bearing fields are read directly so
- * they can be resolved against `baseDir` (config file's directory) instead
- * of `cwd` (deploy environment).
- */
+import { loadBrokerConfig, WsTunnelBuilder, loadMcpbBundle } from './chunk-FTDKH2C4.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import open from 'open';
+
+var { config, baseDir } = loadBrokerConfig();
+var cwd = process.cwd();
 function envFromConfig(envName, configValue) {
-    if (configValue === undefined || configValue === null)
-        return;
-    if (process.env[envName] !== undefined && process.env[envName] !== "")
-        return;
-    process.env[envName] = String(configValue);
+  if (configValue === void 0 || configValue === null) return;
+  if (process.env[envName] !== void 0 && process.env[envName] !== "") return;
+  process.env[envName] = String(configValue);
 }
 envFromConfig("MCP_BROKER_PORT", config.port);
 envFromConfig("MCP_BROKER_HOST", config.host);
@@ -81,155 +19,189 @@ envFromConfig("MCP_BROKER_STDIO_PROVIDER", config.stdioProvider);
 envFromConfig("MCP_BROKER_PROVIDER_PATH", config.paths?.provider);
 envFromConfig("MCP_BROKER_CLIENT_PATH", config.paths?.client);
 envFromConfig("MCP_BROKER_MCP_PATH", config.paths?.mcp);
-envFromConfig("MCP_BROKER_OPEN", config.www?.open === true ? "1" : undefined);
-const stdioProvider = process.env["MCP_BROKER_STDIO_PROVIDER"];
-// In stdio mode stdout is reserved for JSON-RPC — redirect all console output to stderr.
+envFromConfig("MCP_BROKER_OPEN", config.www?.open === true ? "1" : void 0);
+envFromConfig("MCP_BROKER_AUTH_ENABLED", config.auth?.enabled === true ? "1" : void 0);
+envFromConfig("MCP_BROKER_PUBLIC_BASE_URL", config.auth?.publicBaseUrl);
+envFromConfig("MCP_BROKER_JWKS", config.auth?.jwks);
+envFromConfig("MCP_BROKER_ISSUER", config.auth?.issuer);
+envFromConfig("MCP_BROKER_PROVIDER_SECRET", config.auth?.providerSecret);
+var stdioProvider = process.env["MCP_BROKER_STDIO_PROVIDER"];
 if (stdioProvider) {
-    const toStderr = (...args) => process.stderr.write(args.join(" ") + "\n");
-    console.log = toStderr;
-    console.info = toStderr;
-    console.warn = toStderr;
-    console.error = toStderr;
+  const toStderr = (...args) => process.stderr.write(args.join(" ") + "\n");
+  console.log = toStderr;
+  console.info = toStderr;
+  console.warn = toStderr;
+  console.error = toStderr;
 }
-const port = parseInt(process.env["MCP_BROKER_PORT"] ?? "3000", 10);
-const host = process.env["MCP_BROKER_HOST"];
-const providerPath = process.env["MCP_BROKER_PROVIDER_PATH"] ?? "/provider";
-const clientPath = process.env["MCP_BROKER_CLIENT_PATH"] ?? "/";
-const mcpPath = process.env["MCP_BROKER_MCP_PATH"] ?? "/mcp";
-const ssePath = config.paths?.sse ?? "/sse";
-// ── TLS material ─────────────────────────────────────────────────────────────
-// Env var (relative to cwd) wins over config (relative to baseDir).
-const tlsCertPath = process.env["MCP_BROKER_TLS_CERT"] ? path.resolve(cwd, process.env["MCP_BROKER_TLS_CERT"]) : config.tls?.cert ? path.resolve(baseDir, config.tls.cert) : null;
-const tlsKeyPath = process.env["MCP_BROKER_TLS_KEY"] ? path.resolve(cwd, process.env["MCP_BROKER_TLS_KEY"]) : config.tls?.key ? path.resolve(baseDir, config.tls.key) : null;
-const protocolOverride = process.env["MCP_BROKER_PROTOCOL"]?.toLowerCase();
-if (protocolOverride !== undefined && protocolOverride !== "http" && protocolOverride !== "https") {
-    console.error(`[mcp-broker] Invalid MCP_BROKER_PROTOCOL="${protocolOverride}". Use "http" or "https".`);
-    process.exit(1);
+var port = parseInt(process.env["MCP_BROKER_PORT"] ?? "3000", 10);
+var host = process.env["MCP_BROKER_HOST"];
+var providerPath = process.env["MCP_BROKER_PROVIDER_PATH"] ?? "/provider";
+var clientPath = process.env["MCP_BROKER_CLIENT_PATH"] ?? "/";
+var mcpPath = process.env["MCP_BROKER_MCP_PATH"] ?? "/mcp";
+var ssePath = config.paths?.sse ?? "/sse";
+var tlsCertPath = process.env["MCP_BROKER_TLS_CERT"] ? path.resolve(cwd, process.env["MCP_BROKER_TLS_CERT"]) : config.tls?.cert ? path.resolve(baseDir, config.tls.cert) : null;
+var tlsKeyPath = process.env["MCP_BROKER_TLS_KEY"] ? path.resolve(cwd, process.env["MCP_BROKER_TLS_KEY"]) : config.tls?.key ? path.resolve(baseDir, config.tls.key) : null;
+var protocolOverride = process.env["MCP_BROKER_PROTOCOL"]?.toLowerCase();
+if (protocolOverride !== void 0 && protocolOverride !== "http" && protocolOverride !== "https") {
+  console.error(`[mcp-broker] Invalid MCP_BROKER_PROTOCOL="${protocolOverride}". Use "http" or "https".`);
+  process.exit(1);
 }
 if (protocolOverride === "https" && (!tlsCertPath || !tlsKeyPath)) {
-    console.error("[mcp-broker] MCP_BROKER_PROTOCOL=https requires TLS cert+key (via config.tls or MCP_BROKER_TLS_CERT/KEY).");
-    process.exit(1);
+  console.error("[mcp-broker] MCP_BROKER_PROTOCOL=https requires TLS cert+key (via config.tls or MCP_BROKER_TLS_CERT/KEY).");
+  process.exit(1);
 }
-const useTls = protocolOverride === "http" ? false : protocolOverride === "https" ? true : !!(tlsCertPath && tlsKeyPath);
-// ── Env-var static mount shortcuts (relative to cwd) ─────────────────────────
-const envWwwDir = process.env["MCP_BROKER_WWW_DIR"] ? path.resolve(cwd, process.env["MCP_BROKER_WWW_DIR"]) : null;
-const envBundleDir = process.env["MCP_BROKER_BUNDLE_DIR"] ? path.resolve(cwd, process.env["MCP_BROKER_BUNDLE_DIR"]) : null;
-// ---------------------------------------------------------------------------
-// Server bootstrap
-// ---------------------------------------------------------------------------
+var useTls = protocolOverride === "http" ? false : protocolOverride === "https" ? true : !!(tlsCertPath && tlsKeyPath);
+var envOrigins = process.env["MCP_BROKER_ALLOWED_ORIGINS"]?.split(",").map((origin) => origin.trim()).filter(Boolean);
+var allowedOrigins;
+if (envOrigins?.length) {
+  allowedOrigins = envOrigins;
+} else if (Array.isArray(config.allowedOrigins)) {
+  allowedOrigins = config.allowedOrigins;
+} else if (config.allowedOrigins) {
+  try {
+    allowedOrigins = new RegExp(config.allowedOrigins.pattern, config.allowedOrigins.flags);
+  } catch (err) {
+    console.error(`[mcp-broker] Ignoring allowedOrigins.pattern: ${err.message}`);
+  }
+}
+var envWwwDir = process.env["MCP_BROKER_WWW_DIR"] ? path.resolve(cwd, process.env["MCP_BROKER_WWW_DIR"]) : null;
+var envBundleDir = process.env["MCP_BROKER_BUNDLE_DIR"] ? path.resolve(cwd, process.env["MCP_BROKER_BUNDLE_DIR"]) : null;
 async function main() {
-    // Local grammar overrides: when `<baseDir>/grammars/` exists, the broker
-    // server merges those JSON files on top of the packaged grammars.
-    const localGrammarsDir = path.join(baseDir, "grammars");
-    const hasLocalGrammars = fs.existsSync(localGrammarsDir);
-    const builder = new WsTunnelBuilder().withPort(port).withProviderPath(providerPath).withClientPath(clientPath).withMcpPath(mcpPath);
-    if (host) {
-        builder.withHost(host);
-    }
-    if (useTls) {
-        builder.withTlsFiles(tlsCertPath, tlsKeyPath);
-    }
-    // ── Static mounts ────────────────────────────────────────────────────────
-    // First the env-var shortcuts (relative to cwd), then the config `www.mounts`
-    // (relative to baseDir). Order matters: /bundle before / so the prefix router
-    // can distinguish them. Subsequent registrations contribute additional mounts;
-    // longest-prefix match wins at runtime.
-    if (envBundleDir && fs.existsSync(envBundleDir)) {
-        builder.withStaticMount("/bundle", envBundleDir);
-    }
-    if (envWwwDir && fs.existsSync(envWwwDir)) {
-        builder.withStaticMount("/", envWwwDir);
-    }
-    if (config.www?.mounts) {
-        for (const mount of config.www.mounts) {
-            const abs = path.resolve(baseDir, mount.dir);
-            if (fs.existsSync(abs)) {
-                builder.withStaticMount(mount.urlPrefix, abs);
-            }
-            else {
-                console.warn(`[mcp-broker] www.mounts entry "${mount.urlPrefix}" → ${abs} skipped (directory not found).`);
-            }
-        }
+  const localGrammarsDir = path.join(baseDir, "grammars");
+  const hasLocalGrammars = fs.existsSync(localGrammarsDir);
+  const builder = new WsTunnelBuilder().withPort(port).withProviderPath(providerPath).withClientPath(clientPath).withMcpPath(mcpPath);
+  if (host) {
+    builder.withHost(host);
+  }
+  if (useTls) {
+    builder.withTlsFiles(tlsCertPath, tlsKeyPath);
+  }
+  if (allowedOrigins) {
+    builder.withAllowedOrigins(allowedOrigins);
+  }
+  if (envBundleDir && fs.existsSync(envBundleDir)) {
+    builder.withStaticMount("/bundle", envBundleDir);
+  }
+  if (envWwwDir && fs.existsSync(envWwwDir)) {
+    builder.withStaticMount("/", envWwwDir);
+  }
+  if (config.www?.mounts) {
+    for (const mount of config.www.mounts) {
+      const abs = path.resolve(baseDir, mount.dir);
+      if (fs.existsSync(abs)) {
+        builder.withStaticMount(mount.urlPrefix, abs);
+      } else {
+        console.warn(`[mcp-broker] www.mounts entry "${mount.urlPrefix}" \u2192 ${abs} skipped (directory not found).`);
+      }
     }
-    // ── Stdio upstreams ──────────────────────────────────────────────────────
-    if (config.stdioUpstreams) {
-        for (const u of config.stdioUpstreams) {
-            builder.withStdioUpstream({
-                name: u.name,
-                command: u.command,
-                args: u.args,
-                env: u.env,
-                aggregate: u.aggregate,
-            });
-        }
+  }
+  if (config.stdioUpstreams) {
+    for (const u of config.stdioUpstreams) {
+      builder.withStdioUpstream({
+        name: u.name,
+        command: u.command,
+        args: u.args,
+        env: u.env,
+        aggregate: u.aggregate
+      });
     }
-    // ── Remote MCP server upstreams (reached by URL) ─────────────────────────
-    // Config-discovered remote servers join the `_all` aggregate by default;
-    // an explicit `aggregate: false` opts an entry out.
-    if (config.mcpServers) {
-        for (const s of config.mcpServers) {
-            builder.withRemoteUpstream({ ...s, aggregate: s.aggregate ?? true });
-        }
+  }
+  if (config.mcpServers) {
+    for (const s of config.mcpServers) {
+      builder.withRemoteUpstream({ ...s, aggregate: s.aggregate ?? true });
     }
-    // ── Local `.mcpb` bundles ────────────────────────────────────────────────
-    // Each bundle is signature-verified and unpacked before it is wired in as a
-    // stdio upstream. A refused bundle is skipped (loadMcpbBundle logs why); it
-    // never spawns a process. Bundles join `_all` by default (opt-out per entry).
-    if (config.mcpbBundles) {
-        for (const b of config.mcpbBundles) {
-            const upstream = await loadMcpbBundle(b, baseDir);
-            if (upstream) {
-                builder.withStdioUpstream(upstream);
-            }
-        }
+  }
+  if (config.mcpbBundles) {
+    for (const b of config.mcpbBundles) {
+      const upstream = await loadMcpbBundle(b, baseDir);
+      if (upstream) {
+        builder.withStdioUpstream(upstream);
+      }
     }
-    if (stdioProvider) {
-        builder.withStdioClient(stdioProvider);
+  }
+  if (stdioProvider) {
+    builder.withStdioClient(stdioProvider);
+  }
+  if (hasLocalGrammars) {
+    builder.withBrokerLocalGrammarsDir(localGrammarsDir);
+  }
+  const authEnabledEnv = process.env["MCP_BROKER_AUTH_ENABLED"];
+  const authEnabled = authEnabledEnv === "1" || authEnabledEnv === "true";
+  if (authEnabled) {
+    const publicBaseUrl = process.env["MCP_BROKER_PUBLIC_BASE_URL"];
+    const jwks = process.env["MCP_BROKER_JWKS"];
+    const issuer = process.env["MCP_BROKER_ISSUER"];
+    const authorizationServers = config.auth?.authorizationServers ?? (issuer ? [issuer] : []);
+    if (!publicBaseUrl || !jwks || authorizationServers.length === 0) {
+      console.error(
+        "[mcp-broker] auth.enabled requires publicBaseUrl, jwks, and at least one authorizationServers entry (or issuer). Set them via config.auth or MCP_BROKER_PUBLIC_BASE_URL / MCP_BROKER_JWKS / MCP_BROKER_ISSUER."
+      );
+      process.exit(1);
     }
-    if (hasLocalGrammars) {
-        builder.withBrokerLocalGrammarsDir(localGrammarsDir);
-    }
-    const tunnel = builder.build();
-    await tunnel.start();
-    // ── Startup banner ──────────────────────────────────────────────────────
-    const httpScheme = useTls ? "https" : "http";
-    const wsScheme = useTls ? "wss" : "ws";
-    const hr = "─".repeat(64);
-    const localhost = `${httpScheme}://localhost:${port}`;
-    const mcpSuffix = mcpPath.replace(/^\//, "");
-    const sseSuffix = ssePath.replace(/^\//, "");
-    const hasWwwRoot = !!(envWwwDir && fs.existsSync(envWwwDir)) || (config.www?.mounts ?? []).some((m) => m.urlPrefix === "/");
-    console.log();
-    console.log(`⚙️  mcp-broker started${useTls ? " (TLS)" : ""}`);
-    console.log(hr);
-    console.log(`📡  Provider WebSocket    ${wsScheme}://localhost:${port}${providerPath}/<name>`);
-    console.log(`🔌  MCP (Streamable HTTP) ${localhost}/<name>/${mcpSuffix}`);
-    console.log(`📺  Legacy SSE            ${localhost}/<name>/${sseSuffix}`);
-    if (hasLocalGrammars) {
-        console.log(`🌐  Local grammars        ${localGrammarsDir}`);
-    }
-    console.log(hr);
-    console.log(`   Press Ctrl+C to stop.`);
+    builder.withJwtAuth({
+      publicBaseUrl,
+      authorizationServers,
+      jwksUri: jwks,
+      issuer,
+      scopesSupported: config.auth?.scopesSupported,
+      requiredScopes: config.auth?.requiredScopes,
+      perSlotScopes: config.auth?.perSlotScopes,
+      providerScopes: config.auth?.providerScopes,
+      subjectMapping: config.auth?.subjectMapping,
+      roles: config.auth?.roles,
+      assignments: config.auth?.assignments,
+      denies: config.auth?.denies,
+      slotResources: config.auth?.slotResources,
+      toolCapabilities: config.auth?.toolCapabilities,
+      providerToolCapabilities: config.auth?.providerToolCapabilities,
+      audit: config.auth?.audit
+    });
+  }
+  const providerSecret = process.env["MCP_BROKER_PROVIDER_SECRET"];
+  if (providerSecret) {
+    builder.withProviderSecret(providerSecret);
+  }
+  const tunnel = builder.build();
+  await tunnel.start();
+  const httpScheme = useTls ? "https" : "http";
+  const wsScheme = useTls ? "wss" : "ws";
+  const hr = "\u2500".repeat(64);
+  const localhost = `${httpScheme}://localhost:${port}`;
+  const mcpSuffix = mcpPath.replace(/^\//, "");
+  const sseSuffix = ssePath.replace(/^\//, "");
+  const hasWwwRoot = !!(envWwwDir && fs.existsSync(envWwwDir)) || (config.www?.mounts ?? []).some((m) => m.urlPrefix === "/");
+  console.log();
+  console.log(`\u2699\uFE0F  mcp-broker started${useTls ? " (TLS)" : ""}`);
+  console.log(hr);
+  console.log(`\u{1F4E1}  Provider WebSocket    ${wsScheme}://localhost:${port}${providerPath}/<name>`);
+  console.log(`\u{1F50C}  MCP (Streamable HTTP) ${localhost}/<name>/${mcpSuffix}`);
+  console.log(`\u{1F4FA}  Legacy SSE            ${localhost}/<name>/${sseSuffix}`);
+  if (hasLocalGrammars) {
+    console.log(`\u{1F310}  Local grammars        ${localGrammarsDir}`);
+  }
+  console.log(`\u{1F510}  Authorization         ${authEnabled ? "OAuth 2.1 (Bearer required)" : "disabled (trusted network only)"}`);
+  console.log(`\u{1F6E1}\uFE0F   Provider auth         ${providerSecret ? "shared secret required" : "disabled"}`);
+  console.log(hr);
+  console.log(`   Press Ctrl+C to stop.`);
+  console.log();
+  if (hasWwwRoot && process.env["MCP_BROKER_OPEN"] === "1") {
+    const url = `${localhost}/`;
+    console.log(`\u{1F680}  Opening browser: ${url}`);
     console.log();
-    // Auto-launch browser only if explicitly opted in via MCP_BROKER_OPEN=1
-    // AND a mount at "/" is configured.
-    if (hasWwwRoot && process.env["MCP_BROKER_OPEN"] === "1") {
-        const url = `${localhost}/`;
-        console.log(`🚀  Opening browser: ${url}`);
-        console.log();
-        await open(url);
-    }
-    // ── Signal handlers ─────────────────────────────────────────────────────
-    const shutdown = async (signal) => {
-        console.log(`\n⛔  ${signal} received — shutting down…`);
-        await tunnel.stop();
-        process.exit(0);
-    };
-    process.on("SIGINT", () => void shutdown("SIGINT"));
-    process.on("SIGTERM", () => void shutdown("SIGTERM"));
+    await open(url);
+  }
+  const shutdown = async (signal) => {
+    console.log(`
+\u26D4  ${signal} received, shutting down\u2026`);
+    await tunnel.stop();
+    process.exit(0);
+  };
+  process.on("SIGINT", () => void shutdown("SIGINT"));
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
 }
 main().catch((err) => {
-    console.error("[mcp-broker] Fatal error:", err);
-    process.exit(1);
+  console.error("[mcp-broker] Fatal error:", err);
+  process.exit(1);
 });
+//# sourceMappingURL=bin.js.map
 //# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,gBAAgB,EAAE,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAE1B;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,WAAkD;IACtF,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO;IAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE;QAAE,OAAO;IAC9E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC9C,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC9C,aAAa,CAAC,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACtD,aAAa,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;AAClD,aAAa,CAAC,2BAA2B,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;AACjE,aAAa,CAAC,0BAA0B,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAClE,aAAa,CAAC,wBAAwB,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9D,aAAa,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxD,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE9E,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;AAE/D,yFAAyF;AACzF,IAAI,aAAa,EAAE,CAAC;IAChB,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,GAAG,QAAQ,CAAC;IACvB,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC;IACxB,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC;IACxB,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;AAC7B,CAAC;AAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AACpE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,WAAW,CAAC;AAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,GAAG,CAAC;AAChE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,MAAM,CAAC;AAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,MAAM,CAAC;AAE5C,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClL,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAE7K,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,CAAC;AAC3E,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,MAAM,IAAI,gBAAgB,KAAK,OAAO,EAAE,CAAC;IAChG,OAAO,CAAC,KAAK,CAAC,6CAA6C,gBAAgB,2BAA2B,CAAC,CAAC;IACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AACD,IAAI,gBAAgB,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;IAChE,OAAO,CAAC,KAAK,CAAC,2GAA2G,CAAC,CAAC;IAC3H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,MAAM,GAAG,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,UAAU,CAAC,CAAC;AAEzH,gFAAgF;AAChF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClH,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAE3H,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,KAAK,UAAU,IAAI;IACf,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAEpI,IAAI,IAAI,EAAE,CAAC;QACP,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACT,OAAO,CAAC,YAAY,CAAC,WAAY,EAAE,UAAW,CAAC,CAAC;IACpD,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,wCAAwC;IACxC,IAAI,YAAY,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;QACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACJ,OAAO,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,SAAS,OAAO,GAAG,iCAAiC,CAAC,CAAC;YAC/G,CAAC;QACL,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACpC,OAAO,CAAC,iBAAiB,CAAC;gBACtB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,EAAE,CAAC,CAAC,GAAoC;gBAC3C,SAAS,EAAE,CAAC,CAAC,SAAS;aACzB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,oDAAoD;IACpD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACX,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACxC,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAChB,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACnB,OAAO,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAC/B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAErB,2EAA2E;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,GAAG,UAAU,gBAAgB,IAAI,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC;IAE5H,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,6BAA6B,QAAQ,gBAAgB,IAAI,GAAG,YAAY,SAAS,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,6BAA6B,SAAS,WAAW,SAAS,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,6BAA6B,SAAS,WAAW,SAAS,EAAE,CAAC,CAAC;IAC1E,IAAI,gBAAgB,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,6BAA6B,gBAAgB,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,GAAG,SAAS,GAAG,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACrD,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,4BAA4B,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC1B,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC"}
+{"version":3,"sources":["../src/bin.ts"],"names":[],"mappings":";;;;;;AAgEA,IAAM,EAAE,MAAA,EAAQ,OAAA,EAAQ,GAAI,gBAAA,EAAiB;AAC7C,IAAM,GAAA,GAAM,QAAQ,GAAA,EAAI;AAQxB,SAAS,aAAA,CAAc,SAAiB,WAAA,EAA0D;AAC9F,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,WAAA,KAAgB,IAAA,EAAM;AACvD,EAAA,IAAI,OAAA,CAAQ,IAAI,OAAO,CAAA,KAAM,UAAa,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,KAAM,EAAA,EAAI;AACvE,EAAA,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,GAAI,MAAA,CAAO,WAAW,CAAA;AAC7C;AAEA,aAAA,CAAc,iBAAA,EAAmB,OAAO,IAAI,CAAA;AAC5C,aAAA,CAAc,iBAAA,EAAmB,OAAO,IAAI,CAAA;AAC5C,aAAA,CAAc,qBAAA,EAAuB,OAAO,QAAQ,CAAA;AACpD,aAAA,CAAc,mBAAA,EAAqB,OAAO,MAAM,CAAA;AAChD,aAAA,CAAc,2BAAA,EAA6B,OAAO,aAAa,CAAA;AAC/D,aAAA,CAAc,0BAAA,EAA4B,MAAA,CAAO,KAAA,EAAO,QAAQ,CAAA;AAChE,aAAA,CAAc,wBAAA,EAA0B,MAAA,CAAO,KAAA,EAAO,MAAM,CAAA;AAC5D,aAAA,CAAc,qBAAA,EAAuB,MAAA,CAAO,KAAA,EAAO,GAAG,CAAA;AACtD,aAAA,CAAc,mBAAmB,MAAA,CAAO,GAAA,EAAK,IAAA,KAAS,IAAA,GAAO,MAAM,MAAS,CAAA;AAC5E,aAAA,CAAc,2BAA2B,MAAA,CAAO,IAAA,EAAM,OAAA,KAAY,IAAA,GAAO,MAAM,MAAS,CAAA;AACxF,aAAA,CAAc,4BAAA,EAA8B,MAAA,CAAO,IAAA,EAAM,aAAa,CAAA;AACtE,aAAA,CAAc,iBAAA,EAAmB,MAAA,CAAO,IAAA,EAAM,IAAI,CAAA;AAClD,aAAA,CAAc,mBAAA,EAAqB,MAAA,CAAO,IAAA,EAAM,MAAM,CAAA;AACtD,aAAA,CAAc,4BAAA,EAA8B,MAAA,CAAO,IAAA,EAAM,cAAc,CAAA;AAEvE,IAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,2BAA2B,CAAA;AAG7D,IAAI,aAAA,EAAe;AACf,EAAA,MAAM,QAAA,GAAW,CAAA,GAAI,IAAA,KAAoB,OAAA,CAAQ,MAAA,CAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,IAAI,CAAA;AACnF,EAAA,OAAA,CAAQ,GAAA,GAAM,QAAA;AACd,EAAA,OAAA,CAAQ,IAAA,GAAO,QAAA;AACf,EAAA,OAAA,CAAQ,IAAA,GAAO,QAAA;AACf,EAAA,OAAA,CAAQ,KAAA,GAAQ,QAAA;AACpB;AAEA,IAAM,OAAO,QAAA,CAAS,OAAA,CAAQ,IAAI,iBAAiB,CAAA,IAAK,QAAQ,EAAE,CAAA;AAClE,IAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AAC1C,IAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,0BAA0B,CAAA,IAAK,WAAA;AAChE,IAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,wBAAwB,CAAA,IAAK,GAAA;AAC5D,IAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,qBAAqB,CAAA,IAAK,MAAA;AACtD,IAAM,OAAA,GAAU,MAAA,CAAO,KAAA,EAAO,GAAA,IAAO,MAAA;AAIrC,IAAM,WAAA,GAAc,QAAQ,GAAA,CAAI,qBAAqB,IAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,QAAQ,GAAA,CAAI,qBAAqB,CAAC,CAAA,GAAI,MAAA,CAAO,KAAK,IAAA,GAAY,IAAA,CAAA,OAAA,CAAQ,SAAS,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA,GAAI,IAAA;AAC7K,IAAM,UAAA,GAAa,QAAQ,GAAA,CAAI,oBAAoB,IAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,QAAQ,GAAA,CAAI,oBAAoB,CAAC,CAAA,GAAI,MAAA,CAAO,KAAK,GAAA,GAAW,IAAA,CAAA,OAAA,CAAQ,SAAS,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA;AAExK,IAAM,gBAAA,GAAmB,OAAA,CAAQ,GAAA,CAAI,qBAAqB,GAAG,WAAA,EAAY;AACzE,IAAI,gBAAA,KAAqB,MAAA,IAAa,gBAAA,KAAqB,MAAA,IAAU,qBAAqB,OAAA,EAAS;AAC/F,EAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,0CAAA,EAA6C,gBAAgB,CAAA,yBAAA,CAA2B,CAAA;AACtG,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AACA,IAAI,gBAAA,KAAqB,OAAA,KAAY,CAAC,WAAA,IAAe,CAAC,UAAA,CAAA,EAAa;AAC/D,EAAA,OAAA,CAAQ,MAAM,2GAA2G,CAAA;AACzH,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AAEA,IAAM,MAAA,GAAS,qBAAqB,MAAA,GAAS,KAAA,GAAQ,qBAAqB,OAAA,GAAU,IAAA,GAAO,CAAC,EAAE,WAAA,IAAe,UAAA,CAAA;AAM7G,IAAM,aAAa,OAAA,CAAQ,GAAA,CAAI,4BAA4B,CAAA,EACrD,MAAM,GAAG,CAAA,CACV,GAAA,CAAI,CAAC,WAAW,MAAA,CAAO,IAAA,EAAM,CAAA,CAC7B,OAAO,OAAO,CAAA;AAEnB,IAAI,cAAA;AACJ,IAAI,YAAY,MAAA,EAAQ;AACpB,EAAA,cAAA,GAAiB,UAAA;AACrB,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,cAAc,CAAA,EAAG;AAC7C,EAAA,cAAA,GAAiB,MAAA,CAAO,cAAA;AAC5B,CAAA,MAAA,IAAW,OAAO,cAAA,EAAgB;AAC9B,EAAA,IAAI;AACA,IAAA,cAAA,GAAiB,IAAI,MAAA,CAAO,MAAA,CAAO,eAAe,OAAA,EAAS,MAAA,CAAO,eAAe,KAAK,CAAA;AAAA,EAC1F,SAAS,GAAA,EAAK;AAGV,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,8CAAA,EAAkD,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,EAC3F;AACJ;AAGA,IAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,oBAAoB,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,CAAI,oBAAoB,CAAC,CAAA,GAAI,IAAA;AAC7G,IAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAC,CAAA,GAAI,IAAA;AAMtH,eAAe,IAAA,GAAsB;AAGjC,EAAA,MAAM,gBAAA,GAAwB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AACtD,EAAA,MAAM,gBAAA,GAAsB,cAAW,gBAAgB,CAAA;AAEvD,EAAA,MAAM,OAAA,GAAU,IAAI,eAAA,EAAgB,CAAE,SAAS,IAAI,CAAA,CAAE,gBAAA,CAAiB,YAAY,CAAA,CAAE,cAAA,CAAe,UAAU,CAAA,CAAE,YAAY,OAAO,CAAA;AAElI,EAAA,IAAI,IAAA,EAAM;AACN,IAAA,OAAA,CAAQ,SAAS,IAAI,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,MAAA,EAAQ;AACR,IAAA,OAAA,CAAQ,YAAA,CAAa,aAAc,UAAW,CAAA;AAAA,EAClD;AAEA,EAAA,IAAI,cAAA,EAAgB;AAChB,IAAA,OAAA,CAAQ,mBAAmB,cAAc,CAAA;AAAA,EAC7C;AAOA,EAAA,IAAI,YAAA,IAAmB,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC7C,IAAA,OAAA,CAAQ,eAAA,CAAgB,WAAW,YAAY,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,SAAA,IAAgB,EAAA,CAAA,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,IAAA,OAAA,CAAQ,eAAA,CAAgB,KAAK,SAAS,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,MAAA,CAAO,KAAK,MAAA,EAAQ;AACpB,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,GAAA,CAAI,MAAA,EAAQ;AACnC,MAAA,MAAM,GAAA,GAAW,IAAA,CAAA,OAAA,CAAQ,OAAA,EAAS,KAAA,CAAM,GAAG,CAAA;AAC3C,MAAA,IAAO,EAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AACpB,QAAA,OAAA,CAAQ,eAAA,CAAgB,KAAA,CAAM,SAAA,EAAW,GAAG,CAAA;AAAA,MAChD,CAAA,MAAO;AACH,QAAA,OAAA,CAAQ,KAAK,CAAA,+BAAA,EAAkC,KAAA,CAAM,SAAS,CAAA,SAAA,EAAO,GAAG,CAAA,+BAAA,CAAiC,CAAA;AAAA,MAC7G;AAAA,IACJ;AAAA,EACJ;AAGA,EAAA,IAAI,OAAO,cAAA,EAAgB;AACvB,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,cAAA,EAAgB;AACnC,MAAA,OAAA,CAAQ,iBAAA,CAAkB;AAAA,QACtB,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,KAAK,CAAA,CAAE,GAAA;AAAA,QACP,WAAW,CAAA,CAAE;AAAA,OAChB,CAAA;AAAA,IACL;AAAA,EACJ;AAKA,EAAA,IAAI,OAAO,UAAA,EAAY;AACnB,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,UAAA,EAAY;AAC/B,MAAA,OAAA,CAAQ,kBAAA,CAAmB,EAAE,GAAG,CAAA,EAAG,WAAW,CAAA,CAAE,SAAA,IAAa,MAAM,CAAA;AAAA,IACvE;AAAA,EACJ;AAMA,EAAA,IAAI,OAAO,WAAA,EAAa;AACpB,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,WAAA,EAAa;AAChC,MAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,CAAA,EAAG,OAAO,CAAA;AAChD,MAAA,IAAI,QAAA,EAAU;AACV,QAAA,OAAA,CAAQ,kBAAkB,QAAQ,CAAA;AAAA,MACtC;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,IAAI,aAAA,EAAe;AACf,IAAA,OAAA,CAAQ,gBAAgB,aAAa,CAAA;AAAA,EACzC;AAEA,EAAA,IAAI,gBAAA,EAAkB;AAClB,IAAA,OAAA,CAAQ,2BAA2B,gBAAgB,CAAA;AAAA,EACvD;AAKA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,GAAA,CAAI,yBAAyB,CAAA;AAC5D,EAAA,MAAM,WAAA,GAAc,cAAA,KAAmB,GAAA,IAAO,cAAA,KAAmB,MAAA;AACjE,EAAA,IAAI,WAAA,EAAa;AACb,IAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,4BAA4B,CAAA;AAC9D,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AAC1C,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAC9C,IAAA,MAAM,oBAAA,GAAuB,OAAO,IAAA,EAAM,oBAAA,KAAyB,SAAS,CAAC,MAAM,IAAI,EAAC,CAAA;AACxF,IAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,IAAA,IAAQ,oBAAA,CAAqB,WAAW,CAAA,EAAG;AAC9D,MAAA,OAAA,CAAQ,KAAA;AAAA,QACJ;AAAA,OAGJ;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAClB;AACA,IAAA,OAAA,CAAQ,WAAA,CAAY;AAAA,MAChB,aAAA;AAAA,MACA,oBAAA;AAAA,MACA,OAAA,EAAS,IAAA;AAAA,MACT,MAAA;AAAA,MACA,eAAA,EAAiB,OAAO,IAAA,EAAM,eAAA;AAAA,MAC9B,cAAA,EAAgB,OAAO,IAAA,EAAM,cAAA;AAAA,MAC7B,aAAA,EAAe,OAAO,IAAA,EAAM,aAAA;AAAA,MAC5B,cAAA,EAAgB,OAAO,IAAA,EAAM,cAAA;AAAA,MAC7B,cAAA,EAAgB,OAAO,IAAA,EAAM,cAAA;AAAA,MAC7B,KAAA,EAAO,OAAO,IAAA,EAAM,KAAA;AAAA,MACpB,WAAA,EAAa,OAAO,IAAA,EAAM,WAAA;AAAA,MAC1B,MAAA,EAAQ,OAAO,IAAA,EAAM,MAAA;AAAA,MACrB,aAAA,EAAe,OAAO,IAAA,EAAM,aAAA;AAAA,MAC5B,gBAAA,EAAkB,OAAO,IAAA,EAAM,gBAAA;AAAA,MAC/B,wBAAA,EAA0B,OAAO,IAAA,EAAM,wBAAA;AAAA,MACvC,KAAA,EAAO,OAAO,IAAA,EAAM;AAAA,KACvB,CAAA;AAAA,EACL;AAKA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,GAAA,CAAI,4BAA4B,CAAA;AAC/D,EAAA,IAAI,cAAA,EAAgB;AAChB,IAAA,OAAA,CAAQ,mBAAmB,cAAc,CAAA;AAAA,EAC7C;AAEA,EAAA,MAAM,MAAA,GAAS,QAAQ,KAAA,EAAM;AAC7B,EAAA,MAAM,OAAO,KAAA,EAAM;AAGnB,EAAA,MAAM,UAAA,GAAa,SAAS,OAAA,GAAU,MAAA;AACtC,EAAA,MAAM,QAAA,GAAW,SAAS,KAAA,GAAQ,IAAA;AAClC,EAAA,MAAM,EAAA,GAAK,QAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AACxB,EAAA,MAAM,SAAA,GAAY,CAAA,EAAG,UAAU,CAAA,aAAA,EAAgB,IAAI,CAAA,CAAA;AACnD,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC3C,EAAA,MAAM,aAAa,CAAC,EAAE,SAAA,IAAgB,EAAA,CAAA,UAAA,CAAW,SAAS,CAAA,CAAA,IAAA,CAAO,MAAA,CAAO,GAAA,EAAK,MAAA,IAAU,EAAC,EAAG,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,GAAG,CAAA;AAE1H,EAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,gCAAA,EAAyB,MAAA,GAAS,QAAA,GAAW,EAAE,CAAA,CAAE,CAAA;AAC7D,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,IAAI,CAAA,iCAAA,EAA6B,QAAQ,gBAAgB,IAAI,CAAA,EAAG,YAAY,CAAA,OAAA,CAAS,CAAA;AAC7F,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,SAAS,CAAA,QAAA,EAAW,SAAS,CAAA,CAAE,CAAA;AACxE,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,SAAS,CAAA,QAAA,EAAW,SAAS,CAAA,CAAE,CAAA;AACxE,EAAA,IAAI,gBAAA,EAAkB;AAClB,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,gBAAgB,CAAA,CAAE,CAAA;AAAA,EAC/D;AACA,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,WAAA,GAAc,6BAAA,GAAgC,iCAAiC,CAAA,CAAE,CAAA;AAC1H,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,wCAAA,EAA+B,cAAA,GAAiB,wBAAA,GAA2B,UAAU,CAAA,CAAE,CAAA;AACnG,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,IAAI,CAAA,wBAAA,CAA0B,CAAA;AACtC,EAAA,OAAA,CAAQ,GAAA,EAAI;AAIZ,EAAA,IAAI,UAAA,IAAc,OAAA,CAAQ,GAAA,CAAI,iBAAiB,MAAM,GAAA,EAAK;AACtD,IAAA,MAAM,GAAA,GAAM,GAAG,SAAS,CAAA,CAAA,CAAA;AACxB,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,4BAAA,EAAwB,GAAG,CAAA,CAAE,CAAA;AACzC,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,MAAM,KAAK,GAAG,CAAA;AAAA,EAClB;AAGA,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,KAAkC;AACtD,IAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,QAAA,EAAQ,MAAM,CAAA,8BAAA,CAA2B,CAAA;AACrD,IAAA,MAAM,OAAO,IAAA,EAAK;AAClB,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAClB,CAAA;AAEA,EAAA,OAAA,CAAQ,GAAG,QAAA,EAAU,MAAM,KAAK,QAAA,CAAS,QAAQ,CAAC,CAAA;AAClD,EAAA,OAAA,CAAQ,GAAG,SAAA,EAAW,MAAM,KAAK,QAAA,CAAS,SAAS,CAAC,CAAA;AACxD;AAEA,IAAA,EAAK,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AAC3B,EAAA,OAAA,CAAQ,KAAA,CAAM,6BAA6B,GAAG,CAAA;AAC9C,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB,CAAC,CAAA","file":"bin.js","sourcesContent":["#!/usr/bin/env node\n/**\n * Standalone entry-point that starts the mcp-broker WebSocket server.\n *\n * ## Configuration sources (highest priority first)\n *\n * 1. Environment variables (`MCP_BROKER_*`).\n * 2. JSON config file. Resolved in order:\n *    a. `MCP_BROKER_CONFIG` env var.\n *    b. `./.mcp-broker/config.json` in the current working directory.\n *    c. `./mcp-broker.config.json` (legacy, with a deprecation warning).\n * 3. Built-in defaults.\n *\n * ## Path resolution\n *\n * - Env-var paths (`MCP_BROKER_*_DIR`, `MCP_BROKER_TLS_*`) are resolved\n *   against `process.cwd()`.\n * - Config-file paths (`tls.cert`, `www.mounts[*].dir`, `stdioUpstreams[*]`,\n *   `mcpbBundles[*]`) are resolved against the **config file's directory**: so a config in\n *   `./.mcp-broker/config.json` referring to `\"certs/cert.pem\"` points at\n *   `./.mcp-broker/certs/cert.pem`. The folder is self-contained.\n *\n * ## Local grammar overrides\n *\n * When `.mcp-broker/grammars/<userAgent>/<locale>.json` files exist next to\n * the config file, they are merged **on top of** the packaged grammars. Lets\n * users customize tool/resource descriptions for their organization without\n * forking the package.\n *\n * ## Environment variables\n *\n * | Variable                       | Default  | Notes                                                  |\n * |--------------------------------|----------|--------------------------------------------------------|\n * | MCP_BROKER_CONFIG              | (none)   | Path to a JSON config file (see above).                |\n * | MCP_BROKER_PORT                | 3000     |                                                        |\n * | MCP_BROKER_HOST                | 0.0.0.0  |                                                        |\n * | MCP_BROKER_PROVIDER_PATH       | /provider| Prefix for provider WS                                 |\n * | MCP_BROKER_CLIENT_PATH         | /        | Prefix for raw WS clients                              |\n * | MCP_BROKER_MCP_PATH            | /mcp     | Suffix for Streamable HTTP transport                   |\n * | MCP_BROKER_WWW_DIR             | (none)   | Ergonomic shortcut: mount this directory at \"/\"        |\n * | MCP_BROKER_BUNDLE_DIR          | (none)   | Ergonomic shortcut: mount this directory at \"/bundle\"  |\n * | MCP_BROKER_OPEN                | (unset)  | \"1\" to auto-launch the default browser at the root URL |\n * | MCP_BROKER_TLS_CERT            | (none)   | Path to a PEM TLS certificate                          |\n * | MCP_BROKER_TLS_KEY             | (none)   | Path to a PEM private key                              |\n * | MCP_BROKER_PROTOCOL            | auto     | \"http\" to force plain, \"https\" to force TLS, otherwise |\n * |                                |          | TLS is enabled iff cert+key are both set               |\n * | MCP_BROKER_STDIO_PROVIDER      | (none)   | When set, stdin/stdout carry JSON-RPC for the named    |\n * |                                |          | provider (Claude Desktop bridge).                      |\n * | MCP_BROKER_LOCALE              | en       | Locale used for tool descriptions on the `_broker`     |\n * |                                |          | slot. ISO 639-1 base; regional variants accepted.      |\n * | MCP_BROKER_ALLOWED_ORIGINS     | (none)   | Comma-separated browser origins allowed on             |\n * |                                |          | `/<slot>/mcp`. None means no browser origin passes.    |\n */\nimport * as fs from \"fs\";\nimport * as path from \"path\";\nimport open from \"open\";\nimport { WsTunnelBuilder } from \"./index\";\nimport { loadBrokerConfig } from \"./config\";\nimport { loadMcpbBundle } from \"./mcpb/mcpb.loader\";\n\n// ---------------------------------------------------------------------------\n// Configuration\n// ---------------------------------------------------------------------------\n\nconst { config, baseDir } = loadBrokerConfig();\nconst cwd = process.cwd();\n\n/**\n * Fills an env var from the config file when the env var is not already set.\n * Used for **non-path** scalars, path-bearing fields are read directly so\n * they can be resolved against `baseDir` (config file's directory) instead\n * of `cwd` (deploy environment).\n */\nfunction envFromConfig(envName: string, configValue: string | number | boolean | undefined): void {\n    if (configValue === undefined || configValue === null) return;\n    if (process.env[envName] !== undefined && process.env[envName] !== \"\") return;\n    process.env[envName] = String(configValue);\n}\n\nenvFromConfig(\"MCP_BROKER_PORT\", config.port);\nenvFromConfig(\"MCP_BROKER_HOST\", config.host);\nenvFromConfig(\"MCP_BROKER_PROTOCOL\", config.protocol);\nenvFromConfig(\"MCP_BROKER_LOCALE\", config.locale);\nenvFromConfig(\"MCP_BROKER_STDIO_PROVIDER\", config.stdioProvider);\nenvFromConfig(\"MCP_BROKER_PROVIDER_PATH\", config.paths?.provider);\nenvFromConfig(\"MCP_BROKER_CLIENT_PATH\", config.paths?.client);\nenvFromConfig(\"MCP_BROKER_MCP_PATH\", config.paths?.mcp);\nenvFromConfig(\"MCP_BROKER_OPEN\", config.www?.open === true ? \"1\" : undefined);\nenvFromConfig(\"MCP_BROKER_AUTH_ENABLED\", config.auth?.enabled === true ? \"1\" : undefined);\nenvFromConfig(\"MCP_BROKER_PUBLIC_BASE_URL\", config.auth?.publicBaseUrl);\nenvFromConfig(\"MCP_BROKER_JWKS\", config.auth?.jwks);\nenvFromConfig(\"MCP_BROKER_ISSUER\", config.auth?.issuer);\nenvFromConfig(\"MCP_BROKER_PROVIDER_SECRET\", config.auth?.providerSecret);\n\nconst stdioProvider = process.env[\"MCP_BROKER_STDIO_PROVIDER\"];\n\n// In stdio mode stdout is reserved for JSON-RPC, redirect all console output to stderr.\nif (stdioProvider) {\n    const toStderr = (...args: unknown[]) => process.stderr.write(args.join(\" \") + \"\\n\");\n    console.log = toStderr;\n    console.info = toStderr;\n    console.warn = toStderr;\n    console.error = toStderr;\n}\n\nconst port = parseInt(process.env[\"MCP_BROKER_PORT\"] ?? \"3000\", 10);\nconst host = process.env[\"MCP_BROKER_HOST\"];\nconst providerPath = process.env[\"MCP_BROKER_PROVIDER_PATH\"] ?? \"/provider\";\nconst clientPath = process.env[\"MCP_BROKER_CLIENT_PATH\"] ?? \"/\";\nconst mcpPath = process.env[\"MCP_BROKER_MCP_PATH\"] ?? \"/mcp\";\nconst ssePath = config.paths?.sse ?? \"/sse\";\n\n// ── TLS material ─────────────────────────────────────────────────────────────\n// Env var (relative to cwd) wins over config (relative to baseDir).\nconst tlsCertPath = process.env[\"MCP_BROKER_TLS_CERT\"] ? path.resolve(cwd, process.env[\"MCP_BROKER_TLS_CERT\"]) : config.tls?.cert ? path.resolve(baseDir, config.tls.cert) : null;\nconst tlsKeyPath = process.env[\"MCP_BROKER_TLS_KEY\"] ? path.resolve(cwd, process.env[\"MCP_BROKER_TLS_KEY\"]) : config.tls?.key ? path.resolve(baseDir, config.tls.key) : null;\n\nconst protocolOverride = process.env[\"MCP_BROKER_PROTOCOL\"]?.toLowerCase();\nif (protocolOverride !== undefined && protocolOverride !== \"http\" && protocolOverride !== \"https\") {\n    console.error(`[mcp-broker] Invalid MCP_BROKER_PROTOCOL=\"${protocolOverride}\". Use \"http\" or \"https\".`);\n    process.exit(1);\n}\nif (protocolOverride === \"https\" && (!tlsCertPath || !tlsKeyPath)) {\n    console.error(\"[mcp-broker] MCP_BROKER_PROTOCOL=https requires TLS cert+key (via config.tls or MCP_BROKER_TLS_CERT/KEY).\");\n    process.exit(1);\n}\n\nconst useTls = protocolOverride === \"http\" ? false : protocolOverride === \"https\" ? true : !!(tlsCertPath && tlsKeyPath);\n\n// ── Allowed browser origins for /<slot>/mcp ──────────────────────────────────\n// Absent leaves the endpoint closed to browsers, which is the safe default.\n// The env var only carries the list form; a pattern needs the config file,\n// since a regular expression cannot survive comma-splitting.\nconst envOrigins = process.env[\"MCP_BROKER_ALLOWED_ORIGINS\"]\n    ?.split(\",\")\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n\nlet allowedOrigins: readonly string[] | RegExp | undefined;\nif (envOrigins?.length) {\n    allowedOrigins = envOrigins;\n} else if (Array.isArray(config.allowedOrigins)) {\n    allowedOrigins = config.allowedOrigins;\n} else if (config.allowedOrigins) {\n    try {\n        allowedOrigins = new RegExp(config.allowedOrigins.pattern, config.allowedOrigins.flags);\n    } catch (err) {\n        // Falling back to the closed default rather than starting with a rule\n        // the operator believes is in force but which never compiled.\n        console.error(`[mcp-broker] Ignoring allowedOrigins.pattern: ${(err as Error).message}`);\n    }\n}\n\n// ── Env-var static mount shortcuts (relative to cwd) ─────────────────────────\nconst envWwwDir = process.env[\"MCP_BROKER_WWW_DIR\"] ? path.resolve(cwd, process.env[\"MCP_BROKER_WWW_DIR\"]) : null;\nconst envBundleDir = process.env[\"MCP_BROKER_BUNDLE_DIR\"] ? path.resolve(cwd, process.env[\"MCP_BROKER_BUNDLE_DIR\"]) : null;\n\n// ---------------------------------------------------------------------------\n// Server bootstrap\n// ---------------------------------------------------------------------------\n\nasync function main(): Promise<void> {\n    // Local grammar overrides: when `<baseDir>/grammars/` exists, the broker\n    // server merges those JSON files on top of the packaged grammars.\n    const localGrammarsDir = path.join(baseDir, \"grammars\");\n    const hasLocalGrammars = fs.existsSync(localGrammarsDir);\n\n    const builder = new WsTunnelBuilder().withPort(port).withProviderPath(providerPath).withClientPath(clientPath).withMcpPath(mcpPath);\n\n    if (host) {\n        builder.withHost(host);\n    }\n\n    if (useTls) {\n        builder.withTlsFiles(tlsCertPath!, tlsKeyPath!);\n    }\n\n    if (allowedOrigins) {\n        builder.withAllowedOrigins(allowedOrigins);\n    }\n\n    // ── Static mounts ────────────────────────────────────────────────────────\n    // First the env-var shortcuts (relative to cwd), then the config `www.mounts`\n    // (relative to baseDir). Order matters: /bundle before / so the prefix router\n    // can distinguish them. Subsequent registrations contribute additional mounts;\n    // longest-prefix match wins at runtime.\n    if (envBundleDir && fs.existsSync(envBundleDir)) {\n        builder.withStaticMount(\"/bundle\", envBundleDir);\n    }\n    if (envWwwDir && fs.existsSync(envWwwDir)) {\n        builder.withStaticMount(\"/\", envWwwDir);\n    }\n    if (config.www?.mounts) {\n        for (const mount of config.www.mounts) {\n            const abs = path.resolve(baseDir, mount.dir);\n            if (fs.existsSync(abs)) {\n                builder.withStaticMount(mount.urlPrefix, abs);\n            } else {\n                console.warn(`[mcp-broker] www.mounts entry \"${mount.urlPrefix}\" → ${abs} skipped (directory not found).`);\n            }\n        }\n    }\n\n    // ── Stdio upstreams ──────────────────────────────────────────────────────\n    if (config.stdioUpstreams) {\n        for (const u of config.stdioUpstreams) {\n            builder.withStdioUpstream({\n                name: u.name,\n                command: u.command,\n                args: u.args,\n                env: u.env as NodeJS.ProcessEnv | undefined,\n                aggregate: u.aggregate,\n            });\n        }\n    }\n\n    // ── Remote MCP server upstreams (reached by URL) ─────────────────────────\n    // Config-discovered remote servers join the `_all` aggregate by default;\n    // an explicit `aggregate: false` opts an entry out.\n    if (config.mcpServers) {\n        for (const s of config.mcpServers) {\n            builder.withRemoteUpstream({ ...s, aggregate: s.aggregate ?? true });\n        }\n    }\n\n    // ── Local `.mcpb` bundles ────────────────────────────────────────────────\n    // Each bundle is signature-verified and unpacked before it is wired in as a\n    // stdio upstream. A refused bundle is skipped (loadMcpbBundle logs why); it\n    // never spawns a process. Bundles join `_all` by default (opt-out per entry).\n    if (config.mcpbBundles) {\n        for (const b of config.mcpbBundles) {\n            const upstream = await loadMcpbBundle(b, baseDir);\n            if (upstream) {\n                builder.withStdioUpstream(upstream);\n            }\n        }\n    }\n\n    if (stdioProvider) {\n        builder.withStdioClient(stdioProvider);\n    }\n\n    if (hasLocalGrammars) {\n        builder.withBrokerLocalGrammarsDir(localGrammarsDir);\n    }\n\n    // ── Authorization (OAuth 2.1 resource server) ────────────────────────────\n    // Opt-in: only wired when MCP_BROKER_AUTH_ENABLED / config.auth.enabled is on.\n    // Env scalars win over config; array/object fields are read from config.\n    const authEnabledEnv = process.env[\"MCP_BROKER_AUTH_ENABLED\"];\n    const authEnabled = authEnabledEnv === \"1\" || authEnabledEnv === \"true\";\n    if (authEnabled) {\n        const publicBaseUrl = process.env[\"MCP_BROKER_PUBLIC_BASE_URL\"];\n        const jwks = process.env[\"MCP_BROKER_JWKS\"];\n        const issuer = process.env[\"MCP_BROKER_ISSUER\"];\n        const authorizationServers = config.auth?.authorizationServers ?? (issuer ? [issuer] : []);\n        if (!publicBaseUrl || !jwks || authorizationServers.length === 0) {\n            console.error(\n                \"[mcp-broker] auth.enabled requires publicBaseUrl, jwks, and at least one \" +\n                    \"authorizationServers entry (or issuer). Set them via config.auth or \" +\n                    \"MCP_BROKER_PUBLIC_BASE_URL / MCP_BROKER_JWKS / MCP_BROKER_ISSUER.\"\n            );\n            process.exit(1);\n        }\n        builder.withJwtAuth({\n            publicBaseUrl,\n            authorizationServers,\n            jwksUri: jwks,\n            issuer,\n            scopesSupported: config.auth?.scopesSupported,\n            requiredScopes: config.auth?.requiredScopes,\n            perSlotScopes: config.auth?.perSlotScopes,\n            providerScopes: config.auth?.providerScopes,\n            subjectMapping: config.auth?.subjectMapping,\n            roles: config.auth?.roles,\n            assignments: config.auth?.assignments,\n            denies: config.auth?.denies,\n            slotResources: config.auth?.slotResources,\n            toolCapabilities: config.auth?.toolCapabilities,\n            providerToolCapabilities: config.auth?.providerToolCapabilities,\n            audit: config.auth?.audit,\n        });\n    }\n\n    // ── Provider authentication (independent of client OAuth) ────────────────\n    // Requires every provider connecting to /provider/<slot> or /providers to\n    // present the shared secret, closes off slot occupation by strangers.\n    const providerSecret = process.env[\"MCP_BROKER_PROVIDER_SECRET\"];\n    if (providerSecret) {\n        builder.withProviderSecret(providerSecret);\n    }\n\n    const tunnel = builder.build();\n    await tunnel.start();\n\n    // ── Startup banner ──────────────────────────────────────────────────────\n    const httpScheme = useTls ? \"https\" : \"http\";\n    const wsScheme = useTls ? \"wss\" : \"ws\";\n    const hr = \"─\".repeat(64);\n    const localhost = `${httpScheme}://localhost:${port}`;\n    const mcpSuffix = mcpPath.replace(/^\\//, \"\");\n    const sseSuffix = ssePath.replace(/^\\//, \"\");\n    const hasWwwRoot = !!(envWwwDir && fs.existsSync(envWwwDir)) || (config.www?.mounts ?? []).some((m) => m.urlPrefix === \"/\");\n\n    console.log();\n    console.log(`⚙️  mcp-broker started${useTls ? \" (TLS)\" : \"\"}`);\n    console.log(hr);\n    console.log(`📡  Provider WebSocket    ${wsScheme}://localhost:${port}${providerPath}/<name>`);\n    console.log(`🔌  MCP (Streamable HTTP) ${localhost}/<name>/${mcpSuffix}`);\n    console.log(`📺  Legacy SSE            ${localhost}/<name>/${sseSuffix}`);\n    if (hasLocalGrammars) {\n        console.log(`🌐  Local grammars        ${localGrammarsDir}`);\n    }\n    console.log(`🔐  Authorization         ${authEnabled ? \"OAuth 2.1 (Bearer required)\" : \"disabled (trusted network only)\"}`);\n    console.log(`🛡️   Provider auth         ${providerSecret ? \"shared secret required\" : \"disabled\"}`);\n    console.log(hr);\n    console.log(`   Press Ctrl+C to stop.`);\n    console.log();\n\n    // Auto-launch browser only if explicitly opted in via MCP_BROKER_OPEN=1\n    // AND a mount at \"/\" is configured.\n    if (hasWwwRoot && process.env[\"MCP_BROKER_OPEN\"] === \"1\") {\n        const url = `${localhost}/`;\n        console.log(`🚀  Opening browser: ${url}`);\n        console.log();\n        await open(url);\n    }\n\n    // ── Signal handlers ─────────────────────────────────────────────────────\n    const shutdown = async (signal: string): Promise<void> => {\n        console.log(`\\n⛔  ${signal} received, shutting down…`);\n        await tunnel.stop();\n        process.exit(0);\n    };\n\n    process.on(\"SIGINT\", () => void shutdown(\"SIGINT\"));\n    process.on(\"SIGTERM\", () => void shutdown(\"SIGTERM\"));\n}\n\nmain().catch((err: unknown) => {\n    console.error(\"[mcp-broker] Fatal error:\", err);\n    process.exit(1);\n});\n"]}