Skip to content

Commit 08e958d

Browse files
felixweinbergerfelixweinberger
committed
fix(sdk): unify server/auth/* on server-auth-legacy; drop stdio from root; optional express/hono peers
- All five server/auth/* subpaths now re-export from @modelcontextprotocol/server-auth-legacy so OAuth error subclasses share the same OAuthError identity that the legacy router and requireBearerAuth check with instanceof. Previously errors.ts defined local subclasses extending core's OAuthError and bearerAuth.ts re-exported /express, causing instanceof to fail (HTTP 500 instead of 400/401). - Drop @modelcontextprotocol/express dependency (no longer imported). - Forward express and hono as optional peerDependencies so consumers who do not use the auth or hono-adapter subpaths get no unmet-peer warnings. - Add top-level types field for legacy moduleResolution: node. - Revert 87d4f17's stdio re-exports from the root barrel; stdio remains subpath-only to match the underlying client/server packages.
1 parent 4baa8e2 commit 08e958d

7 files changed

Lines changed: 33 additions & 66 deletions

File tree

‎packages/sdk/package.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,7 @@
264264
"import": "./dist/validation/ajv-provider.mjs"
265265
}
266266
},
267+
"types": "./dist/index.d.ts",
267268
"files": [
268269
"dist"
269270
],
@@ -279,11 +280,22 @@
279280
},
280281
"dependencies": {
281282
"@modelcontextprotocol/client": "workspace:^",
282-
"@modelcontextprotocol/express": "workspace:^",
283283
"@modelcontextprotocol/node": "workspace:^",
284284
"@modelcontextprotocol/server": "workspace:^",
285285
"@modelcontextprotocol/server-auth-legacy": "workspace:^"
286286
},
287+
"peerDependencies": {
288+
"express": "^4.18.0 || ^5.0.0",
289+
"hono": "*"
290+
},
291+
"peerDependenciesMeta": {
292+
"express": {
293+
"optional": true
294+
},
295+
"hono": {
296+
"optional": true
297+
}
298+
},
287299
"devDependencies": {
288300
"@modelcontextprotocol/core": "workspace:^",
289301
"@modelcontextprotocol/eslint-config": "workspace:^",

‎packages/sdk/src/index.ts‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,5 +88,3 @@ export {
8888
withLogging,
8989
withOAuth
9090
} from '@modelcontextprotocol/client';
91-
export type { StdioServerParameters } from '@modelcontextprotocol/client/stdio';
92-
export { DEFAULT_INHERITED_ENV_VARS, getDefaultEnvironment, StdioClientTransport } from '@modelcontextprotocol/client/stdio';

‎packages/sdk/src/server/auth/errors.ts‎

Lines changed: 5 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,6 @@
11
// v1 compat: `@modelcontextprotocol/sdk/server/auth/errors.js`
2-
// v2 consolidated 17 OAuth error subclasses into OAuthError + OAuthErrorCode.
3-
// These deprecated subclasses preserve `instanceof` and `throw new InvalidTokenError(msg)` patterns.
4-
5-
import { OAuthError, OAuthErrorCode } from '@modelcontextprotocol/server';
6-
7-
/** @deprecated Construct-signature type for the v1 OAuth error subclasses below. */
8-
export type OAuthErrorSubclass = new (message: string, errorUri?: string) => OAuthError;
9-
10-
function sub(code: OAuthErrorCode): OAuthErrorSubclass {
11-
return class extends OAuthError {
12-
constructor(message: string, errorUri?: string) {
13-
super(code, message, errorUri);
14-
}
15-
};
16-
}
17-
18-
/** @deprecated Use `new OAuthError(OAuthErrorCode.InvalidRequest, ...)` */
19-
export const InvalidRequestError = sub(OAuthErrorCode.InvalidRequest);
20-
/** @deprecated Use `new OAuthError(OAuthErrorCode.InvalidClient, ...)` */
21-
export const InvalidClientError = sub(OAuthErrorCode.InvalidClient);
22-
/** @deprecated Use `new OAuthError(OAuthErrorCode.InvalidGrant, ...)` */
23-
export const InvalidGrantError = sub(OAuthErrorCode.InvalidGrant);
24-
/** @deprecated Use `new OAuthError(OAuthErrorCode.UnauthorizedClient, ...)` */
25-
export const UnauthorizedClientError = sub(OAuthErrorCode.UnauthorizedClient);
26-
/** @deprecated Use `new OAuthError(OAuthErrorCode.UnsupportedGrantType, ...)` */
27-
export const UnsupportedGrantTypeError = sub(OAuthErrorCode.UnsupportedGrantType);
28-
/** @deprecated Use `new OAuthError(OAuthErrorCode.InvalidScope, ...)` */
29-
export const InvalidScopeError = sub(OAuthErrorCode.InvalidScope);
30-
/** @deprecated Use `new OAuthError(OAuthErrorCode.AccessDenied, ...)` */
31-
export const AccessDeniedError = sub(OAuthErrorCode.AccessDenied);
32-
/** @deprecated Use `new OAuthError(OAuthErrorCode.ServerError, ...)` */
33-
export const ServerError = sub(OAuthErrorCode.ServerError);
34-
/** @deprecated Use `new OAuthError(OAuthErrorCode.TemporarilyUnavailable, ...)` */
35-
export const TemporarilyUnavailableError = sub(OAuthErrorCode.TemporarilyUnavailable);
36-
/** @deprecated Use `new OAuthError(OAuthErrorCode.UnsupportedResponseType, ...)` */
37-
export const UnsupportedResponseTypeError = sub(OAuthErrorCode.UnsupportedResponseType);
38-
/** @deprecated Use `new OAuthError(OAuthErrorCode.UnsupportedTokenType, ...)` */
39-
export const UnsupportedTokenTypeError = sub(OAuthErrorCode.UnsupportedTokenType);
40-
/** @deprecated Use `new OAuthError(OAuthErrorCode.InvalidToken, ...)` */
41-
export const InvalidTokenError = sub(OAuthErrorCode.InvalidToken);
42-
/** @deprecated Use `new OAuthError(OAuthErrorCode.MethodNotAllowed, ...)` */
43-
export const MethodNotAllowedError = sub(OAuthErrorCode.MethodNotAllowed);
44-
/** @deprecated Use `new OAuthError(OAuthErrorCode.TooManyRequests, ...)` */
45-
export const TooManyRequestsError = sub(OAuthErrorCode.TooManyRequests);
46-
/** @deprecated Use `new OAuthError(OAuthErrorCode.InvalidClientMetadata, ...)` */
47-
export const InvalidClientMetadataError = sub(OAuthErrorCode.InvalidClientMetadata);
48-
/** @deprecated Use `new OAuthError(OAuthErrorCode.InsufficientScope, ...)` */
49-
export const InsufficientScopeError = sub(OAuthErrorCode.InsufficientScope);
50-
51-
/** @deprecated Construct {@link OAuthError} directly. */
52-
export class CustomOAuthError extends OAuthError {}
53-
54-
export { OAuthError, OAuthErrorCode } from '@modelcontextprotocol/server';
2+
// Re-exports the frozen v1 OAuth error classes from the legacy package so that
3+
// errors thrown from this subpath share the same `OAuthError` identity that
4+
// `mcpAuthRouter`/`requireBearerAuth` (re-exported by sibling subpaths) check
5+
// with `instanceof`.
6+
export * from '@modelcontextprotocol/server-auth-legacy';

‎packages/sdk/src/server/auth/middleware/bearerAuth.ts‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,5 @@
11
// v1 compat: `@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js`
2-
export * from '@modelcontextprotocol/express';
2+
// Re-exports from server-auth-legacy (not @modelcontextprotocol/express) so that
3+
// `requireBearerAuth`'s `instanceof OAuthError` check matches the error classes
4+
// re-exported by the sibling `server/auth/*` subpaths.
5+
export * from '@modelcontextprotocol/server-auth-legacy';

‎packages/sdk/test/compat.test.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@ import { McpError, ErrorCode, type CallToolRequest } from '../src/types.js';
66
import { Server } from '../src/server/index.js';
77
import { Client } from '../src/client/index.js';
88
import { McpServer } from '../src/server/mcp.js';
9-
import { InvalidTokenError } from '../src/server/auth/errors.js';
9+
import { InvalidTokenError, OAuthError as LegacyOAuthError } from '../src/server/auth/errors.js';
1010
import { StreamableHTTPServerTransport } from '../src/server/streamableHttp.js';
1111
import type { Transport } from '../src/shared/transport.js';
1212
import type { RequestHandlerExtra } from '../src/shared/protocol.js';
13-
import { OAuthError, OAuthErrorCode, ProtocolError } from '../src/index.js';
13+
import { ProtocolError } from '../src/index.js';
1414

1515
describe('@modelcontextprotocol/sdk meta-package', () => {
1616
let warnSpy: MockInstance;
@@ -31,10 +31,10 @@ describe('@modelcontextprotocol/sdk meta-package', () => {
3131
// ./server/mcp.js
3232
expect(typeof McpServer).toBe('function');
3333

34-
// ./server/auth/errors.js — OAuth subclasses
34+
// ./server/auth/errors.js — v1 OAuth subclasses (legacy hierarchy, shared with sibling auth subpaths)
3535
const tokenErr = new InvalidTokenError('bad');
36-
expect(tokenErr).toBeInstanceOf(OAuthError);
37-
expect(tokenErr.code).toBe(OAuthErrorCode.InvalidToken);
36+
expect(tokenErr).toBeInstanceOf(LegacyOAuthError);
37+
expect(tokenErr.errorCode).toBe('invalid_token');
3838

3939
// ./server/streamableHttp.js — alias to NodeStreamableHTTPServerTransport
4040
expect(typeof StreamableHTTPServerTransport).toBe('function');

‎packages/sdk/tsconfig.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
"@modelcontextprotocol/server/validators/cf-worker": ["./node_modules/@modelcontextprotocol/server/src/validators/cfWorker.ts"],
1616
"@modelcontextprotocol/node": ["./node_modules/@modelcontextprotocol/node/src/index.ts"],
1717
"@modelcontextprotocol/node/sse": ["./node_modules/@modelcontextprotocol/node/src/sse.ts"],
18-
"@modelcontextprotocol/express": ["./node_modules/@modelcontextprotocol/express/src/index.ts"],
1918
"@modelcontextprotocol/server-auth-legacy": ["./node_modules/@modelcontextprotocol/server-auth-legacy/src/index.ts"],
2019
"@modelcontextprotocol/client/_shims": ["./node_modules/@modelcontextprotocol/client/src/shimsNode.ts"],
2120
"@modelcontextprotocol/server/_shims": ["./node_modules/@modelcontextprotocol/server/src/shimsNode.ts"],

‎pnpm-lock.yaml‎

Lines changed: 6 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)