@alcyone-labs/arg-parser 2.5.0 → 2.7.0

package/dist/index.mjs

@@ -12,6 +12,7 @@ var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "acce
 var __flags, _throwForDuplicateFlags, _appName, _appCommandName, _subCommandName, _parameters, _handler, _throwForDuplicateFlags2, _description, _handleErrors, _autoExit, _parentParser, _lastParseResult, _inheritParentFlags, _subCommands, _flagManager, _dxtGenerator, _configurationManager, _fuzzyMode, _mcpResourcesManager, _mcpPromptsManager, _mcpNotificationsManager, _ArgParserBase_instances, _identifyCommandChainAndParsers_fn, _handleGlobalChecks_fn, _validateMandatoryFlags_fn, _applyDefaultValues_fn, _prepareAndExecuteHandler_fn, parseFlags_fn, _enableFuzzyMode_fn, displayErrorAndExit_fn, _printRecursiveToConsole_fn, _buildRecursiveString_fn, _buildRecursiveJson_fn, _handleSaveToEnvFlag_fn, _handleBuildDxtFlag_fn, _handleMcpServeFlag_fn, _resolveLoggerConfigForServe_fn, _getMcpServerConfiguration_fn, _startUnifiedMcpServer_fn, _findAllMcpSubCommands_fn, _parseMcpTransportOptions_fn, _ArgParser_instances, _resolveLoggerConfig_fn, registerToolAsSubCommand_fn, _startSingleTransport_fn, processAsyncHandlerPromise_fn, _hasDate, _hasTime, _offset;
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 import { createRegExp, anyOf as anyOf$1, oneOrMore, char } from "magic-regexp";
 import { getTsconfig, createPathsMatcher } from "get-tsconfig";
 import { z } from "zod";
@@ -1034,6 +1035,29 @@ class ConfigurationManager {
     }
   }
 }
+const zodDxtOptionsSchema = z.object({
+  sensitive: z.boolean().optional().describe("Whether this field should be marked as sensitive in DXT user_config"),
+  localDefault: z.string().optional().describe("Default value specific to DXT sandbox environment"),
+  type: z.enum(["string", "directory", "file", "boolean", "number"]).optional().describe("DXT input type - determines UI component in DXT clients"),
+  multiple: z.boolean().optional().describe("Allow multiple values (for arrays)"),
+  min: z.number().optional().describe("Minimum value (for number type)"),
+  max: z.number().optional().describe("Maximum value (for number type)"),
+  default: z.any().optional().describe("DXT-specific default value (overrides localDefault if provided)"),
+  title: z.string().optional().describe("Custom title for the user_config field")
+}).strict().refine(
+  (data2) => {
+    if ((data2.min !== void 0 || data2.max !== void 0) && data2.type !== "number") {
+      return false;
+    }
+    if (data2.min !== void 0 && data2.max !== void 0 && data2.min > data2.max) {
+      return false;
+    }
+    return true;
+  },
+  {
+    message: "Invalid dxtOptions: min/max can only be used with type 'number', and min must be <= max"
+  }
+);
 const zodFlagSchema = z.object({
   name: z.string().min(1, "Flag name cannot be empty").describe(
     "The output property name, used as a return key `{name: value}`. Must be unique."
@@ -1105,7 +1129,8 @@ const zodFlagSchema = z.object({
   enum: z.array(z.any()).optional().describe("Array of allowed values for the flag."),
   env: z.union([z.string(), z.array(z.string())]).optional().describe(
     "Environment variables that should be set from this flag's value in DXT packages."
-  )
+  ),
+  dxtOptions: zodDxtOptionsSchema.optional().describe("DXT-specific configuration options for enhanced DXT manifest generation")
 }).transform((obj) => {
   const newObj = { ...obj };
   if ("default" in newObj && newObj["default"] !== void 0 && !("defaultValue" in newObj)) {
@@ -1303,6 +1328,353 @@ echo "Mock DXT build script for ${serverInfo.name}"`;
     return process.env["NODE_ENV"] === "test" || ((_a = process.argv[0]) == null ? void 0 : _a.includes("vitest")) || ((_b = process.argv[1]) == null ? void 0 : _b.includes("vitest")) || ((_c = process.argv[1]) == null ? void 0 : _c.includes("tinypool"));
   }
 }
+function detectEntryPoint() {
+  try {
+    if (process.argv[1] && fs.existsSync(process.argv[1])) {
+      return process.argv[1];
+    }
+    if (typeof require !== "undefined" && require.main && require.main.filename) {
+      return require.main.filename;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function getEntryPointFromImportMeta(importMetaUrl) {
+  if (importMetaUrl.startsWith("file://")) {
+    return decodeURIComponent(importMetaUrl.replace("file://", ""));
+  }
+  return importMetaUrl;
+}
+function normalizePath(path2) {
+  return path2.trim();
+}
+function resolveLogPath(logPath, fallbackEntryPoint) {
+  if (typeof logPath === "string") {
+    const pathWithVariables2 = DxtPathResolver.substituteVariables(
+      logPath,
+      DxtPathResolver.detectContext()
+    );
+    const normalizedPath2 = normalizePath(pathWithVariables2);
+    if (path.isAbsolute(normalizedPath2)) {
+      return normalizedPath2;
+    }
+    if (normalizedPath2.startsWith("cwd:")) {
+      const relativePath = normalizedPath2.slice(4);
+      return path.resolve(process.cwd(), relativePath);
+    }
+    const entryPoint = detectEntryPoint() || fallbackEntryPoint;
+    if (entryPoint) {
+      return path.resolve(path.dirname(entryPoint), normalizedPath2);
+    }
+    console.warn(
+      `Warning: Could not detect entry point for log path resolution. Using process.cwd() as fallback. Path: ${normalizedPath2}`
+    );
+    return path.resolve(process.cwd(), normalizedPath2);
+  }
+  const { path: logFilePath, relativeTo = "entry", basePath } = logPath;
+  const pathWithVariables = DxtPathResolver.substituteVariables(
+    logFilePath,
+    DxtPathResolver.detectContext()
+  );
+  const normalizedPath = normalizePath(pathWithVariables);
+  switch (relativeTo) {
+    case "absolute":
+      if (basePath) {
+        const resolvedBasePath = DxtPathResolver.substituteVariables(
+          basePath,
+          DxtPathResolver.detectContext()
+        );
+        return path.resolve(resolvedBasePath, normalizedPath);
+      }
+      if (path.isAbsolute(normalizedPath)) {
+        return normalizedPath;
+      }
+      console.warn(
+        `Warning: relativeTo 'absolute' specified but no basePath provided and path is not absolute. Using process.cwd() as fallback. Path: ${normalizedPath}`
+      );
+      return path.resolve(process.cwd(), normalizedPath);
+    case "cwd":
+      return path.resolve(process.cwd(), normalizedPath);
+    case "entry":
+    default:
+      const entryPoint = detectEntryPoint() || fallbackEntryPoint;
+      if (entryPoint) {
+        return path.resolve(path.dirname(entryPoint), normalizedPath);
+      }
+      console.warn(
+        `Warning: Could not detect entry point for log path resolution. Using process.cwd() as fallback. Path: ${normalizedPath}`
+      );
+      return path.resolve(process.cwd(), normalizedPath);
+  }
+}
+function entryRelative(path2) {
+  return {
+    path: path2,
+    relativeTo: "entry"
+  };
+}
+function cwdRelative(path2) {
+  return {
+    path: path2,
+    relativeTo: "cwd"
+  };
+}
+function absolutePath(path2, basePath) {
+  return {
+    path: path2,
+    relativeTo: "absolute",
+    basePath
+  };
+}
+function legacyCwdPath(path2) {
+  return `cwd:${path2}`;
+}
+const _DxtPathResolver = class _DxtPathResolver {
+  /**
+   * Detects the current execution context
+   * @param forceRefresh - Force refresh of cached context
+   * @returns Path context information
+   */
+  static detectContext(forceRefresh = false) {
+    if (!forceRefresh && this._cachedContext) {
+      return this._cachedContext;
+    }
+    const context = {
+      isDxt: this.isDxtEnvironment(),
+      userHome: void 0,
+      cwd: typeof process !== "undefined" && typeof process.cwd === "function" ? process.cwd() : void 0
+    };
+    const entryPoint = detectEntryPoint();
+    if (entryPoint) {
+      context.entryDir = path.dirname(entryPoint);
+    }
+    if (context.isDxt) {
+      context.extensionDir = this.detectDxtExtensionDir();
+    }
+    this._cachedContext = context;
+    return context;
+  }
+  /**
+   * Checks if the current environment is a DXT environment
+   * @returns True if running in DXT, false otherwise
+   */
+  static isDxtEnvironment() {
+    if (process.env["DXT_EXTENSION_DIR"] || process.env["CLAUDE_DESKTOP_DXT"]) {
+      return true;
+    }
+    const dxtIndicators = [
+      "manifest.json",
+      // DXT packages have manifest.json
+      ".dxt"
+      // DXT marker file
+    ];
+    for (const indicator of dxtIndicators) {
+      const indicatorPath = path.join(process.cwd(), indicator);
+      if (fs.existsSync(indicatorPath)) {
+        if (indicator === "manifest.json") {
+          try {
+            const manifest = JSON.parse(fs.readFileSync(indicatorPath, "utf-8"));
+            if (manifest.server && manifest.user_config) {
+              return true;
+            }
+          } catch {
+          }
+        } else {
+          return true;
+        }
+      }
+    }
+    const cwd = process.cwd();
+    if (cwd.includes("claude-desktop") || cwd.includes("extensions")) {
+      return true;
+    }
+    return false;
+  }
+  /**
+   * Detects the DXT extension directory
+   * @returns DXT extension directory path or undefined
+   */
+  static detectDxtExtensionDir() {
+    if (process.env["DXT_EXTENSION_DIR"]) {
+      return process.env["DXT_EXTENSION_DIR"];
+    }
+    const cwd = process.cwd();
+    if (fs.existsSync(path.join(cwd, "manifest.json"))) {
+      return cwd;
+    }
+    let currentDir = cwd;
+    for (let i = 0; i < 3; i++) {
+      const parentDir = path.dirname(currentDir);
+      if (parentDir === currentDir) break;
+      if (fs.existsSync(path.join(parentDir, "manifest.json"))) {
+        return parentDir;
+      }
+      currentDir = parentDir;
+    }
+    return void 0;
+  }
+  /**
+   * Resolves a path with DXT variable substitution
+   * @param inputPath - Path that may contain DXT variables
+   * @param context - Optional context (will be detected if not provided)
+   * @param config - Optional configuration for variable substitution
+   * @returns Resolved absolute path
+   */
+  static resolvePath(inputPath, context, config) {
+    const ctx = context || this.detectContext();
+    const resolvedPath = this.substituteVariables(inputPath, ctx, config);
+    if (path.isAbsolute(resolvedPath)) {
+      return resolvedPath;
+    }
+    if (ctx.isDxt && ctx.extensionDir) {
+      return path.resolve(ctx.extensionDir, resolvedPath);
+    } else if (ctx.entryDir) {
+      return path.resolve(ctx.entryDir, resolvedPath);
+    } else {
+      return path.resolve(ctx.cwd || process.cwd(), resolvedPath);
+    }
+  }
+  /**
+   * Substitutes DXT variables in a path string
+   * @param inputPath - Path containing variables like ${HOME}, ${__dirname}, etc.
+   * @param context - Path context
+   * @param config - Variable substitution configuration
+   * @returns Path with variables substituted
+   */
+  static substituteVariables(inputPath, context, config) {
+    const safeHomedir = () => "/tmp";
+    const homeDir = context.userHome || safeHomedir();
+    const variables = {
+      // Standard DXT variables
+      HOME: homeDir,
+      DOCUMENTS: path.join(homeDir, "Documents"),
+      DOWNLOADS: path.join(homeDir, "Downloads"),
+      DESKTOP: path.join(homeDir, "Desktop"),
+      pathSeparator: path.sep,
+      // Context-specific variables
+      __dirname: context.isDxt && context.extensionDir ? context.extensionDir : context.entryDir || context.cwd || process.cwd(),
+      // DXT-specific variables
+      ...context.isDxt && context.extensionDir && {
+        DXT_DIR: context.extensionDir,
+        EXTENSION_DIR: context.extensionDir
+      },
+      // Custom variables override defaults
+      ...config == null ? void 0 : config.customVariables
+    };
+    return inputPath.replace(/\$\{([^}]*)\}/g, (match, variableName) => {
+      if (!variableName.trim()) {
+        if (config == null ? void 0 : config.allowUndefined) {
+          return match;
+        }
+        throw new Error(
+          `Undefined DXT variable: ${variableName}. Available variables: ${Object.keys(variables).join(", ")}`
+        );
+      }
+      const value = variables[variableName];
+      if (value !== void 0) {
+        return value;
+      }
+      if (config == null ? void 0 : config.allowUndefined) {
+        return match;
+      }
+      throw new Error(
+        `Undefined DXT variable: ${variableName}. Available variables: ${Object.keys(variables).join(", ")}`
+      );
+    });
+  }
+  /**
+   * Creates a path for user data storage
+   * @param filename - Name of the file or subdirectory
+   * @param context - Optional context (will be detected if not provided)
+   * @returns Absolute path for user data
+   */
+  static createUserDataPath(filename, context) {
+    const ctx = context || this.detectContext();
+    if (ctx.isDxt && ctx.extensionDir) {
+      return path.join(ctx.extensionDir, "data", filename);
+    } else {
+      const safeHomedir = () => "/tmp";
+      const userDataDir = process.env["XDG_DATA_HOME"] || path.join(ctx.userHome || safeHomedir(), ".local", "share");
+      const appName = this.getAppName(ctx);
+      return path.join(userDataDir, appName, filename);
+    }
+  }
+  /**
+   * Creates a path for temporary files
+   * @param filename - Name of the temporary file
+   * @param context - Optional context (will be detected if not provided)
+   * @returns Absolute path for temporary file
+   */
+  static createTempPath(filename, context) {
+    const ctx = context || this.detectContext();
+    if (ctx.isDxt && ctx.extensionDir) {
+      return path.join(ctx.extensionDir, "temp", filename);
+    } else {
+      const safeTmpdir = () => "/tmp";
+      const appName = this.getAppName(ctx);
+      return path.join(safeTmpdir(), appName, filename);
+    }
+  }
+  /**
+   * Creates a path for configuration files
+   * @param filename - Name of the configuration file
+   * @param context - Optional context (will be detected if not provided)
+   * @returns Absolute path for configuration file
+   */
+  static createConfigPath(filename, context) {
+    const ctx = context || this.detectContext();
+    if (ctx.isDxt && ctx.extensionDir) {
+      return path.join(ctx.extensionDir, "config", filename);
+    } else {
+      const safeHomedir = () => "/tmp";
+      const configDir = process.env["XDG_CONFIG_HOME"] || path.join(ctx.userHome || safeHomedir(), ".config");
+      const appName = this.getAppName(ctx);
+      return path.join(configDir, appName, filename);
+    }
+  }
+  /**
+   * Gets the application name for directory creation
+   * @param context - Path context
+   * @returns Application name or default
+   */
+  static getAppName(context) {
+    try {
+      const packageJsonPath = path.join(context.entryDir || context.cwd || process.cwd(), "package.json");
+      if (fs.existsSync(packageJsonPath)) {
+        const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+        return packageJson.name || "argparser-app";
+      }
+    } catch {
+    }
+    return "argparser-app";
+  }
+  /**
+   * Ensures a directory exists, creating it if necessary
+   * @param dirPath - Directory path to ensure
+   * @returns True if directory exists or was created successfully
+   */
+  static ensureDirectory(dirPath) {
+    try {
+      if (!fs.existsSync(dirPath)) {
+        fs.mkdirSync(dirPath, { recursive: true });
+      }
+      return true;
+    } catch (error) {
+      console.warn(`Failed to create directory: ${dirPath}`, error);
+      return false;
+    }
+  }
+  /**
+   * Clears the cached context (useful for testing)
+   */
+  static clearCache() {
+    this._cachedContext = null;
+  }
+};
+_DxtPathResolver._cachedContext = null;
+let DxtPathResolver = _DxtPathResolver;
 class DxtGenerator {
   constructor(argParserInstance) {
     this.argParserInstance = argParserInstance;
@@ -1712,100 +2084,128 @@ class DxtGenerator {
           silent: process.env["NO_SILENCE"] !== "1",
           unbundle: true,
           external: (id, importer) => {
-            const external = this.shouldModuleBeExternal(
-              id,
-              importer,
-              withNodeModules
-            );
-            if (Boolean(process.env["DEBUG"]))
-              console.log(
-                `[${simpleChalk.blue("External")}] ${simpleChalk.yellow(external ? "true" : "false")} for module: (${simpleChalk.green(id)}), path: '${simpleChalk.grey(importer ?? "")}'`
+            try {
+              const external = this.shouldModuleBeExternal(
+                id,
+                importer,
+                withNodeModules
               );
-            return external;
+              if (Boolean(process.env["DEBUG"]))
+                console.log(
+                  `[${simpleChalk.blue("External")}] ${simpleChalk.yellow(external ? "true" : "false")} for module: (${simpleChalk.green(id)}), path: '${simpleChalk.grey(importer ?? "")}'`
+                );
+              return Boolean(external);
+            } catch (error) {
+              console.warn(`Warning: Error in external function for ${id}:`, error);
+              return true;
+            }
           },
           noExternal: (id, importer) => {
-            const external = this.shouldModuleBeExternal(
-              id,
-              importer,
-              withNodeModules
-            );
-            if (Boolean(process.env["DEBUG"]))
-              console.log(
-                `[${simpleChalk.yellow("noExternal")}] ${simpleChalk.yellow(external === false ? "true" : "false")} for module: (${simpleChalk.green(id)}), path: '${simpleChalk.grey(importer ?? "")}'`
+            try {
+              const external = this.shouldModuleBeExternal(
+                id,
+                importer,
+                withNodeModules
               );
-            return external === false;
+              if (Boolean(process.env["DEBUG"]))
+                console.log(
+                  `[${simpleChalk.yellow("noExternal")}] ${simpleChalk.yellow(external === false ? "true" : "false")} for module: (${simpleChalk.green(id)}), path: '${simpleChalk.grey(importer ?? "")}'`
+                );
+              return Boolean(external === false);
+            } catch (error) {
+              console.warn(`Warning: Error in noExternal function for ${id}:`, error);
+              return false;
+            }
           },
           copy: async (options) => {
             var _a2;
-            const outputPaths = [
-              "package.json"
-            ];
-            if (withNodeModules) {
-              console.log(
-                simpleChalk.gray(
-                  "📦 Including node_modules in bundle (may take longer)..."
-                )
-              );
-              outputPaths.push("node_modules");
-            }
-            const dxtPackageRoot = entryDir !== "." && entryDir !== "" ? path.dirname(options.outDir) : options.outDir;
-            if (logoFilename) {
-              const currentDir = typeof process !== "undefined" ? process.cwd() : "/test";
-              const logoPath = path.join(currentDir, logoFilename);
-              if (fs.existsSync(logoPath)) {
-                console.log(simpleChalk.gray(`Adding logo from: ${logoPath}`));
-                outputPaths.push({
-                  from: logoPath,
-                  to: path.join(dxtPackageRoot, logoFilename)
-                });
+            try {
+              const outputPaths = [
+                "package.json"
+              ];
+              if (withNodeModules) {
+                console.log(
+                  simpleChalk.gray(
+                    "📦 Including node_modules in bundle (may take longer)..."
+                  )
+                );
+                outputPaths.push("node_modules");
               }
-            }
-            if ((_a2 = mcpConfig == null ? void 0 : mcpConfig.dxt) == null ? void 0 : _a2.include) {
-              console.log(
-                simpleChalk.gray(
-                  "📁 Including additional files from DXT configuration..."
-                )
-              );
-              for (const includeItem of mcpConfig.dxt.include) {
-                if (typeof includeItem === "string") {
-                  const sourcePath = path.resolve(projectRoot, includeItem);
-                  if (fs.existsSync(sourcePath)) {
-                    console.log(simpleChalk.gray(`  • ${includeItem}`));
-                    outputPaths.push({
-                      from: sourcePath,
-                      to: path.join(dxtPackageRoot, includeItem)
-                    });
-                  } else {
-                    console.warn(
-                      simpleChalk.yellow(
-                        `  ⚠ File not found: ${includeItem} (resolved to ${sourcePath})`
-                      )
-                    );
-                  }
-                } else {
-                  const sourcePath = path.resolve(
-                    projectRoot,
-                    includeItem.from
-                  );
-                  if (fs.existsSync(sourcePath)) {
-                    console.log(
-                      simpleChalk.gray(`  • ${includeItem.from} → ${includeItem.to}`)
+              const dxtPackageRoot = entryDir !== "." && entryDir !== "" ? path.dirname(options.outDir) : options.outDir;
+              if (logoFilename) {
+                const currentDir = typeof process !== "undefined" ? process.cwd() : "/test";
+                const logoPath = path.join(currentDir, logoFilename);
+                if (fs.existsSync(logoPath)) {
+                  console.log(simpleChalk.gray(`Adding logo from: ${logoPath}`));
+                  outputPaths.push({
+                    from: logoPath,
+                    to: path.join(dxtPackageRoot, logoFilename)
+                  });
+                }
+              }
+              if ((_a2 = mcpConfig == null ? void 0 : mcpConfig.dxt) == null ? void 0 : _a2.include) {
+                console.log(
+                  simpleChalk.gray(
+                    "📁 Including additional files from DXT configuration..."
+                  )
+                );
+                for (const includeItem of mcpConfig.dxt.include) {
+                  if (typeof includeItem === "string") {
+                    const resolvedIncludePath = DxtPathResolver.substituteVariables(
+                      includeItem,
+                      DxtPathResolver.detectContext(),
+                      { allowUndefined: true }
+                      // Allow undefined variables for flexibility
                     );
-                    outputPaths.push({
-                      from: sourcePath,
-                      to: path.join(dxtPackageRoot, includeItem.to)
-                    });
+                    const sourcePath = path.resolve(projectRoot, resolvedIncludePath);
+                    if (fs.existsSync(sourcePath)) {
+                      console.log(simpleChalk.gray(`  • ${resolvedIncludePath}`));
+                      outputPaths.push({
+                        from: sourcePath,
+                        to: path.join(dxtPackageRoot, resolvedIncludePath)
+                      });
+                    } else {
+                      console.warn(
+                        simpleChalk.yellow(
+                          `  ⚠ File not found: ${resolvedIncludePath} (resolved to ${sourcePath})`
+                        )
+                      );
+                    }
                   } else {
-                    console.warn(
-                      simpleChalk.yellow(
-                        `  ⚠ File not found: ${includeItem.from} (resolved to ${sourcePath})`
-                      )
+                    const resolvedFromPath = DxtPathResolver.substituteVariables(
+                      includeItem.from,
+                      DxtPathResolver.detectContext(),
+                      { allowUndefined: true }
+                    );
+                    const resolvedToPath = DxtPathResolver.substituteVariables(
+                      includeItem.to,
+                      DxtPathResolver.detectContext(),
+                      { allowUndefined: true }
                     );
+                    const sourcePath = path.resolve(projectRoot, resolvedFromPath);
+                    if (fs.existsSync(sourcePath)) {
+                      console.log(
+                        simpleChalk.gray(`  • ${resolvedFromPath} → ${resolvedToPath}`)
+                      );
+                      outputPaths.push({
+                        from: sourcePath,
+                        to: path.join(dxtPackageRoot, resolvedToPath)
+                      });
+                    } else {
+                      console.warn(
+                        simpleChalk.yellow(
+                          `  ⚠ File not found: ${resolvedFromPath} (resolved to ${sourcePath})`
+                        )
+                      );
+                    }
                   }
                 }
               }
+              return outputPaths;
+            } catch (error) {
+              console.warn(`Warning: Error in copy function:`, error);
+              return ["package.json"];
             }
-            return outputPaths;
           },
           platform: "node",
           plugins: []
@@ -1833,8 +2233,18 @@ export default ${JSON.stringify(buildConfig, null, 2)};
             simpleChalk.gray("📝 Debug config written to dxt/tsdown.config.dxt.ts")
           );
         }
-        await build(buildConfig);
-        console.log(simpleChalk.green("✅ TSDown bundling completed"));
+        try {
+          await build(buildConfig);
+          console.log(simpleChalk.green("✅ TSDown bundling completed"));
+        } catch (buildError) {
+          console.error(simpleChalk.red("❌ TSDown build failed with error:"));
+          console.error(buildError);
+          if (buildError instanceof Error) {
+            console.error(simpleChalk.red("Error message:"), buildError.message);
+            console.error(simpleChalk.red("Error stack:"), buildError.stack);
+          }
+          throw new Error(`TSDown DXT build failed: ${buildError instanceof Error ? buildError.message : String(buildError)}`);
+        }
         const detectedOutputFile = this.detectTsdownOutputFile(
           outputDir,
           relativeEntryPath.replace(/\.ts$/, ".js")
@@ -2093,7 +2503,7 @@ export default ${JSON.stringify(buildConfig, null, 2)};
         if (flag.enum) {
           properties2[flag.name].enum = flag.enum;
         }
-        if (flag.defaultValue !== void 0) {
+        if (flag.defaultValue !== void 0 && typeof flag.defaultValue !== "function") {
           properties2[flag.name].default = flag.defaultValue;
         }
         if (flag.mandatory) {
@@ -2268,11 +2678,62 @@ export default ${JSON.stringify(buildConfig, null, 2)};
       `Could not find package.json within ${maxAttempts} directories up from ${entryPointFile}. Please ensure your entry point is within a project that has a package.json file.`
     );
   }
+  /**
+   * Validate dxtOptions for common mistakes and security issues
+   * @param flag The flag with dxtOptions to validate
+   * @param envVar The environment variable name for context
+   */
+  validateDxtOptions(flag, envVar) {
+    const dxtOptions = flag.dxtOptions;
+    if (!dxtOptions) return;
+    if (dxtOptions.min !== void 0 && dxtOptions.max !== void 0) {
+      if (dxtOptions.min > dxtOptions.max) {
+        throw new Error(
+          `Invalid dxtOptions for ${envVar}: min (${dxtOptions.min}) cannot be greater than max (${dxtOptions.max})`
+        );
+      }
+    }
+    if (dxtOptions.type !== void 0) {
+      const validTypes = ["string", "directory", "file", "boolean", "number"];
+      if (!validTypes.includes(dxtOptions.type)) {
+        throw new Error(
+          `Invalid dxtOptions.type for ${envVar}: "${dxtOptions.type}". Must be one of: ${validTypes.join(", ")}`
+        );
+      }
+    }
+    if (dxtOptions.default !== void 0 && dxtOptions.type !== void 0) {
+      const defaultType = typeof dxtOptions.default;
+      if (dxtOptions.type === "number" && defaultType !== "number") {
+        throw new Error(
+          `Invalid dxtOptions.default for ${envVar}: expected number, got ${defaultType}`
+        );
+      }
+      if (dxtOptions.type === "boolean" && defaultType !== "boolean") {
+        throw new Error(
+          `Invalid dxtOptions.default for ${envVar}: expected boolean, got ${defaultType}`
+        );
+      }
+    }
+    const sensitiveKeywords = ["key", "token", "password", "secret", "auth"];
+    const envLower = envVar.toLowerCase();
+    const hasSensitiveKeyword = sensitiveKeywords.some((keyword2) => envLower.includes(keyword2));
+    if (hasSensitiveKeyword && dxtOptions.sensitive === false) {
+      console.warn(
+        `⚠️  Security Warning: ${envVar} contains sensitive keyword but dxtOptions.sensitive is false`
+      );
+    }
+    if (flag.mandatory === true && dxtOptions.sensitive !== false) {
+      console.warn(
+        `⚠️  Security Warning: ${envVar} is required and sensitive - consider providing a secure default or making it optional`
+      );
+    }
+  }
   /**
    * Generate environment variables and user configuration from ArgParser flags
    * @returns Object containing envVars and userConfig
    */
   generateEnvAndUserConfig() {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
     const envVars = {};
     const userConfig = {};
     const shouldBeRequired = (flag) => {
@@ -2285,23 +2746,78 @@ export default ${JSON.stringify(buildConfig, null, 2)};
       return false;
     };
     const shouldBeSensitive = (flag) => {
+      var _a2;
+      if (((_a2 = flag.dxtOptions) == null ? void 0 : _a2.sensitive) !== void 0) {
+        return flag.dxtOptions.sensitive;
+      }
       const envVar = flag.env || flag.envVar;
       return !!envVar;
     };
+    const getDxtType = (flag) => {
+      var _a2;
+      if ((_a2 = flag.dxtOptions) == null ? void 0 : _a2.type) {
+        return flag.dxtOptions.type;
+      }
+      if (typeof flag.type === "string") {
+        const lowerType = flag.type.toLowerCase();
+        if (["string", "boolean", "number"].includes(lowerType)) {
+          return lowerType;
+        }
+      } else if (flag.type === String) {
+        return "string";
+      } else if (flag.type === Boolean) {
+        return "boolean";
+      } else if (flag.type === Number) {
+        return "number";
+      }
+      return "string";
+    };
+    const getDxtTitle = (flag, envVar) => {
+      var _a2;
+      if ((_a2 = flag.dxtOptions) == null ? void 0 : _a2.title) {
+        return flag.dxtOptions.title;
+      }
+      return envVar.replace(/_/g, " ").toLowerCase().replace(/\b\w/g, (l) => l.toUpperCase());
+    };
+    const getDxtDescription = (flag, envVar) => {
+      var _a2, _b2;
+      let baseDescription = flag.description || `${envVar} environment variable`;
+      const defaultValue = ((_a2 = flag.dxtOptions) == null ? void 0 : _a2.default) ?? ((_b2 = flag.dxtOptions) == null ? void 0 : _b2.localDefault) ?? flag.defaultValue;
+      if (defaultValue !== void 0 && typeof defaultValue !== "function") {
+        baseDescription += ` (default: ${defaultValue})`;
+      }
+      return baseDescription;
+    };
     const mainFlags = this.argParserInstance.flags;
     for (const flag of mainFlags) {
       const envVar = flag.env || flag.envVar;
       if (envVar) {
+        this.validateDxtOptions(flag, envVar);
         envVars[envVar] = `\${user_config.${envVar}}`;
-        userConfig[envVar] = {
-          type: "string",
-          title: envVar.replace(/_/g, " ").replace(/\b\w/g, (l) => l.toUpperCase()),
-          description: flag.description || `${envVar} environment variable`,
+        const userConfigEntry = {
+          type: getDxtType(flag),
+          title: getDxtTitle(flag, envVar),
+          description: getDxtDescription(flag, envVar),
           required: shouldBeRequired(flag),
           // Respect the flag's mandatory setting
           sensitive: shouldBeSensitive(flag)
-          // Set to sensitive if tied to ENV
+          // Use dxtOptions or default logic
         };
+        if (((_a = flag.dxtOptions) == null ? void 0 : _a.multiple) !== void 0) {
+          userConfigEntry.multiple = flag.dxtOptions.multiple;
+        }
+        if (((_b = flag.dxtOptions) == null ? void 0 : _b.min) !== void 0) {
+          userConfigEntry.min = flag.dxtOptions.min;
+        }
+        if (((_c = flag.dxtOptions) == null ? void 0 : _c.max) !== void 0) {
+          userConfigEntry.max = flag.dxtOptions.max;
+        }
+        if (((_d = flag.dxtOptions) == null ? void 0 : _d.default) !== void 0 && typeof flag.dxtOptions.default !== "function") {
+          userConfigEntry.default = flag.dxtOptions.default;
+        } else if (((_e = flag.dxtOptions) == null ? void 0 : _e.localDefault) !== void 0 && typeof flag.dxtOptions.localDefault !== "function") {
+          userConfigEntry.default = flag.dxtOptions.localDefault;
+        }
+        userConfig[envVar] = userConfigEntry;
       }
     }
     if (typeof this.argParserInstance.getTools === "function") {
@@ -2311,16 +2827,32 @@ export default ${JSON.stringify(buildConfig, null, 2)};
         for (const flag of toolFlags) {
           const envVar = flag.env || flag.envVar;
           if (envVar && !envVars[envVar]) {
+            this.validateDxtOptions(flag, envVar);
             envVars[envVar] = `\${user_config.${envVar}}`;
-            userConfig[envVar] = {
-              type: "string",
-              title: envVar.replace(/_/g, " ").replace(/\b\w/g, (l) => l.toUpperCase()),
-              description: flag.description || `${envVar} environment variable`,
+            const userConfigEntry = {
+              type: getDxtType(flag),
+              title: getDxtTitle(flag, envVar),
+              description: getDxtDescription(flag, envVar),
               required: shouldBeRequired(flag),
               // Respect the flag's mandatory setting
               sensitive: shouldBeSensitive(flag)
-              // Set to sensitive if tied to ENV
+              // Use dxtOptions or default logic
             };
+            if (((_f = flag.dxtOptions) == null ? void 0 : _f.multiple) !== void 0) {
+              userConfigEntry.multiple = flag.dxtOptions.multiple;
+            }
+            if (((_g = flag.dxtOptions) == null ? void 0 : _g.min) !== void 0) {
+              userConfigEntry.min = flag.dxtOptions.min;
+            }
+            if (((_h = flag.dxtOptions) == null ? void 0 : _h.max) !== void 0) {
+              userConfigEntry.max = flag.dxtOptions.max;
+            }
+            if (((_i = flag.dxtOptions) == null ? void 0 : _i.default) !== void 0 && typeof flag.dxtOptions.default !== "function") {
+              userConfigEntry.default = flag.dxtOptions.default;
+            } else if (((_j = flag.dxtOptions) == null ? void 0 : _j.localDefault) !== void 0 && typeof flag.dxtOptions.localDefault !== "function") {
+              userConfigEntry.default = flag.dxtOptions.localDefault;
+            }
+            userConfig[envVar] = userConfigEntry;
           }
         }
       }
@@ -2351,10 +2883,10 @@ export default ${JSON.stringify(buildConfig, null, 2)};
           );
         }
         const pathsMatcher = createPathsMatcher(tsconfig);
-        if (!pathsMatcher) {
+        if (!pathsMatcher || typeof pathsMatcher !== "function") {
           if (Boolean(process.env["DEBUG"])) {
             console.log(
-              `  <${simpleChalk.gray("ts-paths")}> Failed to create paths matcher`
+              `  <${simpleChalk.gray("ts-paths")}> Failed to create paths matcher or matcher is not a function`
             );
           }
         } else {
@@ -3064,7 +3596,8 @@ const _FlagManager = class _FlagManager {
       validate: parsedFromZod["validate"],
       enum: parsedFromZod["enum"],
       mandatory: parsedFromZod["mandatory"],
-      env: parsedFromZod["env"]
+      env: parsedFromZod["env"],
+      dxtOptions: parsedFromZod["dxtOptions"]
     };
   }
   addFlag(flag) {
@@ -3113,97 +3646,6 @@ const _FlagManager = class _FlagManager {
 __flags = new WeakMap();
 _throwForDuplicateFlags = new WeakMap();
 let FlagManager = _FlagManager;
-function detectEntryPoint() {
-  try {
-    if (process.argv[1] && fs.existsSync(process.argv[1])) {
-      return process.argv[1];
-    }
-    if (typeof require !== "undefined" && require.main && require.main.filename) {
-      return require.main.filename;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function getEntryPointFromImportMeta(importMetaUrl) {
-  if (importMetaUrl.startsWith("file://")) {
-    return decodeURIComponent(importMetaUrl.replace("file://", ""));
-  }
-  return importMetaUrl;
-}
-function normalizePath(path2) {
-  return path2.trim();
-}
-function resolveLogPath(logPath, fallbackEntryPoint) {
-  if (typeof logPath === "string") {
-    const normalizedPath2 = normalizePath(logPath);
-    if (path.isAbsolute(normalizedPath2)) {
-      return normalizedPath2;
-    }
-    if (normalizedPath2.startsWith("cwd:")) {
-      const relativePath = normalizedPath2.slice(4);
-      return path.resolve(process.cwd(), relativePath);
-    }
-    const entryPoint = detectEntryPoint() || fallbackEntryPoint;
-    if (entryPoint) {
-      return path.resolve(path.dirname(entryPoint), normalizedPath2);
-    }
-    console.warn(
-      `Warning: Could not detect entry point for log path resolution. Using process.cwd() as fallback. Path: ${normalizedPath2}`
-    );
-    return path.resolve(process.cwd(), normalizedPath2);
-  }
-  const { path: logFilePath, relativeTo = "entry", basePath } = logPath;
-  const normalizedPath = normalizePath(logFilePath);
-  switch (relativeTo) {
-    case "absolute":
-      if (basePath) {
-        return path.resolve(basePath, normalizedPath);
-      }
-      if (path.isAbsolute(normalizedPath)) {
-        return normalizedPath;
-      }
-      console.warn(
-        `Warning: relativeTo 'absolute' specified but no basePath provided and path is not absolute. Using process.cwd() as fallback. Path: ${normalizedPath}`
-      );
-      return path.resolve(process.cwd(), normalizedPath);
-    case "cwd":
-      return path.resolve(process.cwd(), normalizedPath);
-    case "entry":
-    default:
-      const entryPoint = detectEntryPoint() || fallbackEntryPoint;
-      if (entryPoint) {
-        return path.resolve(path.dirname(entryPoint), normalizedPath);
-      }
-      console.warn(
-        `Warning: Could not detect entry point for log path resolution. Using process.cwd() as fallback. Path: ${normalizedPath}`
-      );
-      return path.resolve(process.cwd(), normalizedPath);
-  }
-}
-function entryRelative(path2) {
-  return {
-    path: path2,
-    relativeTo: "entry"
-  };
-}
-function cwdRelative(path2) {
-  return {
-    path: path2,
-    relativeTo: "cwd"
-  };
-}
-function absolutePath(path2, basePath) {
-  return {
-    path: path2,
-    relativeTo: "absolute",
-    basePath
-  };
-}
-function legacyCwdPath(path2) {
-  return `cwd:${path2}`;
-}
 class ArgParserError extends Error {
   constructor(message, cmdChain = []) {
     super(message);
@@ -3470,22 +3912,41 @@ const _ArgParserBase = class _ArgParserBase {
       console.log("--- End Configuration Dump ---\\n");
     }
   }
+  /**
+   * Detects if the current script is being executed directly (not imported)
+   * Uses a robust method that works across different environments and sandboxes
+   * @param importMetaUrl The import.meta.url from the calling script (optional)
+   * @returns true if the script is being executed directly, false if imported
+   */
+  static isExecutedDirectly(importMetaUrl) {
+    try {
+      if (importMetaUrl) {
+        const currentFile = fileURLToPath(importMetaUrl);
+        const executedFile = path.resolve(process.argv[1]);
+        return currentFile === executedFile;
+      }
+      if (typeof process !== "undefined" && process.argv && process.argv[1]) {
+        return false;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
   async parse(processArgs, options) {
-    var _a, _b;
+    var _a;
     debug.log("ArgParserBase.parse() called with args:", processArgs);
+    const shouldCheckAutoExecution = (options == null ? void 0 : options.importMetaUrl) && (options == null ? void 0 : options.autoExecute) !== false;
+    if (shouldCheckAutoExecution) {
+      const isDirectExecution = _ArgParserBase.isExecutedDirectly(options.importMetaUrl);
+      if (!isDirectExecution) {
+        debug.log("Auto-execution enabled but script is imported, skipping execution");
+        return {};
+      }
+    }
     if (processArgs === void 0) {
       if (typeof process !== "undefined" && process.argv && Array.isArray(process.argv)) {
         processArgs = process.argv.slice(2);
-        const isCliMode = !__privateGet(this, _parentParser) && !!__privateGet(this, _appCommandName);
-        const isMcpMode = (options == null ? void 0 : options.isMcp) || ((_a = globalThis.console) == null ? void 0 : _a.mcpError);
-        if (isCliMode && !isMcpMode) {
-          console.warn(
-            `Warning: parse() called without arguments. Auto-detected Node.js environment and using process.argv.slice(2).`
-          );
-          console.warn(
-            `For explicit control, call parse(process.argv.slice(2)) instead.`
-          );
-        }
       } else {
         throw new Error(
           "parse() called without arguments in non-Node.js environment. Please provide arguments explicitly: parse(['--flag', 'value'])"
@@ -3510,7 +3971,7 @@ const _ArgParserBase = class _ArgParserBase {
         commandChain: identifiedCommandChain,
         parserChain: identifiedParserChain
       } = __privateMethod(this, _ArgParserBase_instances, _identifyCommandChainAndParsers_fn).call(this, processArgs, this, [], [this]);
-      const saveToEnvResult = __privateMethod(_b = identifiedFinalParser, _ArgParserBase_instances, _handleSaveToEnvFlag_fn).call(_b, processArgs, identifiedParserChain);
+      const saveToEnvResult = __privateMethod(_a = identifiedFinalParser, _ArgParserBase_instances, _handleSaveToEnvFlag_fn).call(_a, processArgs, identifiedParserChain);
       if (saveToEnvResult !== false) {
         return saveToEnvResult === true ? {} : saveToEnvResult;
       }
@@ -4829,7 +5290,10 @@ _startUnifiedMcpServer_fn = async function(mcpServerConfig, transportOptions) {
     const finalTransportOptions = {
       port: transportOptions.port,
       host: transportOptions.host || "localhost",
-      path: transportOptions.path || "/mcp"
+      path: transportOptions.path || "/mcp",
+      // Pass-through for streamable-http only; harmlessly ignored for others
+      cors: transportOptions.cors,
+      auth: transportOptions.auth
     };
     await mcpParser.startMcpServerWithTransport(
       serverInfo,
@@ -4937,6 +5401,27 @@ _parseMcpTransportOptions_fn = function(processArgs) {
           i++;
         }
         break;
+      // Streamable HTTP extras (accept JSON string)
+      case "--s-mcp-cors":
+        if (nextArg && !nextArg.startsWith("-")) {
+          try {
+            options.cors = JSON.parse(nextArg);
+          } catch {
+            options.cors = nextArg;
+          }
+          i++;
+        }
+        break;
+      case "--s-mcp-auth":
+        if (nextArg && !nextArg.startsWith("-")) {
+          try {
+            options.auth = JSON.parse(nextArg);
+          } catch {
+            options.auth = nextArg;
+          }
+          i++;
+        }
+        break;
       // Backward compatibility: support old flags but with deprecation warning
       case "--transport":
       case "--port":
@@ -6974,6 +7459,34 @@ Migration guide: https://github.com/alcyone-labs/arg-parser/blob/main/docs/MCP-M
   parseAsync(processArgs, options) {
     return this.parse(processArgs, options);
   }
+  /**
+   * Convenience method for auto-execution: only runs if the script is executed directly (not imported).
+   * This eliminates the need for boilerplate code to check if the script is being run directly.
+   *
+   * @param importMetaUrl Pass import.meta.url from your script for reliable detection
+   * @param processArgs Optional arguments to parse (defaults to process.argv.slice(2))
+   * @param options Additional parse options
+   * @returns Promise that resolves to the parse result, or empty object if script is imported
+   *
+   * @example
+   * ```typescript
+   * // At the bottom of your CLI script:
+   * await cli.parseIfExecutedDirectly(import.meta.url);
+   *
+   * // With error handling:
+   * await cli.parseIfExecutedDirectly(import.meta.url).catch((error) => {
+   *   console.error("Fatal error:", error instanceof Error ? error.message : String(error));
+   *   process.exit(1);
+   * });
+   * ```
+   */
+  async parseIfExecutedDirectly(importMetaUrl, processArgs, options) {
+    return this.parse(processArgs, {
+      ...options,
+      autoExecute: true,
+      importMetaUrl
+    });
+  }
   addMcpSubCommand(subCommandName = "mcp-server", serverInfo, optionsOrToolOptions) {
     console.warn(`[DEPRECATED] addMcpSubCommand() is deprecated and will be removed in v2.0.
 Please use withMcp() to configure server metadata and the --s-mcp-serve system flag instead.
@@ -7252,6 +7765,7 @@ registerToolAsSubCommand_fn = function(toolConfig) {
   });
 };
 _startSingleTransport_fn = async function(server, serverInfo, transportConfig, logPath) {
+  var _a, _b, _c, _d, _e, _f;
   const resolvedLogPath = resolveLogPath(logPath || "./logs/mcp.log");
   const logger2 = createMcpLogger("MCP Transport", resolvedLogPath);
   try {
@@ -7295,10 +7809,142 @@ _startSingleTransport_fn = async function(server, serverInfo, transportConfig, l
         const express = (await import("express")).default;
         const app = express();
         app.use(express.json());
+        try {
+          (_c = (_b = (_a = this._mcpServerConfig) == null ? void 0 : _a.httpServer) == null ? void 0 : _b.configureExpress) == null ? void 0 : _c.call(_b, app);
+        } catch (e) {
+        }
         const port = transportConfig.port || 3e3;
         const path2 = transportConfig.path || "/mcp";
+        if (transportConfig.cors) {
+          const cors = transportConfig.cors;
+          const allowMethods = ((_d = cors.methods) == null ? void 0 : _d.join(", ")) || "GET,POST,PUT,PATCH,DELETE,OPTIONS";
+          const allowHeaders = (req) => {
+            var _a2;
+            return ((_a2 = cors.headers) == null ? void 0 : _a2.join(", ")) || req.headers["access-control-request-headers"] || "Content-Type, Authorization, MCP-Session-Id";
+          };
+          const exposed = ((_e = cors.exposedHeaders) == null ? void 0 : _e.join(", ")) || void 0;
+          const resolveOrigin = (req) => {
+            const reqOrigin = req.headers.origin;
+            const origins = cors.origins ?? "*";
+            if (origins === "*") return cors.credentials ? reqOrigin : "*";
+            if (!reqOrigin) return void 0;
+            const list = Array.isArray(origins) ? origins : [origins];
+            for (const o of list) {
+              if (typeof o === "string" && o === reqOrigin) return reqOrigin;
+              if (o instanceof RegExp && o.test(reqOrigin)) return reqOrigin;
+            }
+            return void 0;
+          };
+          const applyCorsHeaders = (req, res) => {
+            const origin = resolveOrigin(req);
+            if (origin) res.setHeader("Access-Control-Allow-Origin", origin);
+            if (cors.credentials) res.setHeader("Access-Control-Allow-Credentials", "true");
+            res.setHeader("Vary", "Origin");
+            res.setHeader("Access-Control-Allow-Methods", allowMethods);
+            const hdrs = allowHeaders(req);
+            if (hdrs) res.setHeader("Access-Control-Allow-Headers", hdrs);
+            if (exposed) res.setHeader("Access-Control-Expose-Headers", exposed);
+            if (typeof cors.maxAge === "number") res.setHeader("Access-Control-Max-Age", String(cors.maxAge));
+          };
+          app.options(path2, (req, res) => {
+            applyCorsHeaders(req, res);
+            res.status(204).end();
+          });
+          app.use((req, res, next) => {
+            if (req.path === path2) applyCorsHeaders(req, res);
+            next();
+          });
+        }
+        if ((_f = transportConfig.auth) == null ? void 0 : _f.customMiddleware) {
+          app.use(transportConfig.auth.customMiddleware);
+        }
+        const authOpts = transportConfig.auth;
+        const shouldRequireAuthFor = (req) => {
+          if (!authOpts) return false;
+          const reqPath = req.path;
+          const pub = authOpts.publicPaths || [];
+          const prot = authOpts.protectedPaths;
+          if (pub.includes(reqPath)) return false;
+          if (prot && !prot.includes(reqPath)) return false;
+          return authOpts.required !== false;
+        };
+        const base64urlDecode = (s) => Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+        const verifyJwt = async (token) => {
+          if (!(authOpts == null ? void 0 : authOpts.jwt)) return false;
+          const [h, p, sig] = token.split(".");
+          if (!h || !p || !sig) return false;
+          const header = JSON.parse(base64urlDecode(h).toString("utf8"));
+          const payload = JSON.parse(base64urlDecode(p).toString("utf8"));
+          const alg = header.alg;
+          if (authOpts.jwt.algorithms && !authOpts.jwt.algorithms.includes(alg)) return false;
+          const data2 = Buffer.from(`${h}.${p}`);
+          const signature = base64urlDecode(sig);
+          if (alg === "HS256") {
+            const secret = authOpts.jwt.secret;
+            if (!secret) return false;
+            const hmac = (await import("node:crypto")).createHmac("sha256", secret).update(data2).digest();
+            if (!hmac.equals(signature)) return false;
+          } else if (alg === "RS256") {
+            const crypto = await import("node:crypto");
+            let key = authOpts.jwt.publicKey;
+            if (!key && authOpts.jwt.getPublicKey) {
+              key = await authOpts.jwt.getPublicKey(header, payload);
+            }
+            if (!key) return false;
+            const verify = crypto.createVerify("RSA-SHA256");
+            verify.update(data2);
+            verify.end();
+            const ok = verify.verify(key, signature);
+            if (!ok) return false;
+          } else {
+            return false;
+          }
+          if (authOpts.jwt.audience) {
+            const allowed = Array.isArray(authOpts.jwt.audience) ? authOpts.jwt.audience : [authOpts.jwt.audience];
+            if (!allowed.includes(payload.aud)) return false;
+          }
+          if (authOpts.jwt.issuer) {
+            const allowed = Array.isArray(authOpts.jwt.issuer) ? authOpts.jwt.issuer : [authOpts.jwt.issuer];
+            if (!allowed.includes(payload.iss)) return false;
+          }
+          const nowSec = Math.floor(Date.now() / 1e3);
+          const tol = authOpts.jwt.clockToleranceSec || 0;
+          if (payload.nbf && nowSec + tol < payload.nbf) return false;
+          if (payload.exp && nowSec - tol >= payload.exp) return false;
+          return true;
+        };
+        const authenticate = async (req) => {
+          if (!authOpts) return true;
+          const authz = req.headers.authorization;
+          const token = (authz == null ? void 0 : authz.startsWith("Bearer ")) ? authz.slice(7) : void 0;
+          if (!token) {
+            if (authOpts.validator) return !!await authOpts.validator(req, token);
+            return false;
+          }
+          if (authOpts.scheme === "jwt" || authOpts.jwt) {
+            const ok = await verifyJwt(token);
+            if (!ok) return false;
+          } else if (authOpts.scheme === "bearer" || !authOpts.scheme) {
+            if (authOpts.allowedTokens && !authOpts.allowedTokens.includes(token)) {
+              if (authOpts.validator) return !!await authOpts.validator(req, token);
+              return false;
+            }
+          }
+          if (authOpts.validator) {
+            const ok = await authOpts.validator(req, token);
+            if (!ok) return false;
+          }
+          return true;
+        };
         const transports = {};
         app.all(path2, async (req, res) => {
+          if (shouldRequireAuthFor(req)) {
+            const ok = await authenticate(req);
+            if (!ok) {
+              res.status(401).json({ error: "Unauthorized" });
+              return;
+            }
+          }
           const sessionId = req.headers["mcp-session-id"];
           let transport;
           if (sessionId && transports[sessionId]) {
@@ -7311,9 +7957,7 @@ _startSingleTransport_fn = async function(server, serverInfo, transportConfig, l
               }
             });
             transport.onclose = () => {
-              if (transport.sessionId) {
-                delete transports[transport.sessionId];
-              }
+              if (transport.sessionId) delete transports[transport.sessionId];
             };
             await server.connect(transport);
           }
@@ -24974,6 +25618,7 @@ export {
   ArgParserMcp,
   ConfigPlugin,
   ConfigPluginRegistry,
+  DxtPathResolver,
   EnvConfigPlugin,
   JsonConfigPlugin,
   Logger,
@@ -25012,6 +25657,7 @@ export {
   logger,
   resolveLogPath,
   sanitizeMcpToolName,
+  zodDxtOptionsSchema,
   zodFlagSchema
 };
 //# sourceMappingURL=index.mjs.map