@cyanmycelium/mcp-broker 1.0.1 → 1.2.1

package/.mcp-broker.example/README.md

@@ -31,7 +31,7 @@ Property-by-property educational guides:
     └── index.html
 ```
 
-A ready-made instance UI lives at [`node/web/`](../web/) — point a `www`
+A ready-made instance UI lives at [`node/web/`](../web/), point a `www`
 mount at it (`"dir": "../web"`) to serve it. See [`node/web/README.md`](../web/README.md).
 
 ## Path resolution
@@ -41,14 +41,14 @@ config file** (i.e. `.mcp-broker/`). So `"certs/cert.pem"` in the config
 points at `.mcp-broker/certs/cert.pem`. The folder is self-contained.
 
 Env vars (`MCP_BROKER_TLS_CERT`, `MCP_BROKER_WWW_DIR`, ...) are still
-resolved against `process.cwd()` — they are the deploy-time override
+resolved against `process.cwd()`: they are the deploy-time override
 mechanism and not tied to the config file's location.
 
 ## `.mcpb` bundles
 
 `mcpbBundles` entries load local `.mcpb` bundles as stdio provider slots.
 Each bundle is verified against a **detached signature** before it is
-unpacked and run — the broker never spawns an unverified bundle.
+unpacked and run: the broker never spawns an unverified bundle.
 
 1. Generate a signing key pair (once):
    `node ../scripts/sign-bundle.mjs keygen bundles`

package/README.md

@@ -32,7 +32,7 @@ The broker starts on `http://localhost:3000` by default.
 
 Two sources, env vars **always win** over the file. The file is the static baseline you ship with the broker; env vars are deploy-specific overrides.
 
-### Option A — `.mcp-broker/` folder (recommended)
+### Option A: `.mcp-broker/` folder (recommended)
 
 Drop a `.mcp-broker/` folder next to where you launch the broker. Paths
 inside `config.json` are resolved against this folder, so it stays
@@ -79,7 +79,7 @@ cp -r node_modules/@cyanmycelium/mcp-broker/.mcp-broker.example .mcp-broker
 
 Full reference (every field, defaults, recipes, grammar overrides): **[docs/config.md](docs/config.md)**.
 
-### Option B — Environment variables
+### Option B: Environment variables
 
 | Variable | Default | Notes |
 |---|---|---|
@@ -111,6 +111,10 @@ providers, and filter the `_all` aggregate per caller.
 
 Enabled via the `auth` config block (or env vars). Minimal `.mcp-broker/config.json`:
 
+The resource paths below use a compact ISA-95 / IEC 62264-aligned industrial
+profile. The engine remains domain-neutral, does not claim full ISA-95
+compliance, and can map UMD-style namespaces through `slotResources`.
+
 ```json
 {
     "auth": {

package/dist/bin.d.ts

@@ -1,2 +1 @@
 #!/usr/bin/env node
-export {};

package/dist/bin.js

@@ -1,77 +1,63 @@
 #!/usr/bin/env node
-/**
- * Standalone entry-point that starts the mcp-broker WebSocket server.
- *
- * ## Configuration sources (highest priority first)
- *
- * 1. Environment variables (`MCP_BROKER_*`).
- * 2. JSON config file. Resolved in order:
- *    a. `MCP_BROKER_CONFIG` env var.
- *    b. `./.mcp-broker/config.json` in the current working directory.
- *    c. `./mcp-broker.config.json` (legacy, with a deprecation warning).
- * 3. Built-in defaults.
- *
- * ## Path resolution
- *
- * - Env-var paths (`MCP_BROKER_*_DIR`, `MCP_BROKER_TLS_*`) are resolved
- *   against `process.cwd()`.
- * - Config-file paths (`tls.cert`, `www.mounts[*].dir`, `stdioUpstreams[*]`,
- *   `mcpbBundles[*]`) are resolved against the **config file's directory** — so a config in
- *   `./.mcp-broker/config.json` referring to `"certs/cert.pem"` points at
- *   `./.mcp-broker/certs/cert.pem`. The folder is self-contained.
- *
- * ## Local grammar overrides
- *
- * When `.mcp-broker/grammars/<userAgent>/<locale>.json` files exist next to
- * the config file, they are merged **on top of** the packaged grammars. Lets
- * users customize tool/resource descriptions for their organization without
- * forking the package.
- *
- * ## Environment variables
- *
- * | Variable                       | Default  | Notes                                                  |
- * |--------------------------------|----------|--------------------------------------------------------|
- * | MCP_BROKER_CONFIG              | (none)   | Path to a JSON config file (see above).                |
- * | MCP_BROKER_PORT                | 3000     |                                                        |
- * | MCP_BROKER_HOST                | 0.0.0.0  |                                                        |
- * | MCP_BROKER_PROVIDER_PATH       | /provider| Prefix for provider WS                                 |
- * | MCP_BROKER_CLIENT_PATH         | /        | Prefix for raw WS clients                              |
- * | MCP_BROKER_MCP_PATH            | /mcp     | Suffix for Streamable HTTP transport                   |
- * | MCP_BROKER_WWW_DIR             | (none)   | Ergonomic shortcut: mount this directory at "/"        |
- * | MCP_BROKER_BUNDLE_DIR          | (none)   | Ergonomic shortcut: mount this directory at "/bundle"  |
- * | MCP_BROKER_OPEN                | (unset)  | "1" to auto-launch the default browser at the root URL |
- * | MCP_BROKER_TLS_CERT            | (none)   | Path to a PEM TLS certificate                          |
- * | MCP_BROKER_TLS_KEY             | (none)   | Path to a PEM private key                              |
- * | MCP_BROKER_PROTOCOL            | auto     | "http" to force plain, "https" to force TLS, otherwise |
- * |                                |          | TLS is enabled iff cert+key are both set               |
- * | MCP_BROKER_STDIO_PROVIDER      | (none)   | When set, stdin/stdout carry JSON-RPC for the named    |
- * |                                |          | provider (Claude Desktop bridge).                      |
- * | MCP_BROKER_LOCALE              | en       | Locale used for tool descriptions on the `_broker`     |
- * |                                |          | slot. ISO 639-1 base; regional variants accepted.      |
- */
-import * as fs from "fs";
-import * as path from "path";
-import open from "open";
-import { WsTunnelBuilder } from "./index.js";
-import { loadBrokerConfig } from "./config.js";
-import { loadMcpbBundle } from "./mcpb.loader.js";
-// ---------------------------------------------------------------------------
-// Configuration
-// ---------------------------------------------------------------------------
-const { config, baseDir } = loadBrokerConfig();
-const cwd = process.cwd();
-/**
- * Fills an env var from the config file when the env var is not already set.
- * Used for **non-path** scalars — path-bearing fields are read directly so
- * they can be resolved against `baseDir` (config file's directory) instead
- * of `cwd` (deploy environment).
- */
+import { PACKAGE_NAME, VERSION, loadBrokerConfig, WsTunnelBuilder, loadMcpbBundle } from './chunk-FTDKH2C4.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import open from 'open';
+
+var argv = process.argv.slice(2);
+if (argv.includes("--help") || argv.includes("-h")) {
+  printHelp();
+  process.exit(0);
+}
+if (argv.includes("--version") || argv.includes("-v")) {
+  process.stdout.write(`${PACKAGE_NAME} ${VERSION}
+`);
+  process.exit(0);
+}
+function printHelp() {
+  process.stdout.write(
+    `
+${PACKAGE_NAME} ${VERSION}
+WebSocket-based Model Context Protocol broker.
+
+USAGE
+  npx @cyanmycelium/mcp-broker             Start the broker (foreground)
+  npx @cyanmycelium/mcp-broker --help      Show this help
+  npx @cyanmycelium/mcp-broker --version   Print the version
+
+The broker takes no positional arguments. Configure it with a
+.mcp-broker/config.json file or MCP_BROKER_* environment variables
+(env vars win over the file).
+
+COMMON ENVIRONMENT VARIABLES
+  MCP_BROKER_CONFIG            Path to a JSON config file
+  MCP_BROKER_PORT             TCP port (default 3000)
+  MCP_BROKER_HOST             Bind interface (default 0.0.0.0)
+  MCP_BROKER_PROTOCOL         "http" | "https" (default: auto from TLS)
+  MCP_BROKER_TLS_CERT         PEM certificate path (enables HTTPS/WSS)
+  MCP_BROKER_TLS_KEY          PEM private key path
+  MCP_BROKER_STDIO_PROVIDER   Bridge stdin/stdout to this provider (Claude Desktop)
+  MCP_BROKER_LOCALE           Locale for _broker tool descriptions (default en)
+  MCP_BROKER_ALLOWED_ORIGINS  Comma-separated browser origins allowed on /<slot>/mcp
+
+AUTHORIZATION (OAuth 2.1, opt-in)
+  MCP_BROKER_AUTH_ENABLED     "1" to require bearer tokens on client endpoints
+  MCP_BROKER_PUBLIC_BASE_URL  Public origin, e.g. https://mcp.example.com
+  MCP_BROKER_JWKS             Authorization server JWKS URL
+  MCP_BROKER_ISSUER           Expected token issuer
+  MCP_BROKER_PROVIDER_SECRET  Shared secret required from providers
+
+Full reference: https://github.com/pandaGaume/mcp-broker/tree/main/node
+
+`
+  );
+}
+var { config, baseDir } = loadBrokerConfig();
+var cwd = process.cwd();
 function envFromConfig(envName, configValue) {
-    if (configValue === undefined || configValue === null)
-        return;
-    if (process.env[envName] !== undefined && process.env[envName] !== "")
-        return;
-    process.env[envName] = String(configValue);
+  if (configValue === void 0 || configValue === null) return;
+  if (process.env[envName] !== void 0 && process.env[envName] !== "") return;
+  process.env[envName] = String(configValue);
 }
 envFromConfig("MCP_BROKER_PORT", config.port);
 envFromConfig("MCP_BROKER_HOST", config.host);
@@ -81,204 +67,189 @@ envFromConfig("MCP_BROKER_STDIO_PROVIDER", config.stdioProvider);
 envFromConfig("MCP_BROKER_PROVIDER_PATH", config.paths?.provider);
 envFromConfig("MCP_BROKER_CLIENT_PATH", config.paths?.client);
 envFromConfig("MCP_BROKER_MCP_PATH", config.paths?.mcp);
-envFromConfig("MCP_BROKER_OPEN", config.www?.open === true ? "1" : undefined);
-envFromConfig("MCP_BROKER_AUTH_ENABLED", config.auth?.enabled === true ? "1" : undefined);
+envFromConfig("MCP_BROKER_OPEN", config.www?.open === true ? "1" : void 0);
+envFromConfig("MCP_BROKER_AUTH_ENABLED", config.auth?.enabled === true ? "1" : void 0);
 envFromConfig("MCP_BROKER_PUBLIC_BASE_URL", config.auth?.publicBaseUrl);
 envFromConfig("MCP_BROKER_JWKS", config.auth?.jwks);
 envFromConfig("MCP_BROKER_ISSUER", config.auth?.issuer);
 envFromConfig("MCP_BROKER_PROVIDER_SECRET", config.auth?.providerSecret);
-const stdioProvider = process.env["MCP_BROKER_STDIO_PROVIDER"];
-// In stdio mode stdout is reserved for JSON-RPC — redirect all console output to stderr.
+var stdioProvider = process.env["MCP_BROKER_STDIO_PROVIDER"];
 if (stdioProvider) {
-    const toStderr = (...args) => process.stderr.write(args.join(" ") + "\n");
-    console.log = toStderr;
-    console.info = toStderr;
-    console.warn = toStderr;
-    console.error = toStderr;
+  const toStderr = (...args) => process.stderr.write(args.join(" ") + "\n");
+  console.log = toStderr;
+  console.info = toStderr;
+  console.warn = toStderr;
+  console.error = toStderr;
 }
-const port = parseInt(process.env["MCP_BROKER_PORT"] ?? "3000", 10);
-const host = process.env["MCP_BROKER_HOST"];
-const providerPath = process.env["MCP_BROKER_PROVIDER_PATH"] ?? "/provider";
-const clientPath = process.env["MCP_BROKER_CLIENT_PATH"] ?? "/";
-const mcpPath = process.env["MCP_BROKER_MCP_PATH"] ?? "/mcp";
-const ssePath = config.paths?.sse ?? "/sse";
-// ── TLS material ─────────────────────────────────────────────────────────────
-// Env var (relative to cwd) wins over config (relative to baseDir).
-const tlsCertPath = process.env["MCP_BROKER_TLS_CERT"] ? path.resolve(cwd, process.env["MCP_BROKER_TLS_CERT"]) : config.tls?.cert ? path.resolve(baseDir, config.tls.cert) : null;
-const tlsKeyPath = process.env["MCP_BROKER_TLS_KEY"] ? path.resolve(cwd, process.env["MCP_BROKER_TLS_KEY"]) : config.tls?.key ? path.resolve(baseDir, config.tls.key) : null;
-const protocolOverride = process.env["MCP_BROKER_PROTOCOL"]?.toLowerCase();
-if (protocolOverride !== undefined && protocolOverride !== "http" && protocolOverride !== "https") {
-    console.error(`[mcp-broker] Invalid MCP_BROKER_PROTOCOL="${protocolOverride}". Use "http" or "https".`);
-    process.exit(1);
+var port = parseInt(process.env["MCP_BROKER_PORT"] ?? "3000", 10);
+var host = process.env["MCP_BROKER_HOST"];
+var providerPath = process.env["MCP_BROKER_PROVIDER_PATH"] ?? "/provider";
+var clientPath = process.env["MCP_BROKER_CLIENT_PATH"] ?? "/";
+var mcpPath = process.env["MCP_BROKER_MCP_PATH"] ?? "/mcp";
+var ssePath = config.paths?.sse ?? "/sse";
+var tlsCertPath = process.env["MCP_BROKER_TLS_CERT"] ? path.resolve(cwd, process.env["MCP_BROKER_TLS_CERT"]) : config.tls?.cert ? path.resolve(baseDir, config.tls.cert) : null;
+var tlsKeyPath = process.env["MCP_BROKER_TLS_KEY"] ? path.resolve(cwd, process.env["MCP_BROKER_TLS_KEY"]) : config.tls?.key ? path.resolve(baseDir, config.tls.key) : null;
+var protocolOverride = process.env["MCP_BROKER_PROTOCOL"]?.toLowerCase();
+if (protocolOverride !== void 0 && protocolOverride !== "http" && protocolOverride !== "https") {
+  console.error(`[mcp-broker] Invalid MCP_BROKER_PROTOCOL="${protocolOverride}". Use "http" or "https".`);
+  process.exit(1);
 }
 if (protocolOverride === "https" && (!tlsCertPath || !tlsKeyPath)) {
-    console.error("[mcp-broker] MCP_BROKER_PROTOCOL=https requires TLS cert+key (via config.tls or MCP_BROKER_TLS_CERT/KEY).");
-    process.exit(1);
+  console.error("[mcp-broker] MCP_BROKER_PROTOCOL=https requires TLS cert+key (via config.tls or MCP_BROKER_TLS_CERT/KEY).");
+  process.exit(1);
+}
+var useTls = protocolOverride === "http" ? false : protocolOverride === "https" ? true : !!(tlsCertPath && tlsKeyPath);
+var envOrigins = process.env["MCP_BROKER_ALLOWED_ORIGINS"]?.split(",").map((origin) => origin.trim()).filter(Boolean);
+var allowedOrigins;
+if (envOrigins?.length) {
+  allowedOrigins = envOrigins;
+} else if (Array.isArray(config.allowedOrigins)) {
+  allowedOrigins = config.allowedOrigins;
+} else if (config.allowedOrigins) {
+  try {
+    allowedOrigins = new RegExp(config.allowedOrigins.pattern, config.allowedOrigins.flags);
+  } catch (err) {
+    console.error(`[mcp-broker] Ignoring allowedOrigins.pattern: ${err.message}`);
+  }
 }
-const useTls = protocolOverride === "http" ? false : protocolOverride === "https" ? true : !!(tlsCertPath && tlsKeyPath);
-// ── Env-var static mount shortcuts (relative to cwd) ─────────────────────────
-const envWwwDir = process.env["MCP_BROKER_WWW_DIR"] ? path.resolve(cwd, process.env["MCP_BROKER_WWW_DIR"]) : null;
-const envBundleDir = process.env["MCP_BROKER_BUNDLE_DIR"] ? path.resolve(cwd, process.env["MCP_BROKER_BUNDLE_DIR"]) : null;
-// ---------------------------------------------------------------------------
-// Server bootstrap
-// ---------------------------------------------------------------------------
+var envWwwDir = process.env["MCP_BROKER_WWW_DIR"] ? path.resolve(cwd, process.env["MCP_BROKER_WWW_DIR"]) : null;
+var envBundleDir = process.env["MCP_BROKER_BUNDLE_DIR"] ? path.resolve(cwd, process.env["MCP_BROKER_BUNDLE_DIR"]) : null;
 async function main() {
-    // Local grammar overrides: when `<baseDir>/grammars/` exists, the broker
-    // server merges those JSON files on top of the packaged grammars.
-    const localGrammarsDir = path.join(baseDir, "grammars");
-    const hasLocalGrammars = fs.existsSync(localGrammarsDir);
-    const builder = new WsTunnelBuilder().withPort(port).withProviderPath(providerPath).withClientPath(clientPath).withMcpPath(mcpPath);
-    if (host) {
-        builder.withHost(host);
-    }
-    if (useTls) {
-        builder.withTlsFiles(tlsCertPath, tlsKeyPath);
-    }
-    // ── Static mounts ────────────────────────────────────────────────────────
-    // First the env-var shortcuts (relative to cwd), then the config `www.mounts`
-    // (relative to baseDir). Order matters: /bundle before / so the prefix router
-    // can distinguish them. Subsequent registrations contribute additional mounts;
-    // longest-prefix match wins at runtime.
-    if (envBundleDir && fs.existsSync(envBundleDir)) {
-        builder.withStaticMount("/bundle", envBundleDir);
-    }
-    if (envWwwDir && fs.existsSync(envWwwDir)) {
-        builder.withStaticMount("/", envWwwDir);
+  const localGrammarsDir = path.join(baseDir, "grammars");
+  const hasLocalGrammars = fs.existsSync(localGrammarsDir);
+  const builder = new WsTunnelBuilder().withPort(port).withProviderPath(providerPath).withClientPath(clientPath).withMcpPath(mcpPath);
+  if (host) {
+    builder.withHost(host);
+  }
+  if (useTls) {
+    builder.withTlsFiles(tlsCertPath, tlsKeyPath);
+  }
+  if (allowedOrigins) {
+    builder.withAllowedOrigins(allowedOrigins);
+  }
+  if (envBundleDir && fs.existsSync(envBundleDir)) {
+    builder.withStaticMount("/bundle", envBundleDir);
+  }
+  if (envWwwDir && fs.existsSync(envWwwDir)) {
+    builder.withStaticMount("/", envWwwDir);
+  }
+  if (config.www?.mounts) {
+    for (const mount of config.www.mounts) {
+      const abs = path.resolve(baseDir, mount.dir);
+      if (fs.existsSync(abs)) {
+        builder.withStaticMount(mount.urlPrefix, abs);
+      } else {
+        console.warn(`[mcp-broker] www.mounts entry "${mount.urlPrefix}" \u2192 ${abs} skipped (directory not found).`);
+      }
     }
-    if (config.www?.mounts) {
-        for (const mount of config.www.mounts) {
-            const abs = path.resolve(baseDir, mount.dir);
-            if (fs.existsSync(abs)) {
-                builder.withStaticMount(mount.urlPrefix, abs);
-            }
-            else {
-                console.warn(`[mcp-broker] www.mounts entry "${mount.urlPrefix}" → ${abs} skipped (directory not found).`);
-            }
-        }
+  }
+  if (config.stdioUpstreams) {
+    for (const u of config.stdioUpstreams) {
+      builder.withStdioUpstream({
+        name: u.name,
+        command: u.command,
+        args: u.args,
+        env: u.env,
+        aggregate: u.aggregate
+      });
     }
-    // ── Stdio upstreams ──────────────────────────────────────────────────────
-    if (config.stdioUpstreams) {
-        for (const u of config.stdioUpstreams) {
-            builder.withStdioUpstream({
-                name: u.name,
-                command: u.command,
-                args: u.args,
-                env: u.env,
-                aggregate: u.aggregate,
-            });
-        }
+  }
+  if (config.mcpServers) {
+    for (const s of config.mcpServers) {
+      builder.withRemoteUpstream({ ...s, aggregate: s.aggregate ?? true });
     }
-    // ── Remote MCP server upstreams (reached by URL) ─────────────────────────
-    // Config-discovered remote servers join the `_all` aggregate by default;
-    // an explicit `aggregate: false` opts an entry out.
-    if (config.mcpServers) {
-        for (const s of config.mcpServers) {
-            builder.withRemoteUpstream({ ...s, aggregate: s.aggregate ?? true });
-        }
+  }
+  if (config.mcpbBundles) {
+    for (const b of config.mcpbBundles) {
+      const upstream = await loadMcpbBundle(b, baseDir);
+      if (upstream) {
+        builder.withStdioUpstream(upstream);
+      }
     }
-    // ── Local `.mcpb` bundles ────────────────────────────────────────────────
-    // Each bundle is signature-verified and unpacked before it is wired in as a
-    // stdio upstream. A refused bundle is skipped (loadMcpbBundle logs why); it
-    // never spawns a process. Bundles join `_all` by default (opt-out per entry).
-    if (config.mcpbBundles) {
-        for (const b of config.mcpbBundles) {
-            const upstream = await loadMcpbBundle(b, baseDir);
-            if (upstream) {
-                builder.withStdioUpstream(upstream);
-            }
-        }
+  }
+  if (stdioProvider) {
+    builder.withStdioClient(stdioProvider);
+  }
+  if (hasLocalGrammars) {
+    builder.withBrokerLocalGrammarsDir(localGrammarsDir);
+  }
+  const authEnabledEnv = process.env["MCP_BROKER_AUTH_ENABLED"];
+  const authEnabled = authEnabledEnv === "1" || authEnabledEnv === "true";
+  if (authEnabled) {
+    const publicBaseUrl = process.env["MCP_BROKER_PUBLIC_BASE_URL"];
+    const jwks = process.env["MCP_BROKER_JWKS"];
+    const issuer = process.env["MCP_BROKER_ISSUER"];
+    const authorizationServers = config.auth?.authorizationServers ?? (issuer ? [issuer] : []);
+    if (!publicBaseUrl || !jwks || authorizationServers.length === 0) {
+      console.error(
+        "[mcp-broker] auth.enabled requires publicBaseUrl, jwks, and at least one authorizationServers entry (or issuer). Set them via config.auth or MCP_BROKER_PUBLIC_BASE_URL / MCP_BROKER_JWKS / MCP_BROKER_ISSUER."
+      );
+      process.exit(1);
     }
-    if (stdioProvider) {
-        builder.withStdioClient(stdioProvider);
-    }
-    if (hasLocalGrammars) {
-        builder.withBrokerLocalGrammarsDir(localGrammarsDir);
-    }
-    // ── Authorization (OAuth 2.1 resource server) ────────────────────────────
-    // Opt-in: only wired when MCP_BROKER_AUTH_ENABLED / config.auth.enabled is on.
-    // Env scalars win over config; array/object fields are read from config.
-    const authEnabledEnv = process.env["MCP_BROKER_AUTH_ENABLED"];
-    const authEnabled = authEnabledEnv === "1" || authEnabledEnv === "true";
-    if (authEnabled) {
-        const publicBaseUrl = process.env["MCP_BROKER_PUBLIC_BASE_URL"];
-        const jwks = process.env["MCP_BROKER_JWKS"];
-        const issuer = process.env["MCP_BROKER_ISSUER"];
-        const authorizationServers = config.auth?.authorizationServers ?? (issuer ? [issuer] : []);
-        if (!publicBaseUrl || !jwks || authorizationServers.length === 0) {
-            console.error("[mcp-broker] auth.enabled requires publicBaseUrl, jwks, and at least one " +
-                "authorizationServers entry (or issuer). Set them via config.auth or " +
-                "MCP_BROKER_PUBLIC_BASE_URL / MCP_BROKER_JWKS / MCP_BROKER_ISSUER.");
-            process.exit(1);
-        }
-        builder.withJwtAuth({
-            publicBaseUrl,
-            authorizationServers,
-            jwksUri: jwks,
-            issuer,
-            scopesSupported: config.auth?.scopesSupported,
-            requiredScopes: config.auth?.requiredScopes,
-            perSlotScopes: config.auth?.perSlotScopes,
-            providerScopes: config.auth?.providerScopes,
-            subjectMapping: config.auth?.subjectMapping,
-            roles: config.auth?.roles,
-            assignments: config.auth?.assignments,
-            denies: config.auth?.denies,
-            slotResources: config.auth?.slotResources,
-            toolCapabilities: config.auth?.toolCapabilities,
-            providerToolCapabilities: config.auth?.providerToolCapabilities,
-            audit: config.auth?.audit,
-        });
-    }
-    // ── Provider authentication (independent of client OAuth) ────────────────
-    // Requires every provider connecting to /provider/<slot> or /providers to
-    // present the shared secret — closes off slot occupation by strangers.
-    const providerSecret = process.env["MCP_BROKER_PROVIDER_SECRET"];
-    if (providerSecret) {
-        builder.withProviderSecret(providerSecret);
-    }
-    const tunnel = builder.build();
-    await tunnel.start();
-    // ── Startup banner ──────────────────────────────────────────────────────
-    const httpScheme = useTls ? "https" : "http";
-    const wsScheme = useTls ? "wss" : "ws";
-    const hr = "─".repeat(64);
-    const localhost = `${httpScheme}://localhost:${port}`;
-    const mcpSuffix = mcpPath.replace(/^\//, "");
-    const sseSuffix = ssePath.replace(/^\//, "");
-    const hasWwwRoot = !!(envWwwDir && fs.existsSync(envWwwDir)) || (config.www?.mounts ?? []).some((m) => m.urlPrefix === "/");
+    builder.withJwtAuth({
+      publicBaseUrl,
+      authorizationServers,
+      jwksUri: jwks,
+      issuer,
+      scopesSupported: config.auth?.scopesSupported,
+      requiredScopes: config.auth?.requiredScopes,
+      perSlotScopes: config.auth?.perSlotScopes,
+      providerScopes: config.auth?.providerScopes,
+      subjectMapping: config.auth?.subjectMapping,
+      roles: config.auth?.roles,
+      assignments: config.auth?.assignments,
+      denies: config.auth?.denies,
+      slotResources: config.auth?.slotResources,
+      toolCapabilities: config.auth?.toolCapabilities,
+      providerToolCapabilities: config.auth?.providerToolCapabilities,
+      audit: config.auth?.audit
+    });
+  }
+  const providerSecret = process.env["MCP_BROKER_PROVIDER_SECRET"];
+  if (providerSecret) {
+    builder.withProviderSecret(providerSecret);
+  }
+  const tunnel = builder.build();
+  await tunnel.start();
+  const httpScheme = useTls ? "https" : "http";
+  const wsScheme = useTls ? "wss" : "ws";
+  const hr = "\u2500".repeat(64);
+  const localhost = `${httpScheme}://localhost:${port}`;
+  const mcpSuffix = mcpPath.replace(/^\//, "");
+  const sseSuffix = ssePath.replace(/^\//, "");
+  const hasWwwRoot = !!(envWwwDir && fs.existsSync(envWwwDir)) || (config.www?.mounts ?? []).some((m) => m.urlPrefix === "/");
+  console.log();
+  console.log(`\u2699\uFE0F  mcp-broker started${useTls ? " (TLS)" : ""}`);
+  console.log(hr);
+  console.log(`\u{1F4E1}  Provider WebSocket    ${wsScheme}://localhost:${port}${providerPath}/<name>`);
+  console.log(`\u{1F50C}  MCP (Streamable HTTP) ${localhost}/<name>/${mcpSuffix}`);
+  console.log(`\u{1F4FA}  Legacy SSE            ${localhost}/<name>/${sseSuffix}`);
+  if (hasLocalGrammars) {
+    console.log(`\u{1F310}  Local grammars        ${localGrammarsDir}`);
+  }
+  console.log(`\u{1F510}  Authorization         ${authEnabled ? "OAuth 2.1 (Bearer required)" : "disabled (trusted network only)"}`);
+  console.log(`\u{1F6E1}\uFE0F   Provider auth         ${providerSecret ? "shared secret required" : "disabled"}`);
+  console.log(hr);
+  console.log(`   Press Ctrl+C to stop.`);
+  console.log();
+  if (hasWwwRoot && process.env["MCP_BROKER_OPEN"] === "1") {
+    const url = `${localhost}/`;
+    console.log(`\u{1F680}  Opening browser: ${url}`);
     console.log();
-    console.log(`⚙️  mcp-broker started${useTls ? " (TLS)" : ""}`);
-    console.log(hr);
-    console.log(`📡  Provider WebSocket    ${wsScheme}://localhost:${port}${providerPath}/<name>`);
-    console.log(`🔌  MCP (Streamable HTTP) ${localhost}/<name>/${mcpSuffix}`);
-    console.log(`📺  Legacy SSE            ${localhost}/<name>/${sseSuffix}`);
-    if (hasLocalGrammars) {
-        console.log(`🌐  Local grammars        ${localGrammarsDir}`);
-    }
-    console.log(`🔐  Authorization         ${authEnabled ? "OAuth 2.1 (Bearer required)" : "disabled (trusted network only)"}`);
-    console.log(`🛡️   Provider auth         ${providerSecret ? "shared secret required" : "disabled"}`);
-    console.log(hr);
-    console.log(`   Press Ctrl+C to stop.`);
-    console.log();
-    // Auto-launch browser only if explicitly opted in via MCP_BROKER_OPEN=1
-    // AND a mount at "/" is configured.
-    if (hasWwwRoot && process.env["MCP_BROKER_OPEN"] === "1") {
-        const url = `${localhost}/`;
-        console.log(`🚀  Opening browser: ${url}`);
-        console.log();
-        await open(url);
-    }
-    // ── Signal handlers ─────────────────────────────────────────────────────
-    const shutdown = async (signal) => {
-        console.log(`\n⛔  ${signal} received — shutting down…`);
-        await tunnel.stop();
-        process.exit(0);
-    };
-    process.on("SIGINT", () => void shutdown("SIGINT"));
-    process.on("SIGTERM", () => void shutdown("SIGTERM"));
+    await open(url);
+  }
+  const shutdown = async (signal) => {
+    console.log(`
+\u26D4  ${signal} received, shutting down\u2026`);
+    await tunnel.stop();
+    process.exit(0);
+  };
+  process.on("SIGINT", () => void shutdown("SIGINT"));
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
 }
 main().catch((err) => {
-    console.error("[mcp-broker] Fatal error:", err);
-    process.exit(1);
+  console.error("[mcp-broker] Fatal error:", err);
+  process.exit(1);
 });
+//# sourceMappingURL=bin.js.map
 //# sourceMappingURL=bin.js.map