v2: codemod iterations, canonical zod schema exports from sdk-shared (#2354)

Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>

.changeset/abort-handlers-on-close.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Abort in-flight request handlers when the connection closes. Previously, request handlers would continue running after the transport disconnected, wasting resources and preventing proper cleanup. Also fixes `InMemoryTransport.close()` firing `onclose` twice on the initiating side.

.changeset/add-core-public-package.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/core': minor
+---
+
+Add `@modelcontextprotocol/core`: the public home for the MCP specification and OAuth/OpenID Zod schemas. It bundles the SDK's internal schema definitions and re-exports only the `*Schema` values, so consumers can validate protocol payloads (`<TypeName>Schema.parse(value)` / `.safeParse(value)`) without depending on a package's internal barrel. Alongside the spec schemas it also re-exports the auth schemas v1 exposed from `@modelcontextprotocol/sdk/shared/auth.js` (e.g. `OAuthTokensSchema`, `OAuthMetadataSchema`, `IdJagTokenExchangeResponseSchema`). Spec types, error classes, enums, and guards continue to live on `@modelcontextprotocol/server` and `@modelcontextprotocol/client`.

.changeset/add-resource-size-field.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Add missing `size` field to `ResourceSchema` to match the MCP specification

.changeset/add-sdk-http-error.md

@@ -1,5 +1,5 @@
 ---
-"@modelcontextprotocol/core": minor
+"@modelcontextprotocol/core-internal": minor
 "@modelcontextprotocol/client": minor
 ---
 

.changeset/busy-weeks-hang.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 '@modelcontextprotocol/server': patch
 ---
 

.changeset/codemod-core-routing.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/codemod': minor
+---
+
+Route v1 `@modelcontextprotocol/sdk/types.js` schema imports to the new `@modelcontextprotocol/core` package. The `*Schema` Zod constants now migrate as a behavior-preserving import-path swap — `<Name>Schema.parse(value)` / `.safeParse(value)` keep working — while spec types, error classes, enums, and guards continue to resolve to `@modelcontextprotocol/client` / `@modelcontextprotocol/server` by context. A single `import { CallToolResult, CallToolResultSchema } from '.../types.js'` is split accordingly. The v1 OAuth/OpenID `*Schema` constants imported from `@modelcontextprotocol/sdk/shared/auth.js` are routed to `@modelcontextprotocol/core` the same way (their auth TYPES keep resolving to `client` / `server`). The previous `specSchemaAccess` transform (which rewrote `.parse()` into `specTypeSchemas.X['~standard'].validate(...)`) is removed.

.changeset/codemod-infer-project-type.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/codemod': patch
+---
+
+Infer client/server project type from source for v1 projects. A project being migrated still declares the single v1 `@modelcontextprotocol/sdk` dependency, so detecting the project type from `package.json` came back "unknown" and every file importing only shared protocol symbols defaulted to `@modelcontextprotocol/server` with an action-required warning. The codemod now scans the source for quoted `@modelcontextprotocol/sdk/client/…` and `…/server/…` import specifiers to infer the type (both → "both", one → that side, neither → "unknown"), routing shared symbols to the installed package and replacing the spurious warnings with at most an info note for genuinely ambiguous "both" projects.

.changeset/codemod-task-handler-methods.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/codemod': patch
+---
+
+Map the task request/notification schemas to their v2 method strings in the handler-registration transform. `setRequestHandler(GetTaskRequestSchema, …)`, `setNotificationHandler(TaskStatusNotificationSchema, …)`, and the other task handlers (`tasks/get`, `tasks/result`, `tasks/list`, `tasks/cancel`, `notifications/tasks/status`) now rewrite to the v2 two-argument method-string form instead of falling through to the generic "use the 3-argument form" manual-migration diagnostic.

.changeset/custom-methods-minimal.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': minor
+'@modelcontextprotocol/core-internal': minor
 '@modelcontextprotocol/client': minor
 '@modelcontextprotocol/server': minor
 ---

.changeset/extract-task-manager.md

@@ -1,5 +1,5 @@
 ---
-"@modelcontextprotocol/core": minor
+"@modelcontextprotocol/core-internal": minor
 "@modelcontextprotocol/client": minor
 "@modelcontextprotocol/server": minor
 ---

.changeset/finish-sdkerror-capability.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 '@modelcontextprotocol/client': patch
 '@modelcontextprotocol/server': patch
 ---

.changeset/fix-abort-listener-leak.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Consolidate per-request cleanup in `_requestWithSchema` into a single `.finally()` block. This fixes an abort signal listener leak (listeners accumulated when a caller reused one `AbortSignal` across requests) and two cases where `_responseHandlers` entries leaked on send-failure paths.

.changeset/fix-task-session-isolation.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Fix InMemoryTaskStore to enforce session isolation. Previously, sessionId was accepted but ignored on all TaskStore methods, allowing any session to enumerate, read, and mutate tasks created by other sessions. The store now persists sessionId at creation time and enforces ownership on all reads and writes.

.changeset/fix-transport-exact-optional-property-types.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Add explicit `| undefined` to optional properties on the `Transport` interface and `TransportSendOptions` (`onclose`, `onerror`, `onmessage`, `sessionId`, `setProtocolVersion`, `setSupportedProtocolVersions`, `onresumptiontoken`).

.changeset/fix-unknown-tool-protocol-error.md

@@ -1,5 +1,5 @@
 ---
-"@modelcontextprotocol/core": minor
+"@modelcontextprotocol/core-internal": minor
 "@modelcontextprotocol/server": major
 ---
 

.changeset/funky-baths-attack.md

@@ -2,7 +2,7 @@
 '@modelcontextprotocol/node': patch
 '@modelcontextprotocol/test-integration': patch
 '@modelcontextprotocol/server': patch
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 remove deprecated .tool, .prompt, .resource method signatures

.changeset/idjag-spec-type-export.md

@@ -0,0 +1,6 @@
+---
+'@modelcontextprotocol/client': minor
+'@modelcontextprotocol/server': minor
+---
+
+Add the v2 `IdJagTokenExchangeResponse` type to the public API and register its schema as an MCP spec type. `IdJagTokenExchangeResponse` is now exported from `@modelcontextprotocol/client` and `@modelcontextprotocol/server`, `'IdJagTokenExchangeResponse'` joins the `SpecTypeName` union, and `isSpecType.IdJagTokenExchangeResponse(value)` / `specTypeSchemas.IdJagTokenExchangeResponse` validate it by name — matching how the OAuth/OpenID auth schemas are already exposed. The Zod schema itself, `IdJagTokenExchangeResponseSchema`, is available from `@modelcontextprotocol/core`.

.changeset/pre.json

@@ -11,13 +11,14 @@
     "@modelcontextprotocol/examples-server-quickstart": "2.0.0-alpha.0",
     "@modelcontextprotocol/examples-shared": "2.0.0-alpha.0",
     "@modelcontextprotocol/client": "2.0.0-alpha.0",
-    "@modelcontextprotocol/core": "2.0.0-alpha.0",
+    "@modelcontextprotocol/core-internal": "2.0.0-alpha.0",
     "@modelcontextprotocol/express": "2.0.0-alpha.0",
     "@modelcontextprotocol/fastify": "2.0.0-alpha.0",
     "@modelcontextprotocol/hono": "2.0.0-alpha.0",
     "@modelcontextprotocol/node": "2.0.0-alpha.0",
     "@modelcontextprotocol/server": "2.0.0-alpha.0",
     "@modelcontextprotocol/server-legacy": "2.0.0-alpha.0",
+    "@modelcontextprotocol/core": "2.0.0-alpha.0",
     "@modelcontextprotocol/codemod": "2.0.0-alpha.0",
     "@modelcontextprotocol/test-conformance": "2.0.0-alpha.0",
     "@modelcontextprotocol/test-helpers": "2.0.0-alpha.0",

.changeset/quick-islands-occur.md

@@ -4,7 +4,7 @@
 '@modelcontextprotocol/node': patch
 '@modelcontextprotocol/client': patch
 '@modelcontextprotocol/server': patch
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 remove npm references, use pnpm

.changeset/register-rawshape-compat.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 '@modelcontextprotocol/server': patch
 ---