@cyanmycelium/mcp-broker 1.2.0 → 1.3.0

package/dist/bin.js

@@ -1,9 +1,92 @@
 #!/usr/bin/env node
-import { loadBrokerConfig, WsTunnelBuilder, loadMcpbBundle } from './chunk-FTDKH2C4.js';
+import { PACKAGE_NAME, VERSION, loadBrokerConfig, WsTunnelBuilder, loadMcpbBundle, BROKER_AGGREGATE_NAME, BROKER_PROVIDER_NAME, resolveOpenTarget } from './chunk-BZUZYXVA.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import open from 'open';
 
+var argv = process.argv.slice(2);
+if (argv.includes("--help") || argv.includes("-h")) {
+  printHelp();
+  process.exit(0);
+}
+if (argv.includes("--version") || argv.includes("-v")) {
+  process.stdout.write(`${PACKAGE_NAME} ${VERSION}
+`);
+  process.exit(0);
+}
+function printHelp() {
+  process.stdout.write(
+    `
+${PACKAGE_NAME} ${VERSION}
+WebSocket-based Model Context Protocol broker.
+
+USAGE
+  npx @cyanmycelium/mcp-broker             Start the broker (foreground)
+  npx @cyanmycelium/mcp-broker --help      Show this help
+  npx @cyanmycelium/mcp-broker --version   Print the version
+
+The broker takes no positional arguments. Configure it with a
+.mcp-broker/config.json file or MCP_BROKER_* environment variables
+(env vars win over the file).
+
+COMMON ENVIRONMENT VARIABLES
+  MCP_BROKER_CONFIG           Path to a JSON config file
+  MCP_BROKER_PORT             TCP port (default 3000)
+  MCP_BROKER_HOST             Bind interface (default 0.0.0.0)
+  MCP_BROKER_PROTOCOL         "http" | "https" (default: auto from TLS)
+  MCP_BROKER_TLS_CERT         PEM certificate path (enables HTTPS/WSS)
+  MCP_BROKER_TLS_KEY          PEM private key path
+  MCP_BROKER_STDIO_PROVIDER   Bridge stdin/stdout to this provider ("_all" is the safe target)
+  MCP_BROKER_LOCALE           Locale for _broker tool descriptions (default en)
+  MCP_BROKER_ALLOWED_ORIGINS  Comma-separated browser origins allowed on /<slot>/mcp,
+                              /<slot>/sse and /<slot>/messages (default: none pass)
+  MCP_BROKER_WWW_DIR          Serve this directory at "/"
+  MCP_BROKER_BUNDLE_DIR       Serve this directory at "/bundle"
+  MCP_BROKER_OPEN             "1" to open the root in a browser, or a path such as /app/
+
+ENDPOINT PATHS (change these only if every peer agrees)
+  MCP_BROKER_PROVIDER_PATH    Prefix for one provider per socket (default /provider);
+                              connect as <prefix>/<slot> with DirectTransport (plain frames)
+  MCP_BROKER_PROVIDERS_PATH   Exact path for many providers on one socket (default /providers);
+                              connect with MultiplexTransport (envelope frames)
+  MCP_BROKER_CLIENT_PATH      Prefix for raw WebSocket clients (default /)
+  MCP_BROKER_MCP_PATH         Streamable HTTP suffix (default /mcp)
+  MCP_BROKER_SSE_PATH         Legacy SSE stream suffix (default /sse)
+  MCP_BROKER_MESSAGES_PATH    Legacy SSE post suffix (default /messages)
+
+PROVIDER LIVENESS
+  MCP_BROKER_PROVIDER_HEARTBEAT_MS       Ping interval per provider socket (default 30000, 0 off)
+  MCP_BROKER_PROVIDER_REQUEST_TIMEOUT_MS Deadline for one provider answer (default 60000, 0 off)
+  MCP_BROKER_PROVIDER_TAKEOVER           reject | liveness | always (default liveness)
+
+AUTHORIZATION (OAuth 2.1, opt-in)
+  MCP_BROKER_AUTH_ENABLED     "1" to require bearer tokens on client endpoints
+  MCP_BROKER_PUBLIC_BASE_URL  Public origin, e.g. https://mcp.example.com
+  MCP_BROKER_JWKS             Authorization server JWKS URL
+  MCP_BROKER_ISSUER           Expected token issuer
+  MCP_BROKER_PROVIDER_SECRET  Shared secret required from providers
+
+CONFIG-FILE ONLY (no env var; .mcp-broker/config.json)
+  stdioUpstreams[]  Local MCP servers the broker spawns. NOT in _all unless "aggregate": true
+  mcpServers[]      Remote MCP servers the broker dials out to. In _all unless "aggregate": false
+  mcpbBundles[]     Signed .mcpb bundles, verified then spawned. In _all unless "aggregate": false
+  www.mounts[]      Several urlPrefix -> dir mappings (the env vars above mount one each)
+  allowedOrigins    Also accepts { "pattern": "<regexp>" }; the env var takes a list only
+  auth.*            Roles, assignments, denies, per-slot and per-provider scopes
+  brokerName        Library-only: no builder setter exists, so the CLI cannot forward it
+
+RESERVED SLOTS (always present, no provider needed)
+  _broker   Introspection: broker_info, providers_list, provider_status,
+            broker_guide (integration docs), broker_diagnose (live problem report)
+  _all      Live aggregate of every opted-in provider. The right target for
+            MCP_BROKER_STDIO_PROVIDER, since it exists before any provider connects.
+
+Start here: call broker_guide on the _broker slot for the integration guide.
+Full reference: https://github.com/pandaGaume/mcp-broker/tree/main/node
+
+`
+  );
+}
 var { config, baseDir } = loadBrokerConfig();
 var cwd = process.cwd();
 function envFromConfig(envName, configValue) {
@@ -17,9 +100,15 @@ envFromConfig("MCP_BROKER_PROTOCOL", config.protocol);
 envFromConfig("MCP_BROKER_LOCALE", config.locale);
 envFromConfig("MCP_BROKER_STDIO_PROVIDER", config.stdioProvider);
 envFromConfig("MCP_BROKER_PROVIDER_PATH", config.paths?.provider);
+envFromConfig("MCP_BROKER_PROVIDERS_PATH", config.paths?.providers);
 envFromConfig("MCP_BROKER_CLIENT_PATH", config.paths?.client);
 envFromConfig("MCP_BROKER_MCP_PATH", config.paths?.mcp);
-envFromConfig("MCP_BROKER_OPEN", config.www?.open === true ? "1" : void 0);
+envFromConfig("MCP_BROKER_SSE_PATH", config.paths?.sse);
+envFromConfig("MCP_BROKER_MESSAGES_PATH", config.paths?.messages);
+envFromConfig("MCP_BROKER_PROVIDER_HEARTBEAT_MS", config.providerHeartbeatIntervalMs);
+envFromConfig("MCP_BROKER_PROVIDER_REQUEST_TIMEOUT_MS", config.providerRequestTimeoutMs);
+envFromConfig("MCP_BROKER_PROVIDER_TAKEOVER", config.providerTakeover);
+envFromConfig("MCP_BROKER_OPEN", config.www?.open === true ? "1" : typeof config.www?.open === "string" ? config.www.open : void 0);
 envFromConfig("MCP_BROKER_AUTH_ENABLED", config.auth?.enabled === true ? "1" : void 0);
 envFromConfig("MCP_BROKER_PUBLIC_BASE_URL", config.auth?.publicBaseUrl);
 envFromConfig("MCP_BROKER_JWKS", config.auth?.jwks);
@@ -36,9 +125,11 @@ if (stdioProvider) {
 var port = parseInt(process.env["MCP_BROKER_PORT"] ?? "3000", 10);
 var host = process.env["MCP_BROKER_HOST"];
 var providerPath = process.env["MCP_BROKER_PROVIDER_PATH"] ?? "/provider";
+var providersPath = process.env["MCP_BROKER_PROVIDERS_PATH"] ?? "/providers";
 var clientPath = process.env["MCP_BROKER_CLIENT_PATH"] ?? "/";
 var mcpPath = process.env["MCP_BROKER_MCP_PATH"] ?? "/mcp";
-var ssePath = config.paths?.sse ?? "/sse";
+var ssePath = process.env["MCP_BROKER_SSE_PATH"] ?? "/sse";
+var messagesPath = process.env["MCP_BROKER_MESSAGES_PATH"] ?? "/messages";
 var tlsCertPath = process.env["MCP_BROKER_TLS_CERT"] ? path.resolve(cwd, process.env["MCP_BROKER_TLS_CERT"]) : config.tls?.cert ? path.resolve(baseDir, config.tls.cert) : null;
 var tlsKeyPath = process.env["MCP_BROKER_TLS_KEY"] ? path.resolve(cwd, process.env["MCP_BROKER_TLS_KEY"]) : config.tls?.key ? path.resolve(baseDir, config.tls.key) : null;
 var protocolOverride = process.env["MCP_BROKER_PROTOCOL"]?.toLowerCase();
@@ -51,6 +142,27 @@ if (protocolOverride === "https" && (!tlsCertPath || !tlsKeyPath)) {
   process.exit(1);
 }
 var useTls = protocolOverride === "http" ? false : protocolOverride === "https" ? true : !!(tlsCertPath && tlsKeyPath);
+function millisFromEnv(envName) {
+  const raw = process.env[envName];
+  if (raw === void 0 || raw.trim() === "") return void 0;
+  const value = Number(raw);
+  if (!Number.isFinite(value) || value < 0) {
+    console.warn(`[mcp-broker] Ignoring ${envName}="${raw}": expected a whole number of milliseconds (0 disables). Using the default.`);
+    return void 0;
+  }
+  return Math.floor(value);
+}
+var providerHeartbeatIntervalMs = millisFromEnv("MCP_BROKER_PROVIDER_HEARTBEAT_MS");
+var providerRequestTimeoutMs = millisFromEnv("MCP_BROKER_PROVIDER_REQUEST_TIMEOUT_MS");
+var takeoverRaw = process.env["MCP_BROKER_PROVIDER_TAKEOVER"]?.trim().toLowerCase();
+var providerTakeover;
+if (takeoverRaw) {
+  if (takeoverRaw === "reject" || takeoverRaw === "liveness" || takeoverRaw === "always") {
+    providerTakeover = takeoverRaw;
+  } else {
+    console.warn(`[mcp-broker] Ignoring MCP_BROKER_PROVIDER_TAKEOVER="${takeoverRaw}": expected "reject", "liveness" or "always". Using "liveness".`);
+  }
+}
 var envOrigins = process.env["MCP_BROKER_ALLOWED_ORIGINS"]?.split(",").map((origin) => origin.trim()).filter(Boolean);
 var allowedOrigins;
 if (envOrigins?.length) {
@@ -64,34 +176,74 @@ if (envOrigins?.length) {
     console.error(`[mcp-broker] Ignoring allowedOrigins.pattern: ${err.message}`);
   }
 }
+function describeAllowedOrigins() {
+  if (allowedOrigins instanceof RegExp) return `pattern ${String(allowedOrigins)}`;
+  if (allowedOrigins && allowedOrigins.length > 0) return allowedOrigins.join(", ");
+  return "none (set MCP_BROKER_ALLOWED_ORIGINS, or allowedOrigins in the config file). Requests carrying no Origin header (Claude Desktop, MCP Inspector, any server-side SDK) still pass";
+}
 var envWwwDir = process.env["MCP_BROKER_WWW_DIR"] ? path.resolve(cwd, process.env["MCP_BROKER_WWW_DIR"]) : null;
 var envBundleDir = process.env["MCP_BROKER_BUNDLE_DIR"] ? path.resolve(cwd, process.env["MCP_BROKER_BUNDLE_DIR"]) : null;
+function warnIfStdioTargetUnknown(target) {
+  const known = /* @__PURE__ */ new Set([
+    BROKER_AGGREGATE_NAME,
+    BROKER_PROVIDER_NAME,
+    ...(config.stdioUpstreams ?? []).map((u) => u.name),
+    ...(config.mcpServers ?? []).map((s) => s.name),
+    ...(config.mcpbBundles ?? []).map((b) => b.name)
+  ]);
+  if (known.has(target)) return;
+  const hosted = [...known].filter((name) => name !== BROKER_AGGREGATE_NAME && name !== BROKER_PROVIDER_NAME);
+  console.warn(
+    `[mcp-broker] MCP_BROKER_STDIO_PROVIDER="${target}" names a slot this broker does not host. Nothing answers on it until a WebSocket provider connects to ${providerPath}/${target} (or announces "${target}" on ${providersPath}), and until then every request from the MCP host, including the initial handshake, fails with 'Provider "${target}" not connected'. An MCP host that starts before that provider is up, which is always the case for a provider hosted in a browser page, will therefore never connect. Prefer MCP_BROKER_STDIO_PROVIDER="${BROKER_AGGREGATE_NAME}": it exists from startup, answers the handshake itself, unions every opted-in provider, and pushes notifications/tools/list_changed as providers join, so a page opened later appears live. Slots this broker hosts right now: ${hosted.length > 0 ? hosted.map((n) => `"${n}"`).join(", ") + `, plus the reserved "${BROKER_AGGREGATE_NAME}" and "${BROKER_PROVIDER_NAME}"` : `the reserved "${BROKER_AGGREGATE_NAME}" and "${BROKER_PROVIDER_NAME}" only`}.`
+  );
+}
 async function main() {
   const localGrammarsDir = path.join(baseDir, "grammars");
   const hasLocalGrammars = fs.existsSync(localGrammarsDir);
-  const builder = new WsTunnelBuilder().withPort(port).withProviderPath(providerPath).withClientPath(clientPath).withMcpPath(mcpPath);
+  const builder = new WsTunnelBuilder().withPort(port).withProviderPath(providerPath).withProvidersPath(providersPath).withClientPath(clientPath).withMcpPath(mcpPath).withSsePath(ssePath).withMessagesPath(messagesPath);
   if (host) {
     builder.withHost(host);
   }
+  if (providerHeartbeatIntervalMs !== void 0) {
+    builder.withProviderHeartbeat(providerHeartbeatIntervalMs);
+  }
+  if (providerRequestTimeoutMs !== void 0) {
+    builder.withProviderRequestTimeout(providerRequestTimeoutMs);
+  }
+  if (providerTakeover) {
+    builder.withProviderTakeover(providerTakeover);
+  }
   if (useTls) {
-    builder.withTlsFiles(tlsCertPath, tlsKeyPath);
+    try {
+      builder.withTlsFiles(tlsCertPath, tlsKeyPath);
+    } catch (err) {
+      throw new Error(
+        `TLS is enabled but the material could not be read: ${err.message}. Certificate: ${tlsCertPath}, key: ${tlsKeyPath}. Config-file paths are resolved against the config file's own directory, env-var paths against the current directory. Generate a development pair, point tls.cert/tls.key (or MCP_BROKER_TLS_CERT/MCP_BROKER_TLS_KEY) at real files, or run without TLS by removing the tls block and setting MCP_BROKER_PROTOCOL=http.`,
+        { cause: err }
+      );
+    }
   }
   if (allowedOrigins) {
     builder.withAllowedOrigins(allowedOrigins);
   }
+  const mountedPrefixes = [];
+  const mount = (urlPrefix, dir) => {
+    builder.withStaticMount(urlPrefix, dir);
+    mountedPrefixes.push(urlPrefix);
+  };
   if (envBundleDir && fs.existsSync(envBundleDir)) {
-    builder.withStaticMount("/bundle", envBundleDir);
+    mount("/bundle", envBundleDir);
   }
   if (envWwwDir && fs.existsSync(envWwwDir)) {
-    builder.withStaticMount("/", envWwwDir);
+    mount("/", envWwwDir);
   }
   if (config.www?.mounts) {
-    for (const mount of config.www.mounts) {
-      const abs = path.resolve(baseDir, mount.dir);
+    for (const entry of config.www.mounts) {
+      const abs = path.resolve(baseDir, entry.dir);
       if (fs.existsSync(abs)) {
-        builder.withStaticMount(mount.urlPrefix, abs);
+        mount(entry.urlPrefix, abs);
       } else {
-        console.warn(`[mcp-broker] www.mounts entry "${mount.urlPrefix}" \u2192 ${abs} skipped (directory not found).`);
+        console.warn(`[mcp-broker] www.mounts entry "${entry.urlPrefix}" \u2192 ${abs} skipped (directory not found).`);
       }
     }
   }
@@ -121,6 +273,7 @@ async function main() {
   }
   if (stdioProvider) {
     builder.withStdioClient(stdioProvider);
+    warnIfStdioTargetUnknown(stdioProvider);
   }
   if (hasLocalGrammars) {
     builder.withBrokerLocalGrammarsDir(localGrammarsDir);
@@ -169,26 +322,57 @@ async function main() {
   const localhost = `${httpScheme}://localhost:${port}`;
   const mcpSuffix = mcpPath.replace(/^\//, "");
   const sseSuffix = ssePath.replace(/^\//, "");
-  const hasWwwRoot = !!(envWwwDir && fs.existsSync(envWwwDir)) || (config.www?.mounts ?? []).some((m) => m.urlPrefix === "/");
+  const messagesSuffix = messagesPath.replace(/^\//, "");
   console.log();
   console.log(`\u2699\uFE0F  mcp-broker started${useTls ? " (TLS)" : ""}`);
   console.log(hr);
-  console.log(`\u{1F4E1}  Provider WebSocket    ${wsScheme}://localhost:${port}${providerPath}/<name>`);
+  console.log(`\u{1F4E1}  Provider WS direct    ${wsScheme}://localhost:${port}${providerPath}/<name>`);
+  console.log(`                          one provider per socket, plain JSON-RPC frames: use DirectTransport`);
+  console.log(`\u{1F9F5}  Provider WS multiplex ${wsScheme}://localhost:${port}${providersPath}`);
+  console.log(`                          many providers per socket, envelope frames: use MultiplexTransport`);
   console.log(`\u{1F50C}  MCP (Streamable HTTP) ${localhost}/<name>/${mcpSuffix}`);
-  console.log(`\u{1F4FA}  Legacy SSE            ${localhost}/<name>/${sseSuffix}`);
+  console.log(`\u{1F4FA}  Legacy SSE            ${localhost}/<name>/${sseSuffix}  +  POST ${localhost}/<name>/${messagesSuffix}`);
+  console.log(`\u{1F517}  Client WS (raw)       ${wsScheme}://localhost:${port}${clientPath === "/" ? "/" : clientPath}<name>`);
+  console.log(`                          bare JSON-RPC frames, no session layer; not origin-checked`);
+  console.log(`\u{1F9E9}  Reserved slots        ${BROKER_AGGREGATE_NAME}: live aggregate of every opted-in provider`);
+  console.log(`                          ${BROKER_PROVIDER_NAME}: broker_info, providers_list, provider_status, broker_guide, broker_diagnose`);
+  if (mountedPrefixes.length > 0) {
+    console.log(`\u{1F4C1}  Static mounts         ${mountedPrefixes.map((prefix) => `${localhost}${prefix === "/" ? "/" : prefix + "/"}`).join("  ")}`);
+  }
   if (hasLocalGrammars) {
     console.log(`\u{1F310}  Local grammars        ${localGrammarsDir}`);
   }
   console.log(`\u{1F510}  Authorization         ${authEnabled ? "OAuth 2.1 (Bearer required)" : "disabled (trusted network only)"}`);
   console.log(`\u{1F6E1}\uFE0F   Provider auth         ${providerSecret ? "shared secret required" : "disabled"}`);
+  console.log(`\u{1F30D}  Browser origins       ${describeAllowedOrigins()}`);
+  console.log(`                          enforced on /<name>/${mcpSuffix}, /<name>/${sseSuffix} and /<name>/${messagesSuffix}`);
+  if (!allowedOrigins) {
+    console.log(`                          a page this broker serves is refused too, list its origin to admit it`);
+  }
   console.log(hr);
+  console.log(`   New here? Call broker_guide on the ${BROKER_PROVIDER_NAME} slot: ${localhost}/${BROKER_PROVIDER_NAME}/${mcpSuffix}`);
   console.log(`   Press Ctrl+C to stop.`);
   console.log();
-  if (hasWwwRoot && process.env["MCP_BROKER_OPEN"] === "1") {
-    const url = `${localhost}/`;
-    console.log(`\u{1F680}  Opening browser: ${url}`);
-    console.log();
-    await open(url);
+  const openTarget = resolveOpenTarget(process.env["MCP_BROKER_OPEN"], localhost);
+  if (openTarget.error) {
+    console.warn(`[mcp-broker] ${openTarget.error}`);
+  } else if (openTarget.url && openTarget.path) {
+    const openUrl = openTarget.url;
+    const openPath = openTarget.path;
+    const covered = mountedPrefixes.some((prefix) => prefix === "/" || openPath === prefix || openPath.startsWith(prefix.endsWith("/") ? prefix : prefix + "/"));
+    if (!covered) {
+      console.warn(
+        `[mcp-broker] Not opening ${openUrl}: no static mount serves "${openPath}", so it would 404. ` + (mountedPrefixes.length > 0 ? `Mounted prefixes: ${mountedPrefixes.map((p) => `"${p}"`).join(", ")}.` : `No directory is mounted. Add one with MCP_BROKER_WWW_DIR=<dir> (serves it at "/") or a www.mounts entry in the config file.`)
+      );
+    } else {
+      console.log(`\u{1F680}  Opening browser: ${openUrl}`);
+      console.log();
+      try {
+        await open(openUrl);
+      } catch (err) {
+        console.warn(`[mcp-broker] Could not launch a browser for ${openUrl}: ${err.message}. The broker is running; open the URL yourself.`);
+      }
+    }
   }
   const shutdown = async (signal) => {
     console.log(`
@@ -200,7 +384,18 @@ async function main() {
   process.on("SIGTERM", () => void shutdown("SIGTERM"));
 }
 main().catch((err) => {
-  console.error("[mcp-broker] Fatal error:", err);
+  const message = err instanceof Error ? err.message : String(err);
+  console.error(`[mcp-broker] Cannot start: ${message}`);
+  const cause = err instanceof Error ? err.cause : void 0;
+  if (cause instanceof Error) {
+    const code = cause.code;
+    console.error(`[mcp-broker] Underlying error: ${code ? code + " " : ""}${cause.message}`);
+  }
+  if (!(err instanceof Error) || !message.includes(String(port))) {
+    console.error(
+      `[mcp-broker] Configuration in effect: host=${host ?? "0.0.0.0"} port=${port}. Set MCP_BROKER_PORT / MCP_BROKER_HOST, or "port" / "host" in .mcp-broker/config.json.`
+    );
+  }
   process.exit(1);
 });
 //# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/bin.ts"],"names":[],"mappings":";;;;;;AAgEA,IAAM,EAAE,MAAA,EAAQ,OAAA,EAAQ,GAAI,gBAAA,EAAiB;AAC7C,IAAM,GAAA,GAAM,QAAQ,GAAA,EAAI;AAQxB,SAAS,aAAA,CAAc,SAAiB,WAAA,EAA0D;AAC9F,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,WAAA,KAAgB,IAAA,EAAM;AACvD,EAAA,IAAI,OAAA,CAAQ,IAAI,OAAO,CAAA,KAAM,UAAa,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,KAAM,EAAA,EAAI;AACvE,EAAA,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,GAAI,MAAA,CAAO,WAAW,CAAA;AAC7C;AAEA,aAAA,CAAc,iBAAA,EAAmB,OAAO,IAAI,CAAA;AAC5C,aAAA,CAAc,iBAAA,EAAmB,OAAO,IAAI,CAAA;AAC5C,aAAA,CAAc,qBAAA,EAAuB,OAAO,QAAQ,CAAA;AACpD,aAAA,CAAc,mBAAA,EAAqB,OAAO,MAAM,CAAA;AAChD,aAAA,CAAc,2BAAA,EAA6B,OAAO,aAAa,CAAA;AAC/D,aAAA,CAAc,0BAAA,EAA4B,MAAA,CAAO,KAAA,EAAO,QAAQ,CAAA;AAChE,aAAA,CAAc,wBAAA,EAA0B,MAAA,CAAO,KAAA,EAAO,MAAM,CAAA;AAC5D,aAAA,CAAc,qBAAA,EAAuB,MAAA,CAAO,KAAA,EAAO,GAAG,CAAA;AACtD,aAAA,CAAc,mBAAmB,MAAA,CAAO,GAAA,EAAK,IAAA,KAAS,IAAA,GAAO,MAAM,MAAS,CAAA;AAC5E,aAAA,CAAc,2BAA2B,MAAA,CAAO,IAAA,EAAM,OAAA,KAAY,IAAA,GAAO,MAAM,MAAS,CAAA;AACxF,aAAA,CAAc,4BAAA,EAA8B,MAAA,CAAO,IAAA,EAAM,aAAa,CAAA;AACtE,aAAA,CAAc,iBAAA,EAAmB,MAAA,CAAO,IAAA,EAAM,IAAI,CAAA;AAClD,aAAA,CAAc,mBAAA,EAAqB,MAAA,CAAO,IAAA,EAAM,MAAM,CAAA;AACtD,aAAA,CAAc,4BAAA,EAA8B,MAAA,CAAO,IAAA,EAAM,cAAc,CAAA;AAEvE,IAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,2BAA2B,CAAA;AAG7D,IAAI,aAAA,EAAe;AACf,EAAA,MAAM,QAAA,GAAW,CAAA,GAAI,IAAA,KAAoB,OAAA,CAAQ,MAAA,CAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,IAAI,CAAA;AACnF,EAAA,OAAA,CAAQ,GAAA,GAAM,QAAA;AACd,EAAA,OAAA,CAAQ,IAAA,GAAO,QAAA;AACf,EAAA,OAAA,CAAQ,IAAA,GAAO,QAAA;AACf,EAAA,OAAA,CAAQ,KAAA,GAAQ,QAAA;AACpB;AAEA,IAAM,OAAO,QAAA,CAAS,OAAA,CAAQ,IAAI,iBAAiB,CAAA,IAAK,QAAQ,EAAE,CAAA;AAClE,IAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AAC1C,IAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,0BAA0B,CAAA,IAAK,WAAA;AAChE,IAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,wBAAwB,CAAA,IAAK,GAAA;AAC5D,IAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,qBAAqB,CAAA,IAAK,MAAA;AACtD,IAAM,OAAA,GAAU,MAAA,CAAO,KAAA,EAAO,GAAA,IAAO,MAAA;AAIrC,IAAM,WAAA,GAAc,QAAQ,GAAA,CAAI,qBAAqB,IAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,QAAQ,GAAA,CAAI,qBAAqB,CAAC,CAAA,GAAI,MAAA,CAAO,KAAK,IAAA,GAAY,IAAA,CAAA,OAAA,CAAQ,SAAS,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA,GAAI,IAAA;AAC7K,IAAM,UAAA,GAAa,QAAQ,GAAA,CAAI,oBAAoB,IAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,QAAQ,GAAA,CAAI,oBAAoB,CAAC,CAAA,GAAI,MAAA,CAAO,KAAK,GAAA,GAAW,IAAA,CAAA,OAAA,CAAQ,SAAS,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA;AAExK,IAAM,gBAAA,GAAmB,OAAA,CAAQ,GAAA,CAAI,qBAAqB,GAAG,WAAA,EAAY;AACzE,IAAI,gBAAA,KAAqB,MAAA,IAAa,gBAAA,KAAqB,MAAA,IAAU,qBAAqB,OAAA,EAAS;AAC/F,EAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,0CAAA,EAA6C,gBAAgB,CAAA,yBAAA,CAA2B,CAAA;AACtG,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AACA,IAAI,gBAAA,KAAqB,OAAA,KAAY,CAAC,WAAA,IAAe,CAAC,UAAA,CAAA,EAAa;AAC/D,EAAA,OAAA,CAAQ,MAAM,2GAA2G,CAAA;AACzH,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AAEA,IAAM,MAAA,GAAS,qBAAqB,MAAA,GAAS,KAAA,GAAQ,qBAAqB,OAAA,GAAU,IAAA,GAAO,CAAC,EAAE,WAAA,IAAe,UAAA,CAAA;AAM7G,IAAM,aAAa,OAAA,CAAQ,GAAA,CAAI,4BAA4B,CAAA,EACrD,MAAM,GAAG,CAAA,CACV,GAAA,CAAI,CAAC,WAAW,MAAA,CAAO,IAAA,EAAM,CAAA,CAC7B,OAAO,OAAO,CAAA;AAEnB,IAAI,cAAA;AACJ,IAAI,YAAY,MAAA,EAAQ;AACpB,EAAA,cAAA,GAAiB,UAAA;AACrB,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,cAAc,CAAA,EAAG;AAC7C,EAAA,cAAA,GAAiB,MAAA,CAAO,cAAA;AAC5B,CAAA,MAAA,IAAW,OAAO,cAAA,EAAgB;AAC9B,EAAA,IAAI;AACA,IAAA,cAAA,GAAiB,IAAI,MAAA,CAAO,MAAA,CAAO,eAAe,OAAA,EAAS,MAAA,CAAO,eAAe,KAAK,CAAA;AAAA,EAC1F,SAAS,GAAA,EAAK;AAGV,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,8CAAA,EAAkD,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,EAC3F;AACJ;AAGA,IAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,oBAAoB,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,CAAI,oBAAoB,CAAC,CAAA,GAAI,IAAA;AAC7G,IAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAC,CAAA,GAAI,IAAA;AAMtH,eAAe,IAAA,GAAsB;AAGjC,EAAA,MAAM,gBAAA,GAAwB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AACtD,EAAA,MAAM,gBAAA,GAAsB,cAAW,gBAAgB,CAAA;AAEvD,EAAA,MAAM,OAAA,GAAU,IAAI,eAAA,EAAgB,CAAE,SAAS,IAAI,CAAA,CAAE,gBAAA,CAAiB,YAAY,CAAA,CAAE,cAAA,CAAe,UAAU,CAAA,CAAE,YAAY,OAAO,CAAA;AAElI,EAAA,IAAI,IAAA,EAAM;AACN,IAAA,OAAA,CAAQ,SAAS,IAAI,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,MAAA,EAAQ;AACR,IAAA,OAAA,CAAQ,YAAA,CAAa,aAAc,UAAW,CAAA;AAAA,EAClD;AAEA,EAAA,IAAI,cAAA,EAAgB;AAChB,IAAA,OAAA,CAAQ,mBAAmB,cAAc,CAAA;AAAA,EAC7C;AAOA,EAAA,IAAI,YAAA,IAAmB,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC7C,IAAA,OAAA,CAAQ,eAAA,CAAgB,WAAW,YAAY,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,SAAA,IAAgB,EAAA,CAAA,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,IAAA,OAAA,CAAQ,eAAA,CAAgB,KAAK,SAAS,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,MAAA,CAAO,KAAK,MAAA,EAAQ;AACpB,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,GAAA,CAAI,MAAA,EAAQ;AACnC,MAAA,MAAM,GAAA,GAAW,IAAA,CAAA,OAAA,CAAQ,OAAA,EAAS,KAAA,CAAM,GAAG,CAAA;AAC3C,MAAA,IAAO,EAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AACpB,QAAA,OAAA,CAAQ,eAAA,CAAgB,KAAA,CAAM,SAAA,EAAW,GAAG,CAAA;AAAA,MAChD,CAAA,MAAO;AACH,QAAA,OAAA,CAAQ,KAAK,CAAA,+BAAA,EAAkC,KAAA,CAAM,SAAS,CAAA,SAAA,EAAO,GAAG,CAAA,+BAAA,CAAiC,CAAA;AAAA,MAC7G;AAAA,IACJ;AAAA,EACJ;AAGA,EAAA,IAAI,OAAO,cAAA,EAAgB;AACvB,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,cAAA,EAAgB;AACnC,MAAA,OAAA,CAAQ,iBAAA,CAAkB;AAAA,QACtB,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,KAAK,CAAA,CAAE,GAAA;AAAA,QACP,WAAW,CAAA,CAAE;AAAA,OAChB,CAAA;AAAA,IACL;AAAA,EACJ;AAKA,EAAA,IAAI,OAAO,UAAA,EAAY;AACnB,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,UAAA,EAAY;AAC/B,MAAA,OAAA,CAAQ,kBAAA,CAAmB,EAAE,GAAG,CAAA,EAAG,WAAW,CAAA,CAAE,SAAA,IAAa,MAAM,CAAA;AAAA,IACvE;AAAA,EACJ;AAMA,EAAA,IAAI,OAAO,WAAA,EAAa;AACpB,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,WAAA,EAAa;AAChC,MAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,CAAA,EAAG,OAAO,CAAA;AAChD,MAAA,IAAI,QAAA,EAAU;AACV,QAAA,OAAA,CAAQ,kBAAkB,QAAQ,CAAA;AAAA,MACtC;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,IAAI,aAAA,EAAe;AACf,IAAA,OAAA,CAAQ,gBAAgB,aAAa,CAAA;AAAA,EACzC;AAEA,EAAA,IAAI,gBAAA,EAAkB;AAClB,IAAA,OAAA,CAAQ,2BAA2B,gBAAgB,CAAA;AAAA,EACvD;AAKA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,GAAA,CAAI,yBAAyB,CAAA;AAC5D,EAAA,MAAM,WAAA,GAAc,cAAA,KAAmB,GAAA,IAAO,cAAA,KAAmB,MAAA;AACjE,EAAA,IAAI,WAAA,EAAa;AACb,IAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,4BAA4B,CAAA;AAC9D,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AAC1C,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAC9C,IAAA,MAAM,oBAAA,GAAuB,OAAO,IAAA,EAAM,oBAAA,KAAyB,SAAS,CAAC,MAAM,IAAI,EAAC,CAAA;AACxF,IAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,IAAA,IAAQ,oBAAA,CAAqB,WAAW,CAAA,EAAG;AAC9D,MAAA,OAAA,CAAQ,KAAA;AAAA,QACJ;AAAA,OAGJ;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAClB;AACA,IAAA,OAAA,CAAQ,WAAA,CAAY;AAAA,MAChB,aAAA;AAAA,MACA,oBAAA;AAAA,MACA,OAAA,EAAS,IAAA;AAAA,MACT,MAAA;AAAA,MACA,eAAA,EAAiB,OAAO,IAAA,EAAM,eAAA;AAAA,MAC9B,cAAA,EAAgB,OAAO,IAAA,EAAM,cAAA;AAAA,MAC7B,aAAA,EAAe,OAAO,IAAA,EAAM,aAAA;AAAA,MAC5B,cAAA,EAAgB,OAAO,IAAA,EAAM,cAAA;AAAA,MAC7B,cAAA,EAAgB,OAAO,IAAA,EAAM,cAAA;AAAA,MAC7B,KAAA,EAAO,OAAO,IAAA,EAAM,KAAA;AAAA,MACpB,WAAA,EAAa,OAAO,IAAA,EAAM,WAAA;AAAA,MAC1B,MAAA,EAAQ,OAAO,IAAA,EAAM,MAAA;AAAA,MACrB,aAAA,EAAe,OAAO,IAAA,EAAM,aAAA;AAAA,MAC5B,gBAAA,EAAkB,OAAO,IAAA,EAAM,gBAAA;AAAA,MAC/B,wBAAA,EAA0B,OAAO,IAAA,EAAM,wBAAA;AAAA,MACvC,KAAA,EAAO,OAAO,IAAA,EAAM;AAAA,KACvB,CAAA;AAAA,EACL;AAKA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,GAAA,CAAI,4BAA4B,CAAA;AAC/D,EAAA,IAAI,cAAA,EAAgB;AAChB,IAAA,OAAA,CAAQ,mBAAmB,cAAc,CAAA;AAAA,EAC7C;AAEA,EAAA,MAAM,MAAA,GAAS,QAAQ,KAAA,EAAM;AAC7B,EAAA,MAAM,OAAO,KAAA,EAAM;AAGnB,EAAA,MAAM,UAAA,GAAa,SAAS,OAAA,GAAU,MAAA;AACtC,EAAA,MAAM,QAAA,GAAW,SAAS,KAAA,GAAQ,IAAA;AAClC,EAAA,MAAM,EAAA,GAAK,QAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AACxB,EAAA,MAAM,SAAA,GAAY,CAAA,EAAG,UAAU,CAAA,aAAA,EAAgB,IAAI,CAAA,CAAA;AACnD,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC3C,EAAA,MAAM,aAAa,CAAC,EAAE,SAAA,IAAgB,EAAA,CAAA,UAAA,CAAW,SAAS,CAAA,CAAA,IAAA,CAAO,MAAA,CAAO,GAAA,EAAK,MAAA,IAAU,EAAC,EAAG,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,GAAG,CAAA;AAE1H,EAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,gCAAA,EAAyB,MAAA,GAAS,QAAA,GAAW,EAAE,CAAA,CAAE,CAAA;AAC7D,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,IAAI,CAAA,iCAAA,EAA6B,QAAQ,gBAAgB,IAAI,CAAA,EAAG,YAAY,CAAA,OAAA,CAAS,CAAA;AAC7F,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,SAAS,CAAA,QAAA,EAAW,SAAS,CAAA,CAAE,CAAA;AACxE,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,SAAS,CAAA,QAAA,EAAW,SAAS,CAAA,CAAE,CAAA;AACxE,EAAA,IAAI,gBAAA,EAAkB;AAClB,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,gBAAgB,CAAA,CAAE,CAAA;AAAA,EAC/D;AACA,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,WAAA,GAAc,6BAAA,GAAgC,iCAAiC,CAAA,CAAE,CAAA;AAC1H,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,wCAAA,EAA+B,cAAA,GAAiB,wBAAA,GAA2B,UAAU,CAAA,CAAE,CAAA;AACnG,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,IAAI,CAAA,wBAAA,CAA0B,CAAA;AACtC,EAAA,OAAA,CAAQ,GAAA,EAAI;AAIZ,EAAA,IAAI,UAAA,IAAc,OAAA,CAAQ,GAAA,CAAI,iBAAiB,MAAM,GAAA,EAAK;AACtD,IAAA,MAAM,GAAA,GAAM,GAAG,SAAS,CAAA,CAAA,CAAA;AACxB,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,4BAAA,EAAwB,GAAG,CAAA,CAAE,CAAA;AACzC,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,MAAM,KAAK,GAAG,CAAA;AAAA,EAClB;AAGA,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,KAAkC;AACtD,IAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,QAAA,EAAQ,MAAM,CAAA,8BAAA,CAA2B,CAAA;AACrD,IAAA,MAAM,OAAO,IAAA,EAAK;AAClB,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAClB,CAAA;AAEA,EAAA,OAAA,CAAQ,GAAG,QAAA,EAAU,MAAM,KAAK,QAAA,CAAS,QAAQ,CAAC,CAAA;AAClD,EAAA,OAAA,CAAQ,GAAG,SAAA,EAAW,MAAM,KAAK,QAAA,CAAS,SAAS,CAAC,CAAA;AACxD;AAEA,IAAA,EAAK,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AAC3B,EAAA,OAAA,CAAQ,KAAA,CAAM,6BAA6B,GAAG,CAAA;AAC9C,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB,CAAC,CAAA","file":"bin.js","sourcesContent":["#!/usr/bin/env node\n/**\n * Standalone entry-point that starts the mcp-broker WebSocket server.\n *\n * ## Configuration sources (highest priority first)\n *\n * 1. Environment variables (`MCP_BROKER_*`).\n * 2. JSON config file. Resolved in order:\n *    a. `MCP_BROKER_CONFIG` env var.\n *    b. `./.mcp-broker/config.json` in the current working directory.\n *    c. `./mcp-broker.config.json` (legacy, with a deprecation warning).\n * 3. Built-in defaults.\n *\n * ## Path resolution\n *\n * - Env-var paths (`MCP_BROKER_*_DIR`, `MCP_BROKER_TLS_*`) are resolved\n *   against `process.cwd()`.\n * - Config-file paths (`tls.cert`, `www.mounts[*].dir`, `stdioUpstreams[*]`,\n *   `mcpbBundles[*]`) are resolved against the **config file's directory**: so a config in\n *   `./.mcp-broker/config.json` referring to `\"certs/cert.pem\"` points at\n *   `./.mcp-broker/certs/cert.pem`. The folder is self-contained.\n *\n * ## Local grammar overrides\n *\n * When `.mcp-broker/grammars/<userAgent>/<locale>.json` files exist next to\n * the config file, they are merged **on top of** the packaged grammars. Lets\n * users customize tool/resource descriptions for their organization without\n * forking the package.\n *\n * ## Environment variables\n *\n * | Variable                       | Default  | Notes                                                  |\n * |--------------------------------|----------|--------------------------------------------------------|\n * | MCP_BROKER_CONFIG              | (none)   | Path to a JSON config file (see above).                |\n * | MCP_BROKER_PORT                | 3000     |                                                        |\n * | MCP_BROKER_HOST                | 0.0.0.0  |                                                        |\n * | MCP_BROKER_PROVIDER_PATH       | /provider| Prefix for provider WS                                 |\n * | MCP_BROKER_CLIENT_PATH         | /        | Prefix for raw WS clients                              |\n * | MCP_BROKER_MCP_PATH            | /mcp     | Suffix for Streamable HTTP transport                   |\n * | MCP_BROKER_WWW_DIR             | (none)   | Ergonomic shortcut: mount this directory at \"/\"        |\n * | MCP_BROKER_BUNDLE_DIR          | (none)   | Ergonomic shortcut: mount this directory at \"/bundle\"  |\n * | MCP_BROKER_OPEN                | (unset)  | \"1\" to auto-launch the default browser at the root URL |\n * | MCP_BROKER_TLS_CERT            | (none)   | Path to a PEM TLS certificate                          |\n * | MCP_BROKER_TLS_KEY             | (none)   | Path to a PEM private key                              |\n * | MCP_BROKER_PROTOCOL            | auto     | \"http\" to force plain, \"https\" to force TLS, otherwise |\n * |                                |          | TLS is enabled iff cert+key are both set               |\n * | MCP_BROKER_STDIO_PROVIDER      | (none)   | When set, stdin/stdout carry JSON-RPC for the named    |\n * |                                |          | provider (Claude Desktop bridge).                      |\n * | MCP_BROKER_LOCALE              | en       | Locale used for tool descriptions on the `_broker`     |\n * |                                |          | slot. ISO 639-1 base; regional variants accepted.      |\n * | MCP_BROKER_ALLOWED_ORIGINS     | (none)   | Comma-separated browser origins allowed on             |\n * |                                |          | `/<slot>/mcp`. None means no browser origin passes.    |\n */\nimport * as fs from \"fs\";\nimport * as path from \"path\";\nimport open from \"open\";\nimport { WsTunnelBuilder } from \"./index\";\nimport { loadBrokerConfig } from \"./config\";\nimport { loadMcpbBundle } from \"./mcpb/mcpb.loader\";\n\n// ---------------------------------------------------------------------------\n// Configuration\n// ---------------------------------------------------------------------------\n\nconst { config, baseDir } = loadBrokerConfig();\nconst cwd = process.cwd();\n\n/**\n * Fills an env var from the config file when the env var is not already set.\n * Used for **non-path** scalars, path-bearing fields are read directly so\n * they can be resolved against `baseDir` (config file's directory) instead\n * of `cwd` (deploy environment).\n */\nfunction envFromConfig(envName: string, configValue: string | number | boolean | undefined): void {\n    if (configValue === undefined || configValue === null) return;\n    if (process.env[envName] !== undefined && process.env[envName] !== \"\") return;\n    process.env[envName] = String(configValue);\n}\n\nenvFromConfig(\"MCP_BROKER_PORT\", config.port);\nenvFromConfig(\"MCP_BROKER_HOST\", config.host);\nenvFromConfig(\"MCP_BROKER_PROTOCOL\", config.protocol);\nenvFromConfig(\"MCP_BROKER_LOCALE\", config.locale);\nenvFromConfig(\"MCP_BROKER_STDIO_PROVIDER\", config.stdioProvider);\nenvFromConfig(\"MCP_BROKER_PROVIDER_PATH\", config.paths?.provider);\nenvFromConfig(\"MCP_BROKER_CLIENT_PATH\", config.paths?.client);\nenvFromConfig(\"MCP_BROKER_MCP_PATH\", config.paths?.mcp);\nenvFromConfig(\"MCP_BROKER_OPEN\", config.www?.open === true ? \"1\" : undefined);\nenvFromConfig(\"MCP_BROKER_AUTH_ENABLED\", config.auth?.enabled === true ? \"1\" : undefined);\nenvFromConfig(\"MCP_BROKER_PUBLIC_BASE_URL\", config.auth?.publicBaseUrl);\nenvFromConfig(\"MCP_BROKER_JWKS\", config.auth?.jwks);\nenvFromConfig(\"MCP_BROKER_ISSUER\", config.auth?.issuer);\nenvFromConfig(\"MCP_BROKER_PROVIDER_SECRET\", config.auth?.providerSecret);\n\nconst stdioProvider = process.env[\"MCP_BROKER_STDIO_PROVIDER\"];\n\n// In stdio mode stdout is reserved for JSON-RPC, redirect all console output to stderr.\nif (stdioProvider) {\n    const toStderr = (...args: unknown[]) => process.stderr.write(args.join(\" \") + \"\\n\");\n    console.log = toStderr;\n    console.info = toStderr;\n    console.warn = toStderr;\n    console.error = toStderr;\n}\n\nconst port = parseInt(process.env[\"MCP_BROKER_PORT\"] ?? \"3000\", 10);\nconst host = process.env[\"MCP_BROKER_HOST\"];\nconst providerPath = process.env[\"MCP_BROKER_PROVIDER_PATH\"] ?? \"/provider\";\nconst clientPath = process.env[\"MCP_BROKER_CLIENT_PATH\"] ?? \"/\";\nconst mcpPath = process.env[\"MCP_BROKER_MCP_PATH\"] ?? \"/mcp\";\nconst ssePath = config.paths?.sse ?? \"/sse\";\n\n// ── TLS material ─────────────────────────────────────────────────────────────\n// Env var (relative to cwd) wins over config (relative to baseDir).\nconst tlsCertPath = process.env[\"MCP_BROKER_TLS_CERT\"] ? path.resolve(cwd, process.env[\"MCP_BROKER_TLS_CERT\"]) : config.tls?.cert ? path.resolve(baseDir, config.tls.cert) : null;\nconst tlsKeyPath = process.env[\"MCP_BROKER_TLS_KEY\"] ? path.resolve(cwd, process.env[\"MCP_BROKER_TLS_KEY\"]) : config.tls?.key ? path.resolve(baseDir, config.tls.key) : null;\n\nconst protocolOverride = process.env[\"MCP_BROKER_PROTOCOL\"]?.toLowerCase();\nif (protocolOverride !== undefined && protocolOverride !== \"http\" && protocolOverride !== \"https\") {\n    console.error(`[mcp-broker] Invalid MCP_BROKER_PROTOCOL=\"${protocolOverride}\". Use \"http\" or \"https\".`);\n    process.exit(1);\n}\nif (protocolOverride === \"https\" && (!tlsCertPath || !tlsKeyPath)) {\n    console.error(\"[mcp-broker] MCP_BROKER_PROTOCOL=https requires TLS cert+key (via config.tls or MCP_BROKER_TLS_CERT/KEY).\");\n    process.exit(1);\n}\n\nconst useTls = protocolOverride === \"http\" ? false : protocolOverride === \"https\" ? true : !!(tlsCertPath && tlsKeyPath);\n\n// ── Allowed browser origins for /<slot>/mcp ──────────────────────────────────\n// Absent leaves the endpoint closed to browsers, which is the safe default.\n// The env var only carries the list form; a pattern needs the config file,\n// since a regular expression cannot survive comma-splitting.\nconst envOrigins = process.env[\"MCP_BROKER_ALLOWED_ORIGINS\"]\n    ?.split(\",\")\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n\nlet allowedOrigins: readonly string[] | RegExp | undefined;\nif (envOrigins?.length) {\n    allowedOrigins = envOrigins;\n} else if (Array.isArray(config.allowedOrigins)) {\n    allowedOrigins = config.allowedOrigins;\n} else if (config.allowedOrigins) {\n    try {\n        allowedOrigins = new RegExp(config.allowedOrigins.pattern, config.allowedOrigins.flags);\n    } catch (err) {\n        // Falling back to the closed default rather than starting with a rule\n        // the operator believes is in force but which never compiled.\n        console.error(`[mcp-broker] Ignoring allowedOrigins.pattern: ${(err as Error).message}`);\n    }\n}\n\n// ── Env-var static mount shortcuts (relative to cwd) ─────────────────────────\nconst envWwwDir = process.env[\"MCP_BROKER_WWW_DIR\"] ? path.resolve(cwd, process.env[\"MCP_BROKER_WWW_DIR\"]) : null;\nconst envBundleDir = process.env[\"MCP_BROKER_BUNDLE_DIR\"] ? path.resolve(cwd, process.env[\"MCP_BROKER_BUNDLE_DIR\"]) : null;\n\n// ---------------------------------------------------------------------------\n// Server bootstrap\n// ---------------------------------------------------------------------------\n\nasync function main(): Promise<void> {\n    // Local grammar overrides: when `<baseDir>/grammars/` exists, the broker\n    // server merges those JSON files on top of the packaged grammars.\n    const localGrammarsDir = path.join(baseDir, \"grammars\");\n    const hasLocalGrammars = fs.existsSync(localGrammarsDir);\n\n    const builder = new WsTunnelBuilder().withPort(port).withProviderPath(providerPath).withClientPath(clientPath).withMcpPath(mcpPath);\n\n    if (host) {\n        builder.withHost(host);\n    }\n\n    if (useTls) {\n        builder.withTlsFiles(tlsCertPath!, tlsKeyPath!);\n    }\n\n    if (allowedOrigins) {\n        builder.withAllowedOrigins(allowedOrigins);\n    }\n\n    // ── Static mounts ────────────────────────────────────────────────────────\n    // First the env-var shortcuts (relative to cwd), then the config `www.mounts`\n    // (relative to baseDir). Order matters: /bundle before / so the prefix router\n    // can distinguish them. Subsequent registrations contribute additional mounts;\n    // longest-prefix match wins at runtime.\n    if (envBundleDir && fs.existsSync(envBundleDir)) {\n        builder.withStaticMount(\"/bundle\", envBundleDir);\n    }\n    if (envWwwDir && fs.existsSync(envWwwDir)) {\n        builder.withStaticMount(\"/\", envWwwDir);\n    }\n    if (config.www?.mounts) {\n        for (const mount of config.www.mounts) {\n            const abs = path.resolve(baseDir, mount.dir);\n            if (fs.existsSync(abs)) {\n                builder.withStaticMount(mount.urlPrefix, abs);\n            } else {\n                console.warn(`[mcp-broker] www.mounts entry \"${mount.urlPrefix}\" → ${abs} skipped (directory not found).`);\n            }\n        }\n    }\n\n    // ── Stdio upstreams ──────────────────────────────────────────────────────\n    if (config.stdioUpstreams) {\n        for (const u of config.stdioUpstreams) {\n            builder.withStdioUpstream({\n                name: u.name,\n                command: u.command,\n                args: u.args,\n                env: u.env as NodeJS.ProcessEnv | undefined,\n                aggregate: u.aggregate,\n            });\n        }\n    }\n\n    // ── Remote MCP server upstreams (reached by URL) ─────────────────────────\n    // Config-discovered remote servers join the `_all` aggregate by default;\n    // an explicit `aggregate: false` opts an entry out.\n    if (config.mcpServers) {\n        for (const s of config.mcpServers) {\n            builder.withRemoteUpstream({ ...s, aggregate: s.aggregate ?? true });\n        }\n    }\n\n    // ── Local `.mcpb` bundles ────────────────────────────────────────────────\n    // Each bundle is signature-verified and unpacked before it is wired in as a\n    // stdio upstream. A refused bundle is skipped (loadMcpbBundle logs why); it\n    // never spawns a process. Bundles join `_all` by default (opt-out per entry).\n    if (config.mcpbBundles) {\n        for (const b of config.mcpbBundles) {\n            const upstream = await loadMcpbBundle(b, baseDir);\n            if (upstream) {\n                builder.withStdioUpstream(upstream);\n            }\n        }\n    }\n\n    if (stdioProvider) {\n        builder.withStdioClient(stdioProvider);\n    }\n\n    if (hasLocalGrammars) {\n        builder.withBrokerLocalGrammarsDir(localGrammarsDir);\n    }\n\n    // ── Authorization (OAuth 2.1 resource server) ────────────────────────────\n    // Opt-in: only wired when MCP_BROKER_AUTH_ENABLED / config.auth.enabled is on.\n    // Env scalars win over config; array/object fields are read from config.\n    const authEnabledEnv = process.env[\"MCP_BROKER_AUTH_ENABLED\"];\n    const authEnabled = authEnabledEnv === \"1\" || authEnabledEnv === \"true\";\n    if (authEnabled) {\n        const publicBaseUrl = process.env[\"MCP_BROKER_PUBLIC_BASE_URL\"];\n        const jwks = process.env[\"MCP_BROKER_JWKS\"];\n        const issuer = process.env[\"MCP_BROKER_ISSUER\"];\n        const authorizationServers = config.auth?.authorizationServers ?? (issuer ? [issuer] : []);\n        if (!publicBaseUrl || !jwks || authorizationServers.length === 0) {\n            console.error(\n                \"[mcp-broker] auth.enabled requires publicBaseUrl, jwks, and at least one \" +\n                    \"authorizationServers entry (or issuer). Set them via config.auth or \" +\n                    \"MCP_BROKER_PUBLIC_BASE_URL / MCP_BROKER_JWKS / MCP_BROKER_ISSUER.\"\n            );\n            process.exit(1);\n        }\n        builder.withJwtAuth({\n            publicBaseUrl,\n            authorizationServers,\n            jwksUri: jwks,\n            issuer,\n            scopesSupported: config.auth?.scopesSupported,\n            requiredScopes: config.auth?.requiredScopes,\n            perSlotScopes: config.auth?.perSlotScopes,\n            providerScopes: config.auth?.providerScopes,\n            subjectMapping: config.auth?.subjectMapping,\n            roles: config.auth?.roles,\n            assignments: config.auth?.assignments,\n            denies: config.auth?.denies,\n            slotResources: config.auth?.slotResources,\n            toolCapabilities: config.auth?.toolCapabilities,\n            providerToolCapabilities: config.auth?.providerToolCapabilities,\n            audit: config.auth?.audit,\n        });\n    }\n\n    // ── Provider authentication (independent of client OAuth) ────────────────\n    // Requires every provider connecting to /provider/<slot> or /providers to\n    // present the shared secret, closes off slot occupation by strangers.\n    const providerSecret = process.env[\"MCP_BROKER_PROVIDER_SECRET\"];\n    if (providerSecret) {\n        builder.withProviderSecret(providerSecret);\n    }\n\n    const tunnel = builder.build();\n    await tunnel.start();\n\n    // ── Startup banner ──────────────────────────────────────────────────────\n    const httpScheme = useTls ? \"https\" : \"http\";\n    const wsScheme = useTls ? \"wss\" : \"ws\";\n    const hr = \"─\".repeat(64);\n    const localhost = `${httpScheme}://localhost:${port}`;\n    const mcpSuffix = mcpPath.replace(/^\\//, \"\");\n    const sseSuffix = ssePath.replace(/^\\//, \"\");\n    const hasWwwRoot = !!(envWwwDir && fs.existsSync(envWwwDir)) || (config.www?.mounts ?? []).some((m) => m.urlPrefix === \"/\");\n\n    console.log();\n    console.log(`⚙️  mcp-broker started${useTls ? \" (TLS)\" : \"\"}`);\n    console.log(hr);\n    console.log(`📡  Provider WebSocket    ${wsScheme}://localhost:${port}${providerPath}/<name>`);\n    console.log(`🔌  MCP (Streamable HTTP) ${localhost}/<name>/${mcpSuffix}`);\n    console.log(`📺  Legacy SSE            ${localhost}/<name>/${sseSuffix}`);\n    if (hasLocalGrammars) {\n        console.log(`🌐  Local grammars        ${localGrammarsDir}`);\n    }\n    console.log(`🔐  Authorization         ${authEnabled ? \"OAuth 2.1 (Bearer required)\" : \"disabled (trusted network only)\"}`);\n    console.log(`🛡️   Provider auth         ${providerSecret ? \"shared secret required\" : \"disabled\"}`);\n    console.log(hr);\n    console.log(`   Press Ctrl+C to stop.`);\n    console.log();\n\n    // Auto-launch browser only if explicitly opted in via MCP_BROKER_OPEN=1\n    // AND a mount at \"/\" is configured.\n    if (hasWwwRoot && process.env[\"MCP_BROKER_OPEN\"] === \"1\") {\n        const url = `${localhost}/`;\n        console.log(`🚀  Opening browser: ${url}`);\n        console.log();\n        await open(url);\n    }\n\n    // ── Signal handlers ─────────────────────────────────────────────────────\n    const shutdown = async (signal: string): Promise<void> => {\n        console.log(`\\n⛔  ${signal} received, shutting down…`);\n        await tunnel.stop();\n        process.exit(0);\n    };\n\n    process.on(\"SIGINT\", () => void shutdown(\"SIGINT\"));\n    process.on(\"SIGTERM\", () => void shutdown(\"SIGTERM\"));\n}\n\nmain().catch((err: unknown) => {\n    console.error(\"[mcp-broker] Fatal error:\", err);\n    process.exit(1);\n});\n"]}
+{"version":3,"sources":["../src/bin.ts"],"names":[],"mappings":";;;;;;AAyEA,IAAM,IAAA,GAAO,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAEjC,IAAI,KAAK,QAAA,CAAS,QAAQ,KAAK,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAAG;AAChD,EAAA,SAAA,EAAU;AACV,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AACA,IAAI,KAAK,QAAA,CAAS,WAAW,KAAK,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAAG;AACnD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,YAAY,IAAI,OAAO;AAAA,CAAI,CAAA;AACnD,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AAEA,SAAS,SAAA,GAAkB;AACvB,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACX;AAAA,EAAK,YAAY,IAAI,OAAO;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA,GAyDhC;AACJ;AAMA,IAAM,EAAE,MAAA,EAAQ,OAAA,EAAQ,GAAI,gBAAA,EAAiB;AAC7C,IAAM,GAAA,GAAM,QAAQ,GAAA,EAAI;AAQxB,SAAS,aAAA,CAAc,SAAiB,WAAA,EAA0D;AAC9F,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,WAAA,KAAgB,IAAA,EAAM;AACvD,EAAA,IAAI,OAAA,CAAQ,IAAI,OAAO,CAAA,KAAM,UAAa,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,KAAM,EAAA,EAAI;AACvE,EAAA,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,GAAI,MAAA,CAAO,WAAW,CAAA;AAC7C;AAEA,aAAA,CAAc,iBAAA,EAAmB,OAAO,IAAI,CAAA;AAC5C,aAAA,CAAc,iBAAA,EAAmB,OAAO,IAAI,CAAA;AAC5C,aAAA,CAAc,qBAAA,EAAuB,OAAO,QAAQ,CAAA;AACpD,aAAA,CAAc,mBAAA,EAAqB,OAAO,MAAM,CAAA;AAChD,aAAA,CAAc,2BAAA,EAA6B,OAAO,aAAa,CAAA;AAC/D,aAAA,CAAc,0BAAA,EAA4B,MAAA,CAAO,KAAA,EAAO,QAAQ,CAAA;AAChE,aAAA,CAAc,2BAAA,EAA6B,MAAA,CAAO,KAAA,EAAO,SAAS,CAAA;AAClE,aAAA,CAAc,wBAAA,EAA0B,MAAA,CAAO,KAAA,EAAO,MAAM,CAAA;AAC5D,aAAA,CAAc,qBAAA,EAAuB,MAAA,CAAO,KAAA,EAAO,GAAG,CAAA;AACtD,aAAA,CAAc,qBAAA,EAAuB,MAAA,CAAO,KAAA,EAAO,GAAG,CAAA;AACtD,aAAA,CAAc,0BAAA,EAA4B,MAAA,CAAO,KAAA,EAAO,QAAQ,CAAA;AAChE,aAAA,CAAc,kCAAA,EAAoC,OAAO,2BAA2B,CAAA;AACpF,aAAA,CAAc,wCAAA,EAA0C,OAAO,wBAAwB,CAAA;AACvF,aAAA,CAAc,8BAAA,EAAgC,OAAO,gBAAgB,CAAA;AAIrE,aAAA,CAAc,iBAAA,EAAmB,MAAA,CAAO,GAAA,EAAK,IAAA,KAAS,OAAO,GAAA,GAAM,OAAO,MAAA,CAAO,GAAA,EAAK,IAAA,KAAS,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,OAAO,MAAS,CAAA;AACrI,aAAA,CAAc,2BAA2B,MAAA,CAAO,IAAA,EAAM,OAAA,KAAY,IAAA,GAAO,MAAM,MAAS,CAAA;AACxF,aAAA,CAAc,4BAAA,EAA8B,MAAA,CAAO,IAAA,EAAM,aAAa,CAAA;AACtE,aAAA,CAAc,iBAAA,EAAmB,MAAA,CAAO,IAAA,EAAM,IAAI,CAAA;AAClD,aAAA,CAAc,mBAAA,EAAqB,MAAA,CAAO,IAAA,EAAM,MAAM,CAAA;AACtD,aAAA,CAAc,4BAAA,EAA8B,MAAA,CAAO,IAAA,EAAM,cAAc,CAAA;AAEvE,IAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,2BAA2B,CAAA;AAG7D,IAAI,aAAA,EAAe;AACf,EAAA,MAAM,QAAA,GAAW,CAAA,GAAI,IAAA,KAAoB,OAAA,CAAQ,MAAA,CAAO,MAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,IAAI,CAAA;AACnF,EAAA,OAAA,CAAQ,GAAA,GAAM,QAAA;AACd,EAAA,OAAA,CAAQ,IAAA,GAAO,QAAA;AACf,EAAA,OAAA,CAAQ,IAAA,GAAO,QAAA;AACf,EAAA,OAAA,CAAQ,KAAA,GAAQ,QAAA;AACpB;AAEA,IAAM,OAAO,QAAA,CAAS,OAAA,CAAQ,IAAI,iBAAiB,CAAA,IAAK,QAAQ,EAAE,CAAA;AAClE,IAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AAM1C,IAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,0BAA0B,CAAA,IAAK,WAAA;AAChE,IAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,2BAA2B,CAAA,IAAK,YAAA;AAClE,IAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,wBAAwB,CAAA,IAAK,GAAA;AAC5D,IAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,qBAAqB,CAAA,IAAK,MAAA;AACtD,IAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,qBAAqB,CAAA,IAAK,MAAA;AACtD,IAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,0BAA0B,CAAA,IAAK,WAAA;AAIhE,IAAM,WAAA,GAAc,QAAQ,GAAA,CAAI,qBAAqB,IAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,QAAQ,GAAA,CAAI,qBAAqB,CAAC,CAAA,GAAI,MAAA,CAAO,KAAK,IAAA,GAAY,IAAA,CAAA,OAAA,CAAQ,SAAS,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA,GAAI,IAAA;AAC7K,IAAM,UAAA,GAAa,QAAQ,GAAA,CAAI,oBAAoB,IAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,QAAQ,GAAA,CAAI,oBAAoB,CAAC,CAAA,GAAI,MAAA,CAAO,KAAK,GAAA,GAAW,IAAA,CAAA,OAAA,CAAQ,SAAS,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA;AAExK,IAAM,gBAAA,GAAmB,OAAA,CAAQ,GAAA,CAAI,qBAAqB,GAAG,WAAA,EAAY;AACzE,IAAI,gBAAA,KAAqB,MAAA,IAAa,gBAAA,KAAqB,MAAA,IAAU,qBAAqB,OAAA,EAAS;AAC/F,EAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,0CAAA,EAA6C,gBAAgB,CAAA,yBAAA,CAA2B,CAAA;AACtG,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AACA,IAAI,gBAAA,KAAqB,OAAA,KAAY,CAAC,WAAA,IAAe,CAAC,UAAA,CAAA,EAAa;AAC/D,EAAA,OAAA,CAAQ,MAAM,2GAA2G,CAAA;AACzH,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AAEA,IAAM,MAAA,GAAS,qBAAqB,MAAA,GAAS,KAAA,GAAQ,qBAAqB,OAAA,GAAU,IAAA,GAAO,CAAC,EAAE,WAAA,IAAe,UAAA,CAAA;AAY7G,SAAS,cAAc,OAAA,EAAqC;AACxD,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AAC/B,EAAA,IAAI,QAAQ,MAAA,IAAa,GAAA,CAAI,IAAA,EAAK,KAAM,IAAI,OAAO,MAAA;AACnD,EAAA,MAAM,KAAA,GAAQ,OAAO,GAAG,CAAA;AACxB,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,IAAK,QAAQ,CAAA,EAAG;AACtC,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,sBAAA,EAAyB,OAAO,CAAA,EAAA,EAAK,GAAG,CAAA,2EAAA,CAA6E,CAAA;AAClI,IAAA,OAAO,MAAA;AAAA,EACX;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,KAAK,CAAA;AAC3B;AAEA,IAAM,2BAAA,GAA8B,cAAc,kCAAkC,CAAA;AACpF,IAAM,wBAAA,GAA2B,cAAc,wCAAwC,CAAA;AAEvF,IAAM,cAAc,OAAA,CAAQ,GAAA,CAAI,8BAA8B,CAAA,EAAG,IAAA,GAAO,WAAA,EAAY;AACpF,IAAI,gBAAA;AACJ,IAAI,WAAA,EAAa;AACb,EAAA,IAAI,WAAA,KAAgB,QAAA,IAAY,WAAA,KAAgB,UAAA,IAAc,gBAAgB,QAAA,EAAU;AACpF,IAAA,gBAAA,GAAmB,WAAA;AAAA,EACvB,CAAA,MAAO;AACH,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,oDAAA,EAAuD,WAAW,CAAA,+DAAA,CAAiE,CAAA;AAAA,EACpJ;AACJ;AAMA,IAAM,aAAa,OAAA,CAAQ,GAAA,CAAI,4BAA4B,CAAA,EACrD,MAAM,GAAG,CAAA,CACV,GAAA,CAAI,CAAC,WAAW,MAAA,CAAO,IAAA,EAAM,CAAA,CAC7B,OAAO,OAAO,CAAA;AAEnB,IAAI,cAAA;AACJ,IAAI,YAAY,MAAA,EAAQ;AACpB,EAAA,cAAA,GAAiB,UAAA;AACrB,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,cAAc,CAAA,EAAG;AAC7C,EAAA,cAAA,GAAiB,MAAA,CAAO,cAAA;AAC5B,CAAA,MAAA,IAAW,OAAO,cAAA,EAAgB;AAC9B,EAAA,IAAI;AACA,IAAA,cAAA,GAAiB,IAAI,MAAA,CAAO,MAAA,CAAO,eAAe,OAAA,EAAS,MAAA,CAAO,eAAe,KAAK,CAAA;AAAA,EAC1F,SAAS,GAAA,EAAK;AAGV,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,8CAAA,EAAkD,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,EAC3F;AACJ;AASA,SAAS,sBAAA,GAAiC;AACtC,EAAA,IAAI,0BAA0B,MAAA,EAAQ,OAAO,CAAA,QAAA,EAAW,MAAA,CAAO,cAAc,CAAC,CAAA,CAAA;AAC9E,EAAA,IAAI,kBAAkB,cAAA,CAAe,MAAA,GAAS,GAAG,OAAO,cAAA,CAAe,KAAK,IAAI,CAAA;AAChF,EAAA,OAAO,iLAAA;AACX;AAGA,IAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,oBAAoB,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,CAAI,oBAAoB,CAAC,CAAA,GAAI,IAAA;AAC7G,IAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAC,CAAA,GAAI,IAAA;AActH,SAAS,yBAAyB,MAAA,EAAsB;AACpD,EAAA,MAAM,KAAA,uBAAY,GAAA,CAAY;AAAA,IAC1B,qBAAA;AAAA,IACA,oBAAA;AAAA,IACA,GAAA,CAAI,OAAO,cAAA,IAAkB,IAAI,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA;AAAA,IAClD,GAAA,CAAI,OAAO,UAAA,IAAc,IAAI,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA;AAAA,IAC9C,GAAA,CAAI,OAAO,WAAA,IAAe,IAAI,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI;AAAA,GAClD,CAAA;AACD,EAAA,IAAI,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA,EAAG;AAEvB,EAAA,MAAM,MAAA,GAAS,CAAC,GAAG,KAAK,CAAA,CAAE,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,KAAS,qBAAA,IAAyB,IAAA,KAAS,oBAAoB,CAAA;AAC1G,EAAA,OAAA,CAAQ,IAAA;AAAA,IACJ,2CAA2C,MAAM,CAAA,uGAAA,EACmB,YAAY,CAAA,CAAA,EAAI,MAAM,CAAA,gBAAA,EAAmB,MAAM,CAAA,KAAA,EAAQ,aAAa,6GAC1B,MAAM,CAAA,wMAAA,EAE3E,qBAAqB,CAAA,gOAAA,EAEpB,MAAA,CAAO,SAAS,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,CAAC,MAAM,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,CAAG,CAAA,CAAE,KAAK,IAAI,CAAA,GAAI,CAAA,qBAAA,EAAwB,qBAAqB,UAAU,oBAAoB,CAAA,CAAA,CAAA,GAAM,iBAAiB,qBAAqB,CAAA,OAAA,EAAU,oBAAoB,CAAA,MAAA,CAAQ,CAAA,CAAA;AAAA,GACxQ;AACJ;AAMA,eAAe,IAAA,GAAsB;AAGjC,EAAA,MAAM,gBAAA,GAAwB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AACtD,EAAA,MAAM,gBAAA,GAAsB,cAAW,gBAAgB,CAAA;AAEvD,EAAA,MAAM,OAAA,GAAU,IAAI,eAAA,EAAgB,CAC/B,SAAS,IAAI,CAAA,CACb,gBAAA,CAAiB,YAAY,CAAA,CAC7B,iBAAA,CAAkB,aAAa,CAAA,CAC/B,cAAA,CAAe,UAAU,CAAA,CACzB,WAAA,CAAY,OAAO,EACnB,WAAA,CAAY,OAAO,CAAA,CACnB,gBAAA,CAAiB,YAAY,CAAA;AAElC,EAAA,IAAI,IAAA,EAAM;AACN,IAAA,OAAA,CAAQ,SAAS,IAAI,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,gCAAgC,MAAA,EAAW;AAC3C,IAAA,OAAA,CAAQ,sBAAsB,2BAA2B,CAAA;AAAA,EAC7D;AACA,EAAA,IAAI,6BAA6B,MAAA,EAAW;AACxC,IAAA,OAAA,CAAQ,2BAA2B,wBAAwB,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,gBAAA,EAAkB;AAClB,IAAA,OAAA,CAAQ,qBAAqB,gBAAgB,CAAA;AAAA,EACjD;AAEA,EAAA,IAAI,MAAA,EAAQ;AAKR,IAAA,IAAI;AACA,MAAA,OAAA,CAAQ,YAAA,CAAa,aAAc,UAAW,CAAA;AAAA,IAClD,SAAS,GAAA,EAAK;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,sDAAuD,GAAA,CAAc,OAAO,CAAA,eAAA,EACxD,WAAW,UAAU,UAAU,CAAA,wTAAA,CAAA;AAAA,QAInD,EAAE,OAAO,GAAA;AAAI,OACjB;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,IAAI,cAAA,EAAgB;AAChB,IAAA,OAAA,CAAQ,mBAAmB,cAAc,CAAA;AAAA,EAC7C;AAWA,EAAA,MAAM,kBAA4B,EAAC;AACnC,EAAA,MAAM,KAAA,GAAQ,CAAC,SAAA,EAAmB,GAAA,KAAsB;AACpD,IAAA,OAAA,CAAQ,eAAA,CAAgB,WAAW,GAAG,CAAA;AACtC,IAAA,eAAA,CAAgB,KAAK,SAAS,CAAA;AAAA,EAClC,CAAA;AAEA,EAAA,IAAI,YAAA,IAAmB,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC7C,IAAA,KAAA,CAAM,WAAW,YAAY,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,SAAA,IAAgB,EAAA,CAAA,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,IAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,EACxB;AACA,EAAA,IAAI,MAAA,CAAO,KAAK,MAAA,EAAQ;AACpB,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,GAAA,CAAI,MAAA,EAAQ;AACnC,MAAA,MAAM,GAAA,GAAW,IAAA,CAAA,OAAA,CAAQ,OAAA,EAAS,KAAA,CAAM,GAAG,CAAA;AAC3C,MAAA,IAAO,EAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AACpB,QAAA,KAAA,CAAM,KAAA,CAAM,WAAW,GAAG,CAAA;AAAA,MAC9B,CAAA,MAAO;AACH,QAAA,OAAA,CAAQ,KAAK,CAAA,+BAAA,EAAkC,KAAA,CAAM,SAAS,CAAA,SAAA,EAAO,GAAG,CAAA,+BAAA,CAAiC,CAAA;AAAA,MAC7G;AAAA,IACJ;AAAA,EACJ;AAGA,EAAA,IAAI,OAAO,cAAA,EAAgB;AACvB,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,cAAA,EAAgB;AACnC,MAAA,OAAA,CAAQ,iBAAA,CAAkB;AAAA,QACtB,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,KAAK,CAAA,CAAE,GAAA;AAAA,QACP,WAAW,CAAA,CAAE;AAAA,OAChB,CAAA;AAAA,IACL;AAAA,EACJ;AAKA,EAAA,IAAI,OAAO,UAAA,EAAY;AACnB,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,UAAA,EAAY;AAC/B,MAAA,OAAA,CAAQ,kBAAA,CAAmB,EAAE,GAAG,CAAA,EAAG,WAAW,CAAA,CAAE,SAAA,IAAa,MAAM,CAAA;AAAA,IACvE;AAAA,EACJ;AAMA,EAAA,IAAI,OAAO,WAAA,EAAa;AACpB,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,WAAA,EAAa;AAChC,MAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,CAAA,EAAG,OAAO,CAAA;AAChD,MAAA,IAAI,QAAA,EAAU;AACV,QAAA,OAAA,CAAQ,kBAAkB,QAAQ,CAAA;AAAA,MACtC;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,IAAI,aAAA,EAAe;AACf,IAAA,OAAA,CAAQ,gBAAgB,aAAa,CAAA;AACrC,IAAA,wBAAA,CAAyB,aAAa,CAAA;AAAA,EAC1C;AAEA,EAAA,IAAI,gBAAA,EAAkB;AAClB,IAAA,OAAA,CAAQ,2BAA2B,gBAAgB,CAAA;AAAA,EACvD;AAKA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,GAAA,CAAI,yBAAyB,CAAA;AAC5D,EAAA,MAAM,WAAA,GAAc,cAAA,KAAmB,GAAA,IAAO,cAAA,KAAmB,MAAA;AACjE,EAAA,IAAI,WAAA,EAAa;AACb,IAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,4BAA4B,CAAA;AAC9D,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AAC1C,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAC9C,IAAA,MAAM,oBAAA,GAAuB,OAAO,IAAA,EAAM,oBAAA,KAAyB,SAAS,CAAC,MAAM,IAAI,EAAC,CAAA;AACxF,IAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,IAAA,IAAQ,oBAAA,CAAqB,WAAW,CAAA,EAAG;AAC9D,MAAA,OAAA,CAAQ,KAAA;AAAA,QACJ;AAAA,OAGJ;AACA,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAClB;AACA,IAAA,OAAA,CAAQ,WAAA,CAAY;AAAA,MAChB,aAAA;AAAA,MACA,oBAAA;AAAA,MACA,OAAA,EAAS,IAAA;AAAA,MACT,MAAA;AAAA,MACA,eAAA,EAAiB,OAAO,IAAA,EAAM,eAAA;AAAA,MAC9B,cAAA,EAAgB,OAAO,IAAA,EAAM,cAAA;AAAA,MAC7B,aAAA,EAAe,OAAO,IAAA,EAAM,aAAA;AAAA,MAC5B,cAAA,EAAgB,OAAO,IAAA,EAAM,cAAA;AAAA,MAC7B,cAAA,EAAgB,OAAO,IAAA,EAAM,cAAA;AAAA,MAC7B,KAAA,EAAO,OAAO,IAAA,EAAM,KAAA;AAAA,MACpB,WAAA,EAAa,OAAO,IAAA,EAAM,WAAA;AAAA,MAC1B,MAAA,EAAQ,OAAO,IAAA,EAAM,MAAA;AAAA,MACrB,aAAA,EAAe,OAAO,IAAA,EAAM,aAAA;AAAA,MAC5B,gBAAA,EAAkB,OAAO,IAAA,EAAM,gBAAA;AAAA,MAC/B,wBAAA,EAA0B,OAAO,IAAA,EAAM,wBAAA;AAAA,MACvC,KAAA,EAAO,OAAO,IAAA,EAAM;AAAA,KACvB,CAAA;AAAA,EACL;AAKA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,GAAA,CAAI,4BAA4B,CAAA;AAC/D,EAAA,IAAI,cAAA,EAAgB;AAChB,IAAA,OAAA,CAAQ,mBAAmB,cAAc,CAAA;AAAA,EAC7C;AAEA,EAAA,MAAM,MAAA,GAAS,QAAQ,KAAA,EAAM;AAC7B,EAAA,MAAM,OAAO,KAAA,EAAM;AAGnB,EAAA,MAAM,UAAA,GAAa,SAAS,OAAA,GAAU,MAAA;AACtC,EAAA,MAAM,QAAA,GAAW,SAAS,KAAA,GAAQ,IAAA;AAClC,EAAA,MAAM,EAAA,GAAK,QAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AACxB,EAAA,MAAM,SAAA,GAAY,CAAA,EAAG,UAAU,CAAA,aAAA,EAAgB,IAAI,CAAA,CAAA;AACnD,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC3C,EAAA,MAAM,cAAA,GAAiB,YAAA,CAAa,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAMrD,EAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,gCAAA,EAAyB,MAAA,GAAS,QAAA,GAAW,EAAE,CAAA,CAAE,CAAA;AAC7D,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,IAAI,CAAA,iCAAA,EAA6B,QAAQ,gBAAgB,IAAI,CAAA,EAAG,YAAY,CAAA,OAAA,CAAS,CAAA;AAC7F,EAAA,OAAA,CAAQ,IAAI,CAAA,6FAAA,CAA+F,CAAA;AAC3G,EAAA,OAAA,CAAQ,IAAI,CAAA,iCAAA,EAA6B,QAAQ,gBAAgB,IAAI,CAAA,EAAG,aAAa,CAAA,CAAE,CAAA;AACvF,EAAA,OAAA,CAAQ,IAAI,CAAA,4FAAA,CAA8F,CAAA;AAC1G,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,SAAS,CAAA,QAAA,EAAW,SAAS,CAAA,CAAE,CAAA;AACxE,EAAA,OAAA,CAAQ,GAAA,CAAI,oCAA6B,SAAS,CAAA,QAAA,EAAW,SAAS,CAAA,UAAA,EAAa,SAAS,CAAA,QAAA,EAAW,cAAc,CAAA,CAAE,CAAA;AAIvH,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,QAAQ,CAAA,aAAA,EAAgB,IAAI,GAAG,UAAA,KAAe,GAAA,GAAM,GAAA,GAAM,UAAU,CAAA,MAAA,CAAQ,CAAA;AACrH,EAAA,OAAA,CAAQ,IAAI,CAAA,oFAAA,CAAsF,CAAA;AAClG,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,qBAAqB,CAAA,2CAAA,CAA6C,CAAA;AAC3G,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,0BAAA,EAA6B,oBAAoB,CAAA,6EAAA,CAA+E,CAAA;AAC5I,EAAA,IAAI,eAAA,CAAgB,SAAS,CAAA,EAAG;AAC5B,IAAA,OAAA,CAAQ,IAAI,CAAA,iCAAA,EAA6B,eAAA,CAAgB,IAAI,CAAC,MAAA,KAAW,GAAG,SAAS,CAAA,EAAG,WAAW,GAAA,GAAM,GAAA,GAAM,SAAS,GAAG,CAAA,CAAE,EAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/I;AACA,EAAA,IAAI,gBAAA,EAAkB;AAClB,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,gBAAgB,CAAA,CAAE,CAAA;AAAA,EAC/D;AACA,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,WAAA,GAAc,6BAAA,GAAgC,iCAAiC,CAAA,CAAE,CAAA;AAC1H,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,wCAAA,EAA+B,cAAA,GAAiB,wBAAA,GAA2B,UAAU,CAAA,CAAE,CAAA;AACnG,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iCAAA,EAA6B,sBAAA,EAAwB,CAAA,CAAE,CAAA;AACnE,EAAA,OAAA,CAAQ,IAAI,CAAA,8CAAA,EAAiD,SAAS,aAAa,SAAS,CAAA,aAAA,EAAgB,cAAc,CAAA,CAAE,CAAA;AAC5H,EAAA,IAAI,CAAC,cAAA,EAAgB;AACjB,IAAA,OAAA,CAAQ,IAAI,CAAA,+FAAA,CAAiG,CAAA;AAAA,EACjH;AACA,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,GAAA,CAAI,yCAAyC,oBAAoB,CAAA,OAAA,EAAU,SAAS,CAAA,CAAA,EAAI,oBAAoB,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AACnI,EAAA,OAAA,CAAQ,IAAI,CAAA,wBAAA,CAA0B,CAAA;AACtC,EAAA,OAAA,CAAQ,GAAA,EAAI;AAKZ,EAAA,MAAM,aAAa,iBAAA,CAAkB,OAAA,CAAQ,GAAA,CAAI,iBAAiB,GAAG,SAAS,CAAA;AAC9E,EAAA,IAAI,WAAW,KAAA,EAAO;AAClB,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,aAAA,EAAgB,UAAA,CAAW,KAAK,CAAA,CAAE,CAAA;AAAA,EACnD,CAAA,MAAA,IAAW,UAAA,CAAW,GAAA,IAAO,UAAA,CAAW,IAAA,EAAM;AAC1C,IAAA,MAAM,UAAU,UAAA,CAAW,GAAA;AAC3B,IAAA,MAAM,WAAW,UAAA,CAAW,IAAA;AAC5B,IAAA,MAAM,UAAU,eAAA,CAAgB,IAAA,CAAK,CAAC,MAAA,KAAW,MAAA,KAAW,OAAO,QAAA,KAAa,MAAA,IAAU,QAAA,CAAS,UAAA,CAAW,OAAO,QAAA,CAAS,GAAG,IAAI,MAAA,GAAS,MAAA,GAAS,GAAG,CAAC,CAAA;AAC3J,IAAA,IAAI,CAAC,OAAA,EAAS;AACV,MAAA,OAAA,CAAQ,IAAA;AAAA,QACJ,CAAA,yBAAA,EAA4B,OAAO,CAAA,0BAAA,EAA6B,QAAQ,0BACnE,eAAA,CAAgB,MAAA,GAAS,IACpB,CAAA,kBAAA,EAAqB,eAAA,CAAgB,IAAI,CAAC,CAAA,KAAM,IAAI,CAAC,CAAA,CAAA,CAAG,EAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA,GACpE,CAAA,2HAAA,CAAA;AAAA,OACd;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,4BAAA,EAAwB,OAAO,CAAA,CAAE,CAAA;AAC7C,MAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,MAAA,IAAI;AACA,QAAA,MAAM,KAAK,OAAO,CAAA;AAAA,MACtB,SAAS,GAAA,EAAK;AAGV,QAAA,OAAA,CAAQ,KAAK,CAAA,4CAAA,EAA+C,OAAO,CAAA,EAAA,EAAM,GAAA,CAAc,OAAO,CAAA,+CAAA,CAAiD,CAAA;AAAA,MACnJ;AAAA,IACJ;AAAA,EACJ;AAGA,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,KAAkC;AACtD,IAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,QAAA,EAAQ,MAAM,CAAA,8BAAA,CAA2B,CAAA;AACrD,IAAA,MAAM,OAAO,IAAA,EAAK;AAClB,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAClB,CAAA;AAEA,EAAA,OAAA,CAAQ,GAAG,QAAA,EAAU,MAAM,KAAK,QAAA,CAAS,QAAQ,CAAC,CAAA;AAClD,EAAA,OAAA,CAAQ,GAAG,SAAA,EAAW,MAAM,KAAK,QAAA,CAAS,SAAS,CAAC,CAAA;AACxD;AAEA,IAAA,EAAK,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AAU3B,EAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,EAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,2BAAA,EAA8B,OAAO,CAAA,CAAE,CAAA;AAGrD,EAAA,MAAM,KAAA,GAAQ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,KAAA,GAAQ,MAAA;AACjD,EAAA,IAAI,iBAAiB,KAAA,EAAO;AACxB,IAAA,MAAM,OAAQ,KAAA,CAAgC,IAAA;AAC9C,IAAA,OAAA,CAAQ,KAAA,CAAM,kCAAkC,IAAA,GAAO,IAAA,GAAO,MAAM,EAAE,CAAA,EAAG,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,EAC5F;AAKA,EAAA,IAAI,EAAE,eAAe,KAAA,CAAA,IAAU,CAAC,QAAQ,QAAA,CAAS,MAAA,CAAO,IAAI,CAAC,CAAA,EAAG;AAC5D,IAAA,OAAA,CAAQ,KAAA;AAAA,MACJ,CAAA,2CAAA,EAA8C,IAAA,IAAQ,SAAS,CAAA,MAAA,EAAS,IAAI,CAAA,uFAAA;AAAA,KAChF;AAAA,EACJ;AAEA,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB,CAAC,CAAA","file":"bin.js","sourcesContent":["#!/usr/bin/env node\n/**\n * Standalone entry-point that starts the mcp-broker WebSocket server.\n *\n * ## Configuration sources (highest priority first)\n *\n * 1. Environment variables (`MCP_BROKER_*`).\n * 2. JSON config file. Resolved in order:\n *    a. `MCP_BROKER_CONFIG` env var.\n *    b. `./.mcp-broker/config.json` in the current working directory.\n *    c. `./mcp-broker.config.json` (legacy, with a deprecation warning).\n * 3. Built-in defaults.\n *\n * ## Path resolution\n *\n * - Env-var paths (`MCP_BROKER_*_DIR`, `MCP_BROKER_TLS_*`) are resolved\n *   against `process.cwd()`.\n * - Config-file paths (`tls.cert`, `www.mounts[*].dir`, `stdioUpstreams[*]`,\n *   `mcpbBundles[*]`) are resolved against the **config file's directory**: so a config in\n *   `./.mcp-broker/config.json` referring to `\"certs/cert.pem\"` points at\n *   `./.mcp-broker/certs/cert.pem`. The folder is self-contained.\n *\n * ## Local grammar overrides\n *\n * When `.mcp-broker/grammars/<userAgent>/<locale>.json` files exist next to\n * the config file, they are merged **on top of** the packaged grammars. Lets\n * users customize tool/resource descriptions for their organization without\n * forking the package.\n *\n * ## Environment variables\n *\n * | Variable                       | Default  | Notes                                                  |\n * |--------------------------------|----------|--------------------------------------------------------|\n * | MCP_BROKER_CONFIG              | (none)   | Path to a JSON config file (see above).                |\n * | MCP_BROKER_PORT                | 3000     |                                                        |\n * | MCP_BROKER_HOST                | 0.0.0.0  |                                                        |\n * | MCP_BROKER_PROVIDER_PATH       | /provider| Prefix for one-slot-per-socket providers (plain frames)|\n * | MCP_BROKER_PROVIDERS_PATH      |/providers| Exact path for multiplexed providers (envelope frames) |\n * | MCP_BROKER_CLIENT_PATH         | /        | Prefix for raw WS clients                              |\n * | MCP_BROKER_MCP_PATH            | /mcp     | Suffix for Streamable HTTP transport                   |\n * | MCP_BROKER_SSE_PATH            | /sse     | Suffix for the legacy SSE stream (GET)                 |\n * | MCP_BROKER_MESSAGES_PATH       | /messages| Suffix for legacy SSE JSON-RPC posts                   |\n * | MCP_BROKER_WWW_DIR             | (none)   | Ergonomic shortcut: mount this directory at \"/\"        |\n * | MCP_BROKER_BUNDLE_DIR          | (none)   | Ergonomic shortcut: mount this directory at \"/bundle\"  |\n * | MCP_BROKER_OPEN                | (unset)  | \"1\" for the root URL, or a path/same-origin URL to open|\n * | MCP_BROKER_TLS_CERT            | (none)   | Path to a PEM TLS certificate                          |\n * | MCP_BROKER_TLS_KEY             | (none)   | Path to a PEM private key                              |\n * | MCP_BROKER_PROTOCOL            | auto     | \"http\" to force plain, \"https\" to force TLS, otherwise |\n * |                                |          | TLS is enabled iff cert+key are both set               |\n * | MCP_BROKER_STDIO_PROVIDER      | (none)   | When set, stdin/stdout carry JSON-RPC for the named    |\n * |                                |          | provider (Claude Desktop bridge).                      |\n * | MCP_BROKER_LOCALE              | en       | Locale used for tool descriptions on the `_broker`     |\n * |                                |          | slot. ISO 639-1 base; regional variants accepted.      |\n * | MCP_BROKER_ALLOWED_ORIGINS     | (none)   | Comma-separated browser origins allowed on the client  |\n * |                                |          | HTTP surface (`/<slot>/mcp`, `/sse`, `/messages`).     |\n * |                                |          | None means no browser origin passes.                   |\n * | MCP_BROKER_PROVIDER_HEARTBEAT_MS      | 30000 | Provider ws ping interval; 0 disables liveness.  |\n * | MCP_BROKER_PROVIDER_REQUEST_TIMEOUT_MS| 60000 | Deadline for one provider answer; 0 disables.    |\n * | MCP_BROKER_PROVIDER_TAKEOVER   | liveness | \"reject\" | \"liveness\" | \"always\" on slot contention |\n */\nimport * as fs from \"fs\";\nimport * as path from \"path\";\nimport open from \"open\";\nimport { WsTunnelBuilder, VERSION, PACKAGE_NAME, BROKER_PROVIDER_NAME, BROKER_AGGREGATE_NAME, type ProviderTakeoverMode } from \"./index\";\nimport { loadBrokerConfig, resolveOpenTarget } from \"./config\";\nimport { loadMcpbBundle } from \"./mcpb/mcpb.loader\";\n\n// ---------------------------------------------------------------------------\n// CLI flags\n// ---------------------------------------------------------------------------\n// Handled before ANY other work (config load, logging, server start) so that\n// `--help` / `--version` never boot a server or bind a port.\n\nconst argv = process.argv.slice(2);\n\nif (argv.includes(\"--help\") || argv.includes(\"-h\")) {\n    printHelp();\n    process.exit(0);\n}\nif (argv.includes(\"--version\") || argv.includes(\"-v\")) {\n    process.stdout.write(`${PACKAGE_NAME} ${VERSION}\\n`);\n    process.exit(0);\n}\n\nfunction printHelp(): void {\n    process.stdout.write(\n        `\\n${PACKAGE_NAME} ${VERSION}\\n` +\n            `WebSocket-based Model Context Protocol broker.\\n\\n` +\n            `USAGE\\n` +\n            `  npx @cyanmycelium/mcp-broker             Start the broker (foreground)\\n` +\n            `  npx @cyanmycelium/mcp-broker --help      Show this help\\n` +\n            `  npx @cyanmycelium/mcp-broker --version   Print the version\\n\\n` +\n            `The broker takes no positional arguments. Configure it with a\\n` +\n            `.mcp-broker/config.json file or MCP_BROKER_* environment variables\\n` +\n            `(env vars win over the file).\\n\\n` +\n            `COMMON ENVIRONMENT VARIABLES\\n` +\n            `  MCP_BROKER_CONFIG           Path to a JSON config file\\n` +\n            `  MCP_BROKER_PORT             TCP port (default 3000)\\n` +\n            `  MCP_BROKER_HOST             Bind interface (default 0.0.0.0)\\n` +\n            `  MCP_BROKER_PROTOCOL         \"http\" | \"https\" (default: auto from TLS)\\n` +\n            `  MCP_BROKER_TLS_CERT         PEM certificate path (enables HTTPS/WSS)\\n` +\n            `  MCP_BROKER_TLS_KEY          PEM private key path\\n` +\n            `  MCP_BROKER_STDIO_PROVIDER   Bridge stdin/stdout to this provider (\"_all\" is the safe target)\\n` +\n            `  MCP_BROKER_LOCALE           Locale for _broker tool descriptions (default en)\\n` +\n            `  MCP_BROKER_ALLOWED_ORIGINS  Comma-separated browser origins allowed on /<slot>/mcp,\\n` +\n            `                              /<slot>/sse and /<slot>/messages (default: none pass)\\n` +\n            `  MCP_BROKER_WWW_DIR          Serve this directory at \"/\"\\n` +\n            `  MCP_BROKER_BUNDLE_DIR       Serve this directory at \"/bundle\"\\n` +\n            `  MCP_BROKER_OPEN             \"1\" to open the root in a browser, or a path such as /app/\\n\\n` +\n            `ENDPOINT PATHS (change these only if every peer agrees)\\n` +\n            `  MCP_BROKER_PROVIDER_PATH    Prefix for one provider per socket (default /provider);\\n` +\n            `                              connect as <prefix>/<slot> with DirectTransport (plain frames)\\n` +\n            `  MCP_BROKER_PROVIDERS_PATH   Exact path for many providers on one socket (default /providers);\\n` +\n            `                              connect with MultiplexTransport (envelope frames)\\n` +\n            `  MCP_BROKER_CLIENT_PATH      Prefix for raw WebSocket clients (default /)\\n` +\n            `  MCP_BROKER_MCP_PATH         Streamable HTTP suffix (default /mcp)\\n` +\n            `  MCP_BROKER_SSE_PATH         Legacy SSE stream suffix (default /sse)\\n` +\n            `  MCP_BROKER_MESSAGES_PATH    Legacy SSE post suffix (default /messages)\\n\\n` +\n            `PROVIDER LIVENESS\\n` +\n            `  MCP_BROKER_PROVIDER_HEARTBEAT_MS       Ping interval per provider socket (default 30000, 0 off)\\n` +\n            `  MCP_BROKER_PROVIDER_REQUEST_TIMEOUT_MS Deadline for one provider answer (default 60000, 0 off)\\n` +\n            `  MCP_BROKER_PROVIDER_TAKEOVER           reject | liveness | always (default liveness)\\n\\n` +\n            `AUTHORIZATION (OAuth 2.1, opt-in)\\n` +\n            `  MCP_BROKER_AUTH_ENABLED     \"1\" to require bearer tokens on client endpoints\\n` +\n            `  MCP_BROKER_PUBLIC_BASE_URL  Public origin, e.g. https://mcp.example.com\\n` +\n            `  MCP_BROKER_JWKS             Authorization server JWKS URL\\n` +\n            `  MCP_BROKER_ISSUER           Expected token issuer\\n` +\n            `  MCP_BROKER_PROVIDER_SECRET  Shared secret required from providers\\n\\n` +\n            `CONFIG-FILE ONLY (no env var; .mcp-broker/config.json)\\n` +\n            `  stdioUpstreams[]  Local MCP servers the broker spawns. NOT in _all unless \"aggregate\": true\\n` +\n            `  mcpServers[]      Remote MCP servers the broker dials out to. In _all unless \"aggregate\": false\\n` +\n            `  mcpbBundles[]     Signed .mcpb bundles, verified then spawned. In _all unless \"aggregate\": false\\n` +\n            `  www.mounts[]      Several urlPrefix -> dir mappings (the env vars above mount one each)\\n` +\n            `  allowedOrigins    Also accepts { \"pattern\": \"<regexp>\" }; the env var takes a list only\\n` +\n            `  auth.*            Roles, assignments, denies, per-slot and per-provider scopes\\n` +\n            `  brokerName        Library-only: no builder setter exists, so the CLI cannot forward it\\n\\n` +\n            `RESERVED SLOTS (always present, no provider needed)\\n` +\n            `  _broker   Introspection: broker_info, providers_list, provider_status,\\n` +\n            `            broker_guide (integration docs), broker_diagnose (live problem report)\\n` +\n            `  _all      Live aggregate of every opted-in provider. The right target for\\n` +\n            `            MCP_BROKER_STDIO_PROVIDER, since it exists before any provider connects.\\n\\n` +\n            `Start here: call broker_guide on the _broker slot for the integration guide.\\n` +\n            `Full reference: https://github.com/pandaGaume/mcp-broker/tree/main/node\\n\\n`\n    );\n}\n\n// ---------------------------------------------------------------------------\n// Configuration\n// ---------------------------------------------------------------------------\n\nconst { config, baseDir } = loadBrokerConfig();\nconst cwd = process.cwd();\n\n/**\n * Fills an env var from the config file when the env var is not already set.\n * Used for **non-path** scalars, path-bearing fields are read directly so\n * they can be resolved against `baseDir` (config file's directory) instead\n * of `cwd` (deploy environment).\n */\nfunction envFromConfig(envName: string, configValue: string | number | boolean | undefined): void {\n    if (configValue === undefined || configValue === null) return;\n    if (process.env[envName] !== undefined && process.env[envName] !== \"\") return;\n    process.env[envName] = String(configValue);\n}\n\nenvFromConfig(\"MCP_BROKER_PORT\", config.port);\nenvFromConfig(\"MCP_BROKER_HOST\", config.host);\nenvFromConfig(\"MCP_BROKER_PROTOCOL\", config.protocol);\nenvFromConfig(\"MCP_BROKER_LOCALE\", config.locale);\nenvFromConfig(\"MCP_BROKER_STDIO_PROVIDER\", config.stdioProvider);\nenvFromConfig(\"MCP_BROKER_PROVIDER_PATH\", config.paths?.provider);\nenvFromConfig(\"MCP_BROKER_PROVIDERS_PATH\", config.paths?.providers);\nenvFromConfig(\"MCP_BROKER_CLIENT_PATH\", config.paths?.client);\nenvFromConfig(\"MCP_BROKER_MCP_PATH\", config.paths?.mcp);\nenvFromConfig(\"MCP_BROKER_SSE_PATH\", config.paths?.sse);\nenvFromConfig(\"MCP_BROKER_MESSAGES_PATH\", config.paths?.messages);\nenvFromConfig(\"MCP_BROKER_PROVIDER_HEARTBEAT_MS\", config.providerHeartbeatIntervalMs);\nenvFromConfig(\"MCP_BROKER_PROVIDER_REQUEST_TIMEOUT_MS\", config.providerRequestTimeoutMs);\nenvFromConfig(\"MCP_BROKER_PROVIDER_TAKEOVER\", config.providerTakeover);\n// `www.open` is `boolean | string`: `true` means the root, a string is a path\n// or a same-origin URL. Both travel as the env string and are resolved once,\n// by `resolveOpenTarget`, so the file and the env var cannot diverge.\nenvFromConfig(\"MCP_BROKER_OPEN\", config.www?.open === true ? \"1\" : typeof config.www?.open === \"string\" ? config.www.open : undefined);\nenvFromConfig(\"MCP_BROKER_AUTH_ENABLED\", config.auth?.enabled === true ? \"1\" : undefined);\nenvFromConfig(\"MCP_BROKER_PUBLIC_BASE_URL\", config.auth?.publicBaseUrl);\nenvFromConfig(\"MCP_BROKER_JWKS\", config.auth?.jwks);\nenvFromConfig(\"MCP_BROKER_ISSUER\", config.auth?.issuer);\nenvFromConfig(\"MCP_BROKER_PROVIDER_SECRET\", config.auth?.providerSecret);\n\nconst stdioProvider = process.env[\"MCP_BROKER_STDIO_PROVIDER\"];\n\n// In stdio mode stdout is reserved for JSON-RPC, redirect all console output to stderr.\nif (stdioProvider) {\n    const toStderr = (...args: unknown[]) => process.stderr.write(args.join(\" \") + \"\\n\");\n    console.log = toStderr;\n    console.info = toStderr;\n    console.warn = toStderr;\n    console.error = toStderr;\n}\n\nconst port = parseInt(process.env[\"MCP_BROKER_PORT\"] ?? \"3000\", 10);\nconst host = process.env[\"MCP_BROKER_HOST\"];\n// ── Endpoint paths ───────────────────────────────────────────────────────────\n// All six resolve the same way (env, then config file, then the default) and all\n// six are handed to the builder. Before this, `paths.providers` and\n// `paths.messages` were read nowhere and `paths.sse` reached only the banner, so\n// setting one advertised an endpoint the router did not serve.\nconst providerPath = process.env[\"MCP_BROKER_PROVIDER_PATH\"] ?? \"/provider\";\nconst providersPath = process.env[\"MCP_BROKER_PROVIDERS_PATH\"] ?? \"/providers\";\nconst clientPath = process.env[\"MCP_BROKER_CLIENT_PATH\"] ?? \"/\";\nconst mcpPath = process.env[\"MCP_BROKER_MCP_PATH\"] ?? \"/mcp\";\nconst ssePath = process.env[\"MCP_BROKER_SSE_PATH\"] ?? \"/sse\";\nconst messagesPath = process.env[\"MCP_BROKER_MESSAGES_PATH\"] ?? \"/messages\";\n\n// ── TLS material ─────────────────────────────────────────────────────────────\n// Env var (relative to cwd) wins over config (relative to baseDir).\nconst tlsCertPath = process.env[\"MCP_BROKER_TLS_CERT\"] ? path.resolve(cwd, process.env[\"MCP_BROKER_TLS_CERT\"]) : config.tls?.cert ? path.resolve(baseDir, config.tls.cert) : null;\nconst tlsKeyPath = process.env[\"MCP_BROKER_TLS_KEY\"] ? path.resolve(cwd, process.env[\"MCP_BROKER_TLS_KEY\"]) : config.tls?.key ? path.resolve(baseDir, config.tls.key) : null;\n\nconst protocolOverride = process.env[\"MCP_BROKER_PROTOCOL\"]?.toLowerCase();\nif (protocolOverride !== undefined && protocolOverride !== \"http\" && protocolOverride !== \"https\") {\n    console.error(`[mcp-broker] Invalid MCP_BROKER_PROTOCOL=\"${protocolOverride}\". Use \"http\" or \"https\".`);\n    process.exit(1);\n}\nif (protocolOverride === \"https\" && (!tlsCertPath || !tlsKeyPath)) {\n    console.error(\"[mcp-broker] MCP_BROKER_PROTOCOL=https requires TLS cert+key (via config.tls or MCP_BROKER_TLS_CERT/KEY).\");\n    process.exit(1);\n}\n\nconst useTls = protocolOverride === \"http\" ? false : protocolOverride === \"https\" ? true : !!(tlsCertPath && tlsKeyPath);\n\n// ── Provider liveness knobs ──────────────────────────────────────────────────\n// The defaults are correct for nearly everyone; these exist for the operator who\n// has to tune them (long-running tools, a flaky link). An unusable value is\n// reported and ignored rather than silently coerced, so nobody believes a\n// setting is in force when it is not.\n\n/**\n * Parses a millisecond count from an env var. Returns `undefined` (keep the\n * built-in default) when unset or unusable, after saying why.\n */\nfunction millisFromEnv(envName: string): number | undefined {\n    const raw = process.env[envName];\n    if (raw === undefined || raw.trim() === \"\") return undefined;\n    const value = Number(raw);\n    if (!Number.isFinite(value) || value < 0) {\n        console.warn(`[mcp-broker] Ignoring ${envName}=\"${raw}\": expected a whole number of milliseconds (0 disables). Using the default.`);\n        return undefined;\n    }\n    return Math.floor(value);\n}\n\nconst providerHeartbeatIntervalMs = millisFromEnv(\"MCP_BROKER_PROVIDER_HEARTBEAT_MS\");\nconst providerRequestTimeoutMs = millisFromEnv(\"MCP_BROKER_PROVIDER_REQUEST_TIMEOUT_MS\");\n\nconst takeoverRaw = process.env[\"MCP_BROKER_PROVIDER_TAKEOVER\"]?.trim().toLowerCase();\nlet providerTakeover: ProviderTakeoverMode | undefined;\nif (takeoverRaw) {\n    if (takeoverRaw === \"reject\" || takeoverRaw === \"liveness\" || takeoverRaw === \"always\") {\n        providerTakeover = takeoverRaw;\n    } else {\n        console.warn(`[mcp-broker] Ignoring MCP_BROKER_PROVIDER_TAKEOVER=\"${takeoverRaw}\": expected \"reject\", \"liveness\" or \"always\". Using \"liveness\".`);\n    }\n}\n\n// ── Allowed browser origins for the client HTTP surface ──────────────────────\n// Absent leaves the endpoint closed to browsers, which is the safe default.\n// The env var only carries the list form; a pattern needs the config file,\n// since a regular expression cannot survive comma-splitting.\nconst envOrigins = process.env[\"MCP_BROKER_ALLOWED_ORIGINS\"]\n    ?.split(\",\")\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n\nlet allowedOrigins: readonly string[] | RegExp | undefined;\nif (envOrigins?.length) {\n    allowedOrigins = envOrigins;\n} else if (Array.isArray(config.allowedOrigins)) {\n    allowedOrigins = config.allowedOrigins;\n} else if (config.allowedOrigins) {\n    try {\n        allowedOrigins = new RegExp(config.allowedOrigins.pattern, config.allowedOrigins.flags);\n    } catch (err) {\n        // Falling back to the closed default rather than starting with a rule\n        // the operator believes is in force but which never compiled.\n        console.error(`[mcp-broker] Ignoring allowedOrigins.pattern: ${(err as Error).message}`);\n    }\n}\n\n/**\n * One-line rendering of the resolved origin policy for the startup banner.\n *\n * Worth a banner row because the closed default is invisible otherwise: a page\n * served by this very broker still gets a 403 on `/<slot>/mcp` unless its origin\n * is listed, and nothing else says so until the request fails.\n */\nfunction describeAllowedOrigins(): string {\n    if (allowedOrigins instanceof RegExp) return `pattern ${String(allowedOrigins)}`;\n    if (allowedOrigins && allowedOrigins.length > 0) return allowedOrigins.join(\", \");\n    return \"none (set MCP_BROKER_ALLOWED_ORIGINS, or allowedOrigins in the config file). Requests carrying no Origin header (Claude Desktop, MCP Inspector, any server-side SDK) still pass\";\n}\n\n// ── Env-var static mount shortcuts (relative to cwd) ─────────────────────────\nconst envWwwDir = process.env[\"MCP_BROKER_WWW_DIR\"] ? path.resolve(cwd, process.env[\"MCP_BROKER_WWW_DIR\"]) : null;\nconst envBundleDir = process.env[\"MCP_BROKER_BUNDLE_DIR\"] ? path.resolve(cwd, process.env[\"MCP_BROKER_BUNDLE_DIR\"]) : null;\n\n/**\n * Warns when the stdio bridge is pinned to a slot this broker does not host.\n *\n * The bridge gates every frame, `initialize` included, on the slot being\n * occupied, so an MCP host that starts before the slot is claimed fails the\n * handshake and gives up: with a browser-hosted provider, which cannot be\n * connected before the host launches, this fails every single time. Naming the\n * slots the broker does have turns that into a one-line fix.\n *\n * Deliberately a warning, not an exit: a WebSocket provider may legitimately\n * claim the slot later, and a broker that refuses to start would be worse.\n */\nfunction warnIfStdioTargetUnknown(target: string): void {\n    const known = new Set<string>([\n        BROKER_AGGREGATE_NAME,\n        BROKER_PROVIDER_NAME,\n        ...(config.stdioUpstreams ?? []).map((u) => u.name),\n        ...(config.mcpServers ?? []).map((s) => s.name),\n        ...(config.mcpbBundles ?? []).map((b) => b.name),\n    ]);\n    if (known.has(target)) return;\n\n    const hosted = [...known].filter((name) => name !== BROKER_AGGREGATE_NAME && name !== BROKER_PROVIDER_NAME);\n    console.warn(\n        `[mcp-broker] MCP_BROKER_STDIO_PROVIDER=\"${target}\" names a slot this broker does not host. ` +\n            `Nothing answers on it until a WebSocket provider connects to ${providerPath}/${target} (or announces \"${target}\" on ${providersPath}), ` +\n            `and until then every request from the MCP host, including the initial handshake, fails with 'Provider \"${target}\" not connected'. ` +\n            `An MCP host that starts before that provider is up, which is always the case for a provider hosted in a browser page, will therefore never connect. ` +\n            `Prefer MCP_BROKER_STDIO_PROVIDER=\"${BROKER_AGGREGATE_NAME}\": it exists from startup, answers the handshake itself, unions every opted-in provider, ` +\n            `and pushes notifications/tools/list_changed as providers join, so a page opened later appears live. ` +\n            `Slots this broker hosts right now: ${hosted.length > 0 ? hosted.map((n) => `\"${n}\"`).join(\", \") + `, plus the reserved \"${BROKER_AGGREGATE_NAME}\" and \"${BROKER_PROVIDER_NAME}\"` : `the reserved \"${BROKER_AGGREGATE_NAME}\" and \"${BROKER_PROVIDER_NAME}\" only`}.`\n    );\n}\n\n// ---------------------------------------------------------------------------\n// Server bootstrap\n// ---------------------------------------------------------------------------\n\nasync function main(): Promise<void> {\n    // Local grammar overrides: when `<baseDir>/grammars/` exists, the broker\n    // server merges those JSON files on top of the packaged grammars.\n    const localGrammarsDir = path.join(baseDir, \"grammars\");\n    const hasLocalGrammars = fs.existsSync(localGrammarsDir);\n\n    const builder = new WsTunnelBuilder()\n        .withPort(port)\n        .withProviderPath(providerPath)\n        .withProvidersPath(providersPath)\n        .withClientPath(clientPath)\n        .withMcpPath(mcpPath)\n        .withSsePath(ssePath)\n        .withMessagesPath(messagesPath);\n\n    if (host) {\n        builder.withHost(host);\n    }\n\n    if (providerHeartbeatIntervalMs !== undefined) {\n        builder.withProviderHeartbeat(providerHeartbeatIntervalMs);\n    }\n    if (providerRequestTimeoutMs !== undefined) {\n        builder.withProviderRequestTimeout(providerRequestTimeoutMs);\n    }\n    if (providerTakeover) {\n        builder.withProviderTakeover(providerTakeover);\n    }\n\n    if (useTls) {\n        // `withTlsFiles` reads both files synchronously and would otherwise\n        // surface a bare ENOENT with no hint that TLS was on because a config\n        // file mentioned it. That is the first wall a copied config template\n        // hits, since the template ships `tls.cert`/`tls.key` but no `certs/`.\n        try {\n            builder.withTlsFiles(tlsCertPath!, tlsKeyPath!);\n        } catch (err) {\n            throw new Error(\n                `TLS is enabled but the material could not be read: ${(err as Error).message}. ` +\n                    `Certificate: ${tlsCertPath}, key: ${tlsKeyPath}. ` +\n                    `Config-file paths are resolved against the config file's own directory, env-var paths against the current directory. ` +\n                    `Generate a development pair, point tls.cert/tls.key (or MCP_BROKER_TLS_CERT/MCP_BROKER_TLS_KEY) at real files, ` +\n                    `or run without TLS by removing the tls block and setting MCP_BROKER_PROTOCOL=http.`,\n                { cause: err }\n            );\n        }\n    }\n\n    if (allowedOrigins) {\n        builder.withAllowedOrigins(allowedOrigins);\n    }\n\n    // ── Static mounts ────────────────────────────────────────────────────────\n    // First the env-var shortcuts (relative to cwd), then the config `www.mounts`\n    // (relative to baseDir). Order matters: /bundle before / so the prefix router\n    // can distinguish them. Subsequent registrations contribute additional mounts;\n    // longest-prefix match wins at runtime.\n    // Every prefix that actually got mounted, in registration order. The\n    // browser-open check below tests the resolved path against this list rather\n    // than against `config.www.mounts`, which would miss both env shortcuts and\n    // would false-warn on a perfectly valid `open: \"/bundle/\"`.\n    const mountedPrefixes: string[] = [];\n    const mount = (urlPrefix: string, dir: string): void => {\n        builder.withStaticMount(urlPrefix, dir);\n        mountedPrefixes.push(urlPrefix);\n    };\n\n    if (envBundleDir && fs.existsSync(envBundleDir)) {\n        mount(\"/bundle\", envBundleDir);\n    }\n    if (envWwwDir && fs.existsSync(envWwwDir)) {\n        mount(\"/\", envWwwDir);\n    }\n    if (config.www?.mounts) {\n        for (const entry of config.www.mounts) {\n            const abs = path.resolve(baseDir, entry.dir);\n            if (fs.existsSync(abs)) {\n                mount(entry.urlPrefix, abs);\n            } else {\n                console.warn(`[mcp-broker] www.mounts entry \"${entry.urlPrefix}\" → ${abs} skipped (directory not found).`);\n            }\n        }\n    }\n\n    // ── Stdio upstreams ──────────────────────────────────────────────────────\n    if (config.stdioUpstreams) {\n        for (const u of config.stdioUpstreams) {\n            builder.withStdioUpstream({\n                name: u.name,\n                command: u.command,\n                args: u.args,\n                env: u.env as NodeJS.ProcessEnv | undefined,\n                aggregate: u.aggregate,\n            });\n        }\n    }\n\n    // ── Remote MCP server upstreams (reached by URL) ─────────────────────────\n    // Config-discovered remote servers join the `_all` aggregate by default;\n    // an explicit `aggregate: false` opts an entry out.\n    if (config.mcpServers) {\n        for (const s of config.mcpServers) {\n            builder.withRemoteUpstream({ ...s, aggregate: s.aggregate ?? true });\n        }\n    }\n\n    // ── Local `.mcpb` bundles ────────────────────────────────────────────────\n    // Each bundle is signature-verified and unpacked before it is wired in as a\n    // stdio upstream. A refused bundle is skipped (loadMcpbBundle logs why); it\n    // never spawns a process. Bundles join `_all` by default (opt-out per entry).\n    if (config.mcpbBundles) {\n        for (const b of config.mcpbBundles) {\n            const upstream = await loadMcpbBundle(b, baseDir);\n            if (upstream) {\n                builder.withStdioUpstream(upstream);\n            }\n        }\n    }\n\n    if (stdioProvider) {\n        builder.withStdioClient(stdioProvider);\n        warnIfStdioTargetUnknown(stdioProvider);\n    }\n\n    if (hasLocalGrammars) {\n        builder.withBrokerLocalGrammarsDir(localGrammarsDir);\n    }\n\n    // ── Authorization (OAuth 2.1 resource server) ────────────────────────────\n    // Opt-in: only wired when MCP_BROKER_AUTH_ENABLED / config.auth.enabled is on.\n    // Env scalars win over config; array/object fields are read from config.\n    const authEnabledEnv = process.env[\"MCP_BROKER_AUTH_ENABLED\"];\n    const authEnabled = authEnabledEnv === \"1\" || authEnabledEnv === \"true\";\n    if (authEnabled) {\n        const publicBaseUrl = process.env[\"MCP_BROKER_PUBLIC_BASE_URL\"];\n        const jwks = process.env[\"MCP_BROKER_JWKS\"];\n        const issuer = process.env[\"MCP_BROKER_ISSUER\"];\n        const authorizationServers = config.auth?.authorizationServers ?? (issuer ? [issuer] : []);\n        if (!publicBaseUrl || !jwks || authorizationServers.length === 0) {\n            console.error(\n                \"[mcp-broker] auth.enabled requires publicBaseUrl, jwks, and at least one \" +\n                    \"authorizationServers entry (or issuer). Set them via config.auth or \" +\n                    \"MCP_BROKER_PUBLIC_BASE_URL / MCP_BROKER_JWKS / MCP_BROKER_ISSUER.\"\n            );\n            process.exit(1);\n        }\n        builder.withJwtAuth({\n            publicBaseUrl,\n            authorizationServers,\n            jwksUri: jwks,\n            issuer,\n            scopesSupported: config.auth?.scopesSupported,\n            requiredScopes: config.auth?.requiredScopes,\n            perSlotScopes: config.auth?.perSlotScopes,\n            providerScopes: config.auth?.providerScopes,\n            subjectMapping: config.auth?.subjectMapping,\n            roles: config.auth?.roles,\n            assignments: config.auth?.assignments,\n            denies: config.auth?.denies,\n            slotResources: config.auth?.slotResources,\n            toolCapabilities: config.auth?.toolCapabilities,\n            providerToolCapabilities: config.auth?.providerToolCapabilities,\n            audit: config.auth?.audit,\n        });\n    }\n\n    // ── Provider authentication (independent of client OAuth) ────────────────\n    // Requires every provider connecting to /provider/<slot> or /providers to\n    // present the shared secret, closes off slot occupation by strangers.\n    const providerSecret = process.env[\"MCP_BROKER_PROVIDER_SECRET\"];\n    if (providerSecret) {\n        builder.withProviderSecret(providerSecret);\n    }\n\n    const tunnel = builder.build();\n    await tunnel.start();\n\n    // ── Startup banner ──────────────────────────────────────────────────────\n    const httpScheme = useTls ? \"https\" : \"http\";\n    const wsScheme = useTls ? \"wss\" : \"ws\";\n    const hr = \"─\".repeat(64);\n    const localhost = `${httpScheme}://localhost:${port}`;\n    const mcpSuffix = mcpPath.replace(/^\\//, \"\");\n    const sseSuffix = ssePath.replace(/^\\//, \"\");\n    const messagesSuffix = messagesPath.replace(/^\\//, \"\");\n\n    // The two provider rows are the point of the banner: the endpoint chosen\n    // decides the framing, and connecting the wrong transport to either one is\n    // the single most common way an integration fails. So each row names the\n    // transport class it requires, right there.\n    console.log();\n    console.log(`⚙️  mcp-broker started${useTls ? \" (TLS)\" : \"\"}`);\n    console.log(hr);\n    console.log(`📡  Provider WS direct    ${wsScheme}://localhost:${port}${providerPath}/<name>`);\n    console.log(`                          one provider per socket, plain JSON-RPC frames: use DirectTransport`);\n    console.log(`🧵  Provider WS multiplex ${wsScheme}://localhost:${port}${providersPath}`);\n    console.log(`                          many providers per socket, envelope frames: use MultiplexTransport`);\n    console.log(`🔌  MCP (Streamable HTTP) ${localhost}/<name>/${mcpSuffix}`);\n    console.log(`📺  Legacy SSE            ${localhost}/<name>/${sseSuffix}  +  POST ${localhost}/<name>/${messagesSuffix}`);\n    // Raw WS clients are a real, configurable route. Left off the banner it read\n    // as provider-only, and `clientPath` reached the router and nothing else,\n    // which is the same defect `paths.sse` had.\n    console.log(`🔗  Client WS (raw)       ${wsScheme}://localhost:${port}${clientPath === \"/\" ? \"/\" : clientPath}<name>`);\n    console.log(`                          bare JSON-RPC frames, no session layer; not origin-checked`);\n    console.log(`🧩  Reserved slots        ${BROKER_AGGREGATE_NAME}: live aggregate of every opted-in provider`);\n    console.log(`                          ${BROKER_PROVIDER_NAME}: broker_info, providers_list, provider_status, broker_guide, broker_diagnose`);\n    if (mountedPrefixes.length > 0) {\n        console.log(`📁  Static mounts         ${mountedPrefixes.map((prefix) => `${localhost}${prefix === \"/\" ? \"/\" : prefix + \"/\"}`).join(\"  \")}`);\n    }\n    if (hasLocalGrammars) {\n        console.log(`🌐  Local grammars        ${localGrammarsDir}`);\n    }\n    console.log(`🔐  Authorization         ${authEnabled ? \"OAuth 2.1 (Bearer required)\" : \"disabled (trusted network only)\"}`);\n    console.log(`🛡️   Provider auth         ${providerSecret ? \"shared secret required\" : \"disabled\"}`);\n    console.log(`🌍  Browser origins       ${describeAllowedOrigins()}`);\n    console.log(`                          enforced on /<name>/${mcpSuffix}, /<name>/${sseSuffix} and /<name>/${messagesSuffix}`);\n    if (!allowedOrigins) {\n        console.log(`                          a page this broker serves is refused too, list its origin to admit it`);\n    }\n    console.log(hr);\n    console.log(`   New here? Call broker_guide on the ${BROKER_PROVIDER_NAME} slot: ${localhost}/${BROKER_PROVIDER_NAME}/${mcpSuffix}`);\n    console.log(`   Press Ctrl+C to stop.`);\n    console.log();\n\n    // ── Auto-launch the browser ─────────────────────────────────────────────\n    // Opt-in through MCP_BROKER_OPEN / www.open, and only onto a path a mount\n    // actually serves: launching a browser at a 404 is worse than not launching.\n    const openTarget = resolveOpenTarget(process.env[\"MCP_BROKER_OPEN\"], localhost);\n    if (openTarget.error) {\n        console.warn(`[mcp-broker] ${openTarget.error}`);\n    } else if (openTarget.url && openTarget.path) {\n        const openUrl = openTarget.url;\n        const openPath = openTarget.path;\n        const covered = mountedPrefixes.some((prefix) => prefix === \"/\" || openPath === prefix || openPath.startsWith(prefix.endsWith(\"/\") ? prefix : prefix + \"/\"));\n        if (!covered) {\n            console.warn(\n                `[mcp-broker] Not opening ${openUrl}: no static mount serves \"${openPath}\", so it would 404. ` +\n                    (mountedPrefixes.length > 0\n                        ? `Mounted prefixes: ${mountedPrefixes.map((p) => `\"${p}\"`).join(\", \")}.`\n                        : `No directory is mounted. Add one with MCP_BROKER_WWW_DIR=<dir> (serves it at \"/\") or a www.mounts entry in the config file.`)\n            );\n        } else {\n            console.log(`🚀  Opening browser: ${openUrl}`);\n            console.log();\n            try {\n                await open(openUrl);\n            } catch (err) {\n                // The broker is listening and healthy; failing to spawn a browser\n                // (a headless box, no default handler) must not take it down.\n                console.warn(`[mcp-broker] Could not launch a browser for ${openUrl}: ${(err as Error).message}. The broker is running; open the URL yourself.`);\n            }\n        }\n    }\n\n    // ── Signal handlers ─────────────────────────────────────────────────────\n    const shutdown = async (signal: string): Promise<void> => {\n        console.log(`\\n⛔  ${signal} received, shutting down…`);\n        await tunnel.stop();\n        process.exit(0);\n    };\n\n    process.on(\"SIGINT\", () => void shutdown(\"SIGINT\"));\n    process.on(\"SIGTERM\", () => void shutdown(\"SIGTERM\"));\n}\n\nmain().catch((err: unknown) => {\n    // `tunnel.start()` now rejects on a listen failure instead of dying as an\n    // uncaught EventEmitter error, so this path is live where it used to be\n    // unreachable, and the rejection carries a fully worded diagnosis (for\n    // EADDRINUSE: the address, the URL to attach to the broker that already\n    // holds the port, and the MCP_BROKER_PORT escape). Print the sentence, not\n    // the object: `console.error(\"…\", err)` renders a stack dump and buries it.\n    //\n    // In stdio mode console is redirected to stderr above, so this cannot\n    // corrupt the JSON-RPC stream on stdout.\n    const message = err instanceof Error ? err.message : String(err);\n    console.error(`[mcp-broker] Cannot start: ${message}`);\n\n    // A wrapped cause keeps the original errno for anyone reading a host log.\n    const cause = err instanceof Error ? err.cause : undefined;\n    if (cause instanceof Error) {\n        const code = (cause as NodeJS.ErrnoException).code;\n        console.error(`[mcp-broker] Underlying error: ${code ? code + \" \" : \"\"}${cause.message}`);\n    }\n\n    // A bare Error with no diagnosis of its own is still worth grounding: say\n    // where the broker was trying to listen, since that is the one fact the\n    // reader needs to check next.\n    if (!(err instanceof Error) || !message.includes(String(port))) {\n        console.error(\n            `[mcp-broker] Configuration in effect: host=${host ?? \"0.0.0.0\"} port=${port}. Set MCP_BROKER_PORT / MCP_BROKER_HOST, or \"port\" / \"host\" in .mcp-broker/config.json.`\n        );\n    }\n\n    process.exit(1);\n});\n"]}