v2: limit public exports (#1680)

Co-authored-by: Felix Weinberger <fweinberger@anthropic.com> Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
2026-03-25 22:25:01 +02:00 · 2026-03-25 22:25:01 +02:00 · 0ed723748b
commit 0ed723748b
parent f1ade75b67
47 changed files with 3084 additions and 2566 deletions
--- a/CLAUDE.md
+++ b/CLAUDE.md
@ -62,6 +62,19 @@ The SDK is organized into three main layers:
    - `Server` (`packages/server/src/server/server.ts`) - Server implementation extending Protocol with request handler registration
    - `McpServer` (`packages/server/src/server/mcp.ts`) - High-level server API with simplified resource/tool/prompt registration

+### Public API Exports
+
+The SDK has a two-layer export structure to separate internal code from the public API:
+
+- **`@modelcontextprotocol/core`** (main entry, `packages/core/src/index.ts`) — Internal barrel. Exports everything (including Zod schemas, Protocol class, stdio utils). Only consumed by sibling packages within the monorepo (`private: true`).
+- **`@modelcontextprotocol/core/public`** (`packages/core/src/exports/public/index.ts`) — Curated public API. Exports only TypeScript types, error classes, constants, and guards. Re-exported by client and server packages.
+- **`@modelcontextprotocol/client`** and **`@modelcontextprotocol/server`** (`packages/*/src/index.ts`) — Final public surface. Package-specific exports (named explicitly) plus re-exports from `core/public`.
+
+When modifying exports:
+- Use explicit named exports, not `export *`, in package `index.ts` files and `core/public`.
+- Adding a symbol to a package `index.ts` makes it public API — do so intentionally.
+- Internal helpers should stay in the core internal barrel and not be added to `core/public` or package index files.
+
 ### Transport System

 Transports (`packages/core/src/shared/transport.ts`) provide the communication layer:
--- a/docs/migration-SKILL.md
+++ b/docs/migration-SKILL.md
@ -61,18 +61,17 @@ Replace all `@modelcontextprotocol/sdk/...` imports using this table.

 | v1 import path                                    | v2 package                   |
 | ------------------------------------------------- | ---------------------------- |
-| `@modelcontextprotocol/sdk/types.js`              | `@modelcontextprotocol/core` |
-| `@modelcontextprotocol/sdk/shared/protocol.js`    | `@modelcontextprotocol/core` |
-| `@modelcontextprotocol/sdk/shared/transport.js`   | `@modelcontextprotocol/core` |
-| `@modelcontextprotocol/sdk/shared/stdio.js`       | `@modelcontextprotocol/core` |
-| `@modelcontextprotocol/sdk/shared/uriTemplate.js` | `@modelcontextprotocol/core` |
-| `@modelcontextprotocol/sdk/shared/auth.js`        | `@modelcontextprotocol/core` |
+| `@modelcontextprotocol/sdk/types.js`              | `@modelcontextprotocol/client` or `@modelcontextprotocol/server` |
+| `@modelcontextprotocol/sdk/shared/protocol.js`    | `@modelcontextprotocol/client` or `@modelcontextprotocol/server` |
+| `@modelcontextprotocol/sdk/shared/transport.js`   | `@modelcontextprotocol/client` or `@modelcontextprotocol/server` |
+| `@modelcontextprotocol/sdk/shared/uriTemplate.js` | `@modelcontextprotocol/client` or `@modelcontextprotocol/server` |
+| `@modelcontextprotocol/sdk/shared/auth.js`        | `@modelcontextprotocol/client` or `@modelcontextprotocol/server` |
+| `@modelcontextprotocol/sdk/shared/stdio.js`       | `@modelcontextprotocol/client` or `@modelcontextprotocol/server` |

 Notes:

- `@modelcontextprotocol/client` and `@modelcontextprotocol/server` both re-export everything from `@modelcontextprotocol/core`, so you can import types from whichever package you already depend on.
+- `@modelcontextprotocol/client` and `@modelcontextprotocol/server` both re-export shared types from `@modelcontextprotocol/core`, so import from whichever package you already depend on. Do not import from `@modelcontextprotocol/core` directly — it is an internal package.
 - When multiple v1 imports map to the same v2 package, consolidate them into a single import statement.
- If code imports from `sdk/client/...`, install `@modelcontextprotocol/client`. If from `sdk/server/...`, install `@modelcontextprotocol/server`. If from `sdk/types.js` or `sdk/shared/...` only, install `@modelcontextprotocol/core`.

 ## 4. Renamed Symbols

@ -91,7 +90,7 @@ Notes:
 | `ResourceReference`                      | `ResourceTemplateReference`                              |
 | `ResourceReferenceSchema`                | `ResourceTemplateReferenceSchema`                        |
 | `IsomorphicHeaders`                      | REMOVED (use Web Standard `Headers`)                     |
-| `AuthInfo` (from `server/auth/types.js`) | `AuthInfo` (now in `@modelcontextprotocol/core`)         |
+| `AuthInfo` (from `server/auth/types.js`) | `AuthInfo` (now re-exported by `@modelcontextprotocol/client` and `@modelcontextprotocol/server`) |
 | `McpError`                               | `ProtocolError`                                          |
 | `ErrorCode`                              | `ProtocolErrorCode`                                      |
 | `ErrorCode.RequestTimeout`               | `SdkErrorCode.RequestTimeout`                            |
@ -144,7 +143,7 @@ Update error handling:
 if (error instanceof McpError && error.code === ErrorCode.RequestTimeout) { ... }

 // v2
-import { SdkError, SdkErrorCode } from '@modelcontextprotocol/core';
+import { SdkError, SdkErrorCode } from '@modelcontextprotocol/client';
 if (error instanceof SdkError && error.code === SdkErrorCode.RequestTimeout) { ... }
 ```

@ -158,7 +157,7 @@ if (error instanceof StreamableHTTPError) {
 }

 // v2
-import { SdkError, SdkErrorCode } from '@modelcontextprotocol/core';
+import { SdkError, SdkErrorCode } from '@modelcontextprotocol/client';
 if (error instanceof SdkError && error.code === SdkErrorCode.ClientHttpFailedToOpenStream) {
    const status = (error.data as { status?: number })?.status;
 }
@ -195,11 +194,11 @@ Update OAuth error handling:

 ```typescript
 // v1
-import { InvalidClientError, InvalidGrantError } from '@modelcontextprotocol/core';
+import { InvalidClientError, InvalidGrantError } from '@modelcontextprotocol/client';
 if (error instanceof InvalidClientError) { ... }

 // v2
-import { OAuthError, OAuthErrorCode } from '@modelcontextprotocol/core';
+import { OAuthError, OAuthErrorCode } from '@modelcontextprotocol/client';
 if (error instanceof OAuthError && error.code === OAuthErrorCode.InvalidClient) { ... }
 ```

@ -210,7 +209,7 @@ Zod schemas, all callback return types. Note: `callTool()` and `request()` signa

 The variadic `.tool()`, `.prompt()`, `.resource()` methods are removed. Use the `register*` methods with a config object.

-**IMPORTANT**: v2 requires schema objects implementing [Standard Schema](https://standardschema.dev/) — raw shapes like `{ name: z.string() }` are no longer supported. Wrap with `z.object()` (Zod v4), or use ArkType's `type({...})`, or Valibot. For raw JSON Schema, wrap with `fromJsonSchema(schema, validator)` from `@modelcontextprotocol/core`. Applies to `inputSchema`, `outputSchema`, and `argsSchema`.
+**IMPORTANT**: v2 requires schema objects implementing [Standard Schema](https://standardschema.dev/) — raw shapes like `{ name: z.string() }` are no longer supported. Wrap with `z.object()` (Zod v4), or use ArkType's `type({...})`, or Valibot. For raw JSON Schema, wrap with `fromJsonSchema(schema, validator)` from `@modelcontextprotocol/server`. Applies to `inputSchema`, `outputSchema`, and `argsSchema`.

 ### Tools

--- a/docs/migration.md
+++ b/docs/migration.md
@ -52,13 +52,12 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 ```typescript
 import { Client, StreamableHTTPClientTransport, StdioClientTransport } from '@modelcontextprotocol/client';
 import { McpServer, StdioServerTransport, WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/server';
-import { CallToolResultSchema } from '@modelcontextprotocol/core';

 // Node.js HTTP server transport is in the @modelcontextprotocol/node package
 import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 ```

-Note: `@modelcontextprotocol/client` and `@modelcontextprotocol/server` both re-export everything from `@modelcontextprotocol/core`, so you can import types from whichever package you already depend on.
+Note: `@modelcontextprotocol/client` and `@modelcontextprotocol/server` both re-export shared types from `@modelcontextprotocol/core`, so you can import types and error classes from whichever package you already depend on. Do not import from `@modelcontextprotocol/core` directly — it is an internal package.

 ### Dropped Node.js 18 and CommonJS

@ -117,7 +116,7 @@ Server-side OAuth/auth has been removed entirely from the SDK. This includes `mc

 Use a dedicated auth library (e.g., `better-auth`) or a full Authorization Server instead. See the [examples](../examples/server/src/) for a working demo with `better-auth`.

-Note: `AuthInfo` has moved from `server/auth/types.ts` to `@modelcontextprotocol/core` (it's now a core type).
+Note: `AuthInfo` has moved from `server/auth/types.ts` to the core types and is now re-exported by `@modelcontextprotocol/client` and `@modelcontextprotocol/server`.

 ### `Headers` object instead of plain objects

@ -252,7 +251,7 @@ server.registerTool('greet', {
 }, async ({ name }) => { ... });

 // Raw JSON Schema via fromJsonSchema
-import { fromJsonSchema, AjvJsonSchemaValidator } from '@modelcontextprotocol/core';
+import { fromJsonSchema, AjvJsonSchemaValidator } from '@modelcontextprotocol/server';
 server.registerTool('greet', {
  inputSchema: fromJsonSchema({ type: 'object', properties: { name: { type: 'string' } } }, new AjvJsonSchemaValidator())
 }, handler);
@ -434,6 +433,22 @@ const client = new Client(
 );
 ```

+### `InMemoryTransport` removed from public API
+
+`InMemoryTransport` has been removed from the public API surface. It was previously used for in-process client-server connections and testing.
+
+For **testing**, import it directly from the internal core package:
+
+```typescript
+// v1
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
+
+// v2 (testing only — @modelcontextprotocol/core is internal, not for production use)
+import { InMemoryTransport } from '@modelcontextprotocol/core';
+```
+
+For **production in-process connections**, use `StreamableHTTPClientTransport` with a local server URL, or connect client and server via paired streams.
+
 ### Removed type aliases and deprecated exports

 The following deprecated type aliases have been removed from `@modelcontextprotocol/core`:
@ -447,9 +462,9 @@ The following deprecated type aliases have been removed from `@modelcontextproto
 | `ResourceReferenceSchema`                | `ResourceTemplateReferenceSchema`                |
 | `ResourceReference`                      | `ResourceTemplateReference`                      |
 | `IsomorphicHeaders`                      | Use Web Standard `Headers`                       |
-| `AuthInfo` (from `server/auth/types.js`) | `AuthInfo` (now in `@modelcontextprotocol/core`) |
+| `AuthInfo` (from `server/auth/types.js`) | `AuthInfo` (now re-exported by `@modelcontextprotocol/client` and `@modelcontextprotocol/server`) |

-All other types and schemas exported from `@modelcontextprotocol/sdk/types.js` retain their original names in `@modelcontextprotocol/core`.
+All other types and schemas exported from `@modelcontextprotocol/sdk/types.js` retain their original names — import them from `@modelcontextprotocol/client` or `@modelcontextprotocol/server`.

 **Before (v1):**

@ -460,7 +475,7 @@ import { JSONRPCError, ResourceReference, isJSONRPCError } from '@modelcontextpr
 **After (v2):**

 ```typescript
-import { JSONRPCErrorResponse, ResourceTemplateReference, isJSONRPCErrorResponse } from '@modelcontextprotocol/core';
+import { JSONRPCErrorResponse, ResourceTemplateReference, isJSONRPCErrorResponse } from '@modelcontextprotocol/server';
 ```

 ### Request handler context types
@ -576,7 +591,7 @@ try {
 **After (v2):**

 ```typescript
-import { ProtocolError, ProtocolErrorCode, SdkError, SdkErrorCode } from '@modelcontextprotocol/core';
+import { ProtocolError, ProtocolErrorCode, SdkError, SdkErrorCode } from '@modelcontextprotocol/client';

 try {
    await client.callTool({ name: 'test', arguments: {} });
@ -633,7 +648,7 @@ try {
 **After (v2):**

 ```typescript
-import { SdkError, SdkErrorCode } from '@modelcontextprotocol/core';
+import { SdkError, SdkErrorCode } from '@modelcontextprotocol/client';

 try {
    await transport.send(message);
@ -703,7 +718,7 @@ The `OAUTH_ERRORS` constant has also been removed.
 **Before (v1):**

 ```typescript
-import { InvalidClientError, InvalidGrantError, ServerError } from '@modelcontextprotocol/core';
+import { InvalidClientError, InvalidGrantError, ServerError } from '@modelcontextprotocol/client';

 try {
    await refreshToken();
@ -721,7 +736,7 @@ try {
 **After (v2):**

 ```typescript
-import { OAuthError, OAuthErrorCode } from '@modelcontextprotocol/core';
+import { OAuthError, OAuthErrorCode } from '@modelcontextprotocol/client';

 try {
    await refreshToken();
--- a/examples/client-quickstart/tsconfig.json
+++ b/examples/client-quickstart/tsconfig.json
@ -15,6 +15,9 @@
            "@modelcontextprotocol/client/_shims": ["./node_modules/@modelcontextprotocol/client/src/shimsNode.ts"],
            "@modelcontextprotocol/core": [
                "./node_modules/@modelcontextprotocol/client/node_modules/@modelcontextprotocol/core/src/index.ts"
+            ],
+            "@modelcontextprotocol/core/public": [
+                "./node_modules/@modelcontextprotocol/client/node_modules/@modelcontextprotocol/core/src/exports/public/index.ts"
            ]
        }
    },
--- a/examples/client/tsconfig.json
+++ b/examples/client/tsconfig.json
@ -10,6 +10,9 @@
            "@modelcontextprotocol/core": [
                "./node_modules/@modelcontextprotocol/client/node_modules/@modelcontextprotocol/core/src/index.ts"
            ],
+            "@modelcontextprotocol/core/public": [
+                "./node_modules/@modelcontextprotocol/client/node_modules/@modelcontextprotocol/core/src/exports/public/index.ts"
+            ],
            "@modelcontextprotocol/eslint-config": ["./node_modules/@modelcontextprotocol/eslint-config/tsconfig.json"],
            "@modelcontextprotocol/vitest-config": ["./node_modules/@modelcontextprotocol/vitest-config/tsconfig.json"],
            "@modelcontextprotocol/examples-shared": ["./node_modules/@modelcontextprotocol/examples-shared/src/index.ts"]
--- a/examples/server-quickstart/tsconfig.json
+++ b/examples/server-quickstart/tsconfig.json
@ -14,6 +14,9 @@
            "@modelcontextprotocol/server/_shims": ["./node_modules/@modelcontextprotocol/server/src/shimsNode.ts"],
            "@modelcontextprotocol/core": [
                "./node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/src/index.ts"
+            ],
+            "@modelcontextprotocol/core/public": [
+                "./node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/src/exports/public/index.ts"
            ]
        }
    },
--- a/examples/server/tsconfig.json
+++ b/examples/server/tsconfig.json
@ -13,6 +13,9 @@
            "@modelcontextprotocol/core": [
                "./node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/src/index.ts"
            ],
+            "@modelcontextprotocol/core/public": [
+                "./node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/src/exports/public/index.ts"
+            ],
            "@modelcontextprotocol/examples-shared": ["./node_modules/@modelcontextprotocol/examples-shared/src/index.ts"],
            "@modelcontextprotocol/eslint-config": ["./node_modules/@modelcontextprotocol/eslint-config/tsconfig.json"],
            "@modelcontextprotocol/vitest-config": ["./node_modules/@modelcontextprotocol/vitest-config/tsconfig.json"]
--- a/examples/shared/tsconfig.json
+++ b/examples/shared/tsconfig.json
@ -12,6 +12,9 @@
            "@modelcontextprotocol/core": [
                "./node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/src/index.ts"
            ],
+            "@modelcontextprotocol/core/public": [
+                "./node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/src/exports/public/index.ts"
+            ],
            "@modelcontextprotocol/eslint-config": ["./node_modules/@modelcontextprotocol/eslint-config/tsconfig.json"],
            "@modelcontextprotocol/vitest-config": ["./node_modules/@modelcontextprotocol/vitest-config/tsconfig.json"],
            "@modelcontextprotocol/test-helpers": ["./node_modules/@modelcontextprotocol/test-helpers/src/index.ts"],
--- a/packages/client/src/index.ts
+++ b/packages/client/src/index.ts
@ -1,15 +1,73 @@
-export * from './client/auth.js';
-export * from './client/authExtensions.js';
-export * from './client/client.js';
-export * from './client/crossAppAccess.js';
-export * from './client/middleware.js';
-export * from './client/sse.js';
-export * from './client/stdio.js';
-export * from './client/streamableHttp.js';
-export * from './client/websocket.js';
+// Public API for @modelcontextprotocol/client.
+//
+// This file defines the complete public surface. It consists of:
+//   - Package-specific exports: listed explicitly below (named imports)
+//   - Protocol-level types: re-exported from @modelcontextprotocol/core/public
+//
+// Any new export added here becomes public API. Use named exports, not wildcards.
+
+export type {
+    AddClientAuthentication,
+    AuthProvider,
+    AuthResult,
+    ClientAuthMethod,
+    OAuthClientProvider,
+    OAuthDiscoveryState,
+    OAuthServerInfo
+} from './client/auth.js';
+export {
+    auth,
+    buildDiscoveryUrls,
+    discoverAuthorizationServerMetadata,
+    discoverOAuthMetadata,
+    discoverOAuthProtectedResourceMetadata,
+    discoverOAuthServerInfo,
+    exchangeAuthorization,
+    extractResourceMetadataUrl,
+    extractWWWAuthenticateParams,
+    fetchToken,
+    isHttpsUrl,
+    parseErrorResponse,
+    prepareAuthorizationCodeRequest,
+    refreshAuthorization,
+    registerClient,
+    selectClientAuthMethod,
+    selectResourceURL,
+    startAuthorization,
+    UnauthorizedError
+} from './client/auth.js';
+export type {
+    AssertionCallback,
+    ClientCredentialsProviderOptions,
+    CrossAppAccessContext,
+    CrossAppAccessProviderOptions,
+    PrivateKeyJwtProviderOptions,
+    StaticPrivateKeyJwtProviderOptions
+} from './client/authExtensions.js';
+export {
+    ClientCredentialsProvider,
+    createPrivateKeyJwtAuth,
+    CrossAppAccessProvider,
+    PrivateKeyJwtProvider,
+    StaticPrivateKeyJwtProvider
+} from './client/authExtensions.js';
+export type { ClientOptions } from './client/client.js';
+export { Client } from './client/client.js';
+export { getSupportedElicitationModes } from './client/client.js';
+export type { DiscoverAndRequestJwtAuthGrantOptions, JwtAuthGrantResult, RequestJwtAuthGrantOptions } from './client/crossAppAccess.js';
+export { discoverAndRequestJwtAuthGrant, exchangeJwtAuthGrant, requestJwtAuthorizationGrant } from './client/crossAppAccess.js';
+export type { LoggingOptions, Middleware, RequestLogger } from './client/middleware.js';
+export { applyMiddlewares, createMiddleware, withLogging, withOAuth } from './client/middleware.js';
+export type { SSEClientTransportOptions } from './client/sse.js';
+export { SSEClientTransport, SseError } from './client/sse.js';
+export type { StdioServerParameters } from './client/stdio.js';
+export { DEFAULT_INHERITED_ENV_VARS, getDefaultEnvironment, StdioClientTransport } from './client/stdio.js';
+export type { StartSSEOptions, StreamableHTTPClientTransportOptions, StreamableHTTPReconnectionOptions } from './client/streamableHttp.js';
+export { StreamableHTTPClientTransport } from './client/streamableHttp.js';
+export { WebSocketClientTransport } from './client/websocket.js';

 // experimental exports
-export * from './experimental/index.js';
+export { ExperimentalClientTasks } from './experimental/tasks/client.js';

-// re-export shared types
-export * from '@modelcontextprotocol/core';
+// re-export curated public API from core
+export * from '@modelcontextprotocol/core/public';
--- a/packages/client/tsconfig.json
+++ b/packages/client/tsconfig.json
@ -6,6 +6,7 @@
        "paths": {
            "*": ["./*"],
            "@modelcontextprotocol/core": ["./node_modules/@modelcontextprotocol/core/src/index.ts"],
+            "@modelcontextprotocol/core/public": ["./node_modules/@modelcontextprotocol/core/src/exports/public/index.ts"],
            "@modelcontextprotocol/test-helpers": ["./node_modules/@modelcontextprotocol/test-helpers/src/index.ts"],
            "@modelcontextprotocol/client/_shims": ["./src/shimsNode.ts"]
        }
--- a/packages/core/package.json
+++ b/packages/core/package.json
@ -20,6 +20,20 @@
        "mcp",
        "core"
    ],
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.mjs"
+        },
+        "./types": {
+            "types": "./src/exports/types/index.ts",
+            "import": "./src/exports/types/index.ts"
+        },
+        "./public": {
+            "types": "./src/exports/public/index.ts",
+            "import": "./src/exports/public/index.ts"
+        }
+    },
    "scripts": {
        "typecheck": "tsgo -p tsconfig.json --noEmit",
        "lint": "eslint src/ && prettier --ignore-path ../../.prettierignore --check .",
--- a/packages/core/src/experimental/tasks/interfaces.ts
+++ b/packages/core/src/experimental/tasks/interfaces.ts
@ -15,7 +15,7 @@ import type {
    Result,
    Task,
    ToolExecution
-} from '../../types/types.js';
+} from '../../types/index.js';

 // ============================================================================
 // Task Handler Types (for registerToolTask)
--- a/packages/core/src/experimental/tasks/stores/inMemory.ts
+++ b/packages/core/src/experimental/tasks/stores/inMemory.ts
@ -3,7 +3,7 @@
 * @experimental
 */

-import type { Request, RequestId, Result, Task } from '../../../types/types.js';
+import type { Request, RequestId, Result, Task } from '../../../types/index.js';
 import type { CreateTaskOptions, QueuedMessage, TaskMessageQueue, TaskStore } from '../interfaces.js';
 import { isTerminal } from '../interfaces.js';

--- a/packages/core/src/exports/public/index.ts
+++ b/packages/core/src/exports/public/index.ts
@ -0,0 +1,142 @@
+/**
+ * Curated public API exports for @modelcontextprotocol/core.
+ *
+ * This module defines the stable, public-facing API surface. Client and server
+ * packages re-export from here so that end users only see supported symbols.
+ *
+ * Internal utilities (Protocol class, stdio parsing, schema helpers, etc.)
+ * remain available via the internal barrel (@modelcontextprotocol/core) for
+ * use by client/server packages.
+ */
+
+// Auth error classes
+export { OAuthError, OAuthErrorCode } from '../../auth/errors.js';
+
+// SDK error types (local errors that never cross the wire)
+export { SdkError, SdkErrorCode } from '../../errors/sdkErrors.js';
+
+// Auth TypeScript types (NOT Zod schemas like OAuthMetadataSchema)
+export type {
+    AuthorizationServerMetadata,
+    OAuthClientInformation,
+    OAuthClientInformationFull,
+    OAuthClientInformationMixed,
+    OAuthClientMetadata,
+    OAuthClientRegistrationError,
+    OAuthErrorResponse,
+    OAuthMetadata,
+    OAuthProtectedResourceMetadata,
+    OAuthTokenRevocationRequest,
+    OAuthTokens,
+    OpenIdProviderDiscoveryMetadata,
+    OpenIdProviderMetadata
+} from '../../shared/auth.js';
+
+// Auth utilities
+export { checkResourceAllowed, resourceUrlFromServerUrl } from '../../shared/authUtils.js';
+
+// Metadata utilities
+export { getDisplayName } from '../../shared/metadataUtils.js';
+
+// Protocol types (NOT the Protocol class itself or mergeCapabilities)
+export type {
+    BaseContext,
+    ClientContext,
+    NotificationOptions,
+    ProgressCallback,
+    ProtocolOptions,
+    RequestOptions,
+    ServerContext
+} from '../../shared/protocol.js';
+export { DEFAULT_REQUEST_TIMEOUT_MSEC } from '../../shared/protocol.js';
+
+// Task manager types (NOT TaskManager class itself — internal)
+export type { RequestTaskStore, TaskContext, TaskManagerOptions, TaskRequestOptions } from '../../shared/taskManager.js';
+
+// Response message types
+export type {
+    BaseResponseMessage,
+    ErrorMessage,
+    ResponseMessage,
+    ResultMessage,
+    TaskCreatedMessage,
+    TaskStatusMessage
+} from '../../shared/responseMessage.js';
+export { takeResult, toArrayAsync } from '../../shared/responseMessage.js';
+
+// stdio message framing utilities (for custom transport authors)
+export { deserializeMessage, ReadBuffer, serializeMessage } from '../../shared/stdio.js';
+
+// Transport types (NOT normalizeHeaders)
+export type { FetchLike, Transport, TransportSendOptions } from '../../shared/transport.js';
+export { createFetchWithInit } from '../../shared/transport.js';
+
+// URI Template
+export type { Variables } from '../../shared/uriTemplate.js';
+export { UriTemplate } from '../../shared/uriTemplate.js';
+
+// Types — all TypeScript types (standalone interfaces + schema-derived).
+// This is the one intentional `export *`: types.ts contains only spec-derived TS
+// types, and every type there should be public. See comment in types.ts.
+export * from '../../types/types.js';
+
+// Constants
+export {
+    DEFAULT_NEGOTIATED_PROTOCOL_VERSION,
+    INTERNAL_ERROR,
+    INVALID_PARAMS,
+    INVALID_REQUEST,
+    JSONRPC_VERSION,
+    LATEST_PROTOCOL_VERSION,
+    METHOD_NOT_FOUND,
+    PARSE_ERROR,
+    RELATED_TASK_META_KEY,
+    SUPPORTED_PROTOCOL_VERSIONS
+} from '../../types/constants.js';
+
+// Enums
+export { ProtocolErrorCode } from '../../types/enums.js';
+
+// Error classes
+export { ProtocolError, UrlElicitationRequiredError } from '../../types/errors.js';
+
+// Type guards and message parsing
+export {
+    assertCompleteRequestPrompt,
+    assertCompleteRequestResourceTemplate,
+    isInitializedNotification,
+    isInitializeRequest,
+    isJSONRPCErrorResponse,
+    isJSONRPCNotification,
+    isJSONRPCRequest,
+    isJSONRPCResultResponse,
+    isTaskAugmentedRequestParams,
+    parseJSONRPCMessage
+} from '../../types/guards.js';
+
+// Experimental task types and classes
+export { assertClientRequestTaskCapability, assertToolsCallTaskCapability } from '../../experimental/tasks/helpers.js';
+export type {
+    BaseQueuedMessage,
+    CreateTaskOptions,
+    CreateTaskServerContext,
+    QueuedError,
+    QueuedMessage,
+    QueuedNotification,
+    QueuedRequest,
+    QueuedResponse,
+    TaskMessageQueue,
+    TaskServerContext,
+    TaskStore,
+    TaskToolExecution
+} from '../../experimental/tasks/interfaces.js';
+export { isTerminal } from '../../experimental/tasks/interfaces.js';
+export { InMemoryTaskMessageQueue, InMemoryTaskStore } from '../../experimental/tasks/stores/inMemory.js';
+
+// Validator types and classes
+export type { StandardSchemaWithJSON } from '../../util/standardSchema.js';
+export { AjvJsonSchemaValidator } from '../../validators/ajvProvider.js';
+export type { CfWorkerSchemaDraft } from '../../validators/cfWorkerProvider.js';
+export { CfWorkerJsonSchemaValidator } from '../../validators/cfWorkerProvider.js';
+export { fromJsonSchema } from '../../validators/fromJsonSchema.js';
+export type { JsonSchemaType, JsonSchemaValidator, jsonSchemaValidator, JsonSchemaValidatorResult } from '../../validators/types.js';
--- a/packages/core/src/exports/types/index.ts
+++ b/packages/core/src/exports/types/index.ts
@ -1 +1 @@
-export type * from '../../types/types.js';
+export type * from '../../types/index.js';
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@ -11,7 +11,7 @@ export { extractTaskManagerOptions, NullTaskManager, TaskManager } from './share
 export * from './shared/toolNameValidation.js';
 export * from './shared/transport.js';
 export * from './shared/uriTemplate.js';
-export * from './types/types.js';
+export * from './types/index.js';
 export * from './util/inMemory.js';
 export * from './util/schema.js';
 export * from './util/standardSchema.js';
--- a/packages/core/src/shared/metadataUtils.ts
+++ b/packages/core/src/shared/metadataUtils.ts
@ -1,4 +1,4 @@
-import type { BaseMetadata } from '../types/types.js';
+import type { BaseMetadata } from '../types/index.js';

 /**
 * Utilities for working with {@linkcode BaseMetadata} objects.
--- a/packages/core/src/shared/protocol.ts
+++ b/packages/core/src/shared/protocol.ts
@ -32,7 +32,7 @@ import type {
    ResultTypeMap,
    ServerCapabilities,
    TaskCreationParams
-} from '../types/types.js';
+} from '../types/index.js';
 import {
    getNotificationSchema,
    getRequestSchema,
@ -44,7 +44,7 @@ import {
    ProtocolError,
    ProtocolErrorCode,
    SUPPORTED_PROTOCOL_VERSIONS
-} from '../types/types.js';
+} from '../types/index.js';
 import type { AnySchema, SchemaOutput } from '../util/schema.js';
 import { parseSchema } from '../util/schema.js';
 import type { TaskContext, TaskManagerHost, TaskManagerOptions, TaskRequestOptions } from './taskManager.js';
@ -88,9 +88,8 @@ export type ProtocolOptions = {
     * Runtime configuration for task management.
     * If provided, creates a TaskManager with the given options; otherwise a NullTaskManager is used.
     *
-     * Capability assertions are wired automatically from the abstract
-     * {@linkcode Protocol.assertTaskCapability | assertTaskCapability()} and
-     * {@linkcode Protocol.assertTaskHandlerCapability | assertTaskHandlerCapability()} methods,
+     * Capability assertions are wired automatically from the protocol's
+     * `assertTaskCapability()` and `assertTaskHandlerCapability()` methods,
     * so they should NOT be included here.
     */
    tasks?: TaskManagerOptions;
@ -452,7 +451,7 @@ export abstract class Protocol<ContextT extends BaseContext> {
    /**
     * Attaches to the given transport, starts it, and starts listening for messages.
     *
-     * The {@linkcode Protocol} object assumes ownership of the {@linkcode Transport}, replacing any callbacks that have already been set, and expects that it is the only user of the {@linkcode Transport} instance going forward.
+     * The caller assumes ownership of the {@linkcode Transport}, replacing any callbacks that have already been set, and expects that it is the only user of the {@linkcode Transport} instance going forward.
     */
    async connect(transport: Transport): Promise<void> {
        this._transport = transport;
--- a/packages/core/src/shared/responseMessage.ts
+++ b/packages/core/src/shared/responseMessage.ts
@ -1,4 +1,4 @@
-import type { Result, Task } from '../types/types.js';
+import type { Result, Task } from '../types/index.js';

 /**
 * Base message type for the response stream.
--- a/packages/core/src/shared/stdio.ts
+++ b/packages/core/src/shared/stdio.ts
@ -1,5 +1,5 @@
-import type { JSONRPCMessage } from '../types/types.js';
-import { JSONRPCMessageSchema } from '../types/types.js';
+import type { JSONRPCMessage } from '../types/index.js';
+import { JSONRPCMessageSchema } from '../types/index.js';

 /**
 * Buffers a continuous stdio stream into discrete JSON-RPC messages.
--- a/Show more
+++ b/Show more