v2: codemod iterations, canonical zod schema exports from sdk-shared

.changeset/abort-handlers-on-close.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Abort in-flight request handlers when the connection closes. Previously, request handlers would continue running after the transport disconnected, wasting resources and preventing proper cleanup. Also fixes `InMemoryTransport.close()` firing `onclose` twice on the initiating side.

.changeset/add-core-public-package.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/core': minor
+---
+
+Add `@modelcontextprotocol/core`: the public home for the MCP specification and OAuth/OpenID Zod schemas. It bundles the SDK's internal schema definitions and re-exports only the `*Schema` values, so consumers can validate protocol payloads (`<TypeName>Schema.parse(value)` / `.safeParse(value)`) without depending on a package's internal barrel. Alongside the spec schemas it also re-exports the auth schemas v1 exposed from `@modelcontextprotocol/sdk/shared/auth.js` (e.g. `OAuthTokensSchema`, `OAuthMetadataSchema`, `IdJagTokenExchangeResponseSchema`). Spec types, error classes, enums, and guards continue to live on `@modelcontextprotocol/server` and `@modelcontextprotocol/client`.

.changeset/add-resource-size-field.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Add missing `size` field to `ResourceSchema` to match the MCP specification

.changeset/add-sdk-http-error.md

@@ -1,5 +1,5 @@
 ---
-"@modelcontextprotocol/core": minor
+"@modelcontextprotocol/core-internal": minor
 "@modelcontextprotocol/client": minor
 ---
 

.changeset/busy-weeks-hang.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 '@modelcontextprotocol/server': patch
 ---
 

.changeset/codemod-core-routing.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/codemod': minor
+---
+
+Route v1 `@modelcontextprotocol/sdk/types.js` schema imports to the new `@modelcontextprotocol/core` package. The `*Schema` Zod constants now migrate as a behavior-preserving import-path swap — `<Name>Schema.parse(value)` / `.safeParse(value)` keep working — while spec types, error classes, enums, and guards continue to resolve to `@modelcontextprotocol/client` / `@modelcontextprotocol/server` by context. A single `import { CallToolResult, CallToolResultSchema } from '.../types.js'` is split accordingly. The v1 OAuth/OpenID `*Schema` constants imported from `@modelcontextprotocol/sdk/shared/auth.js` are routed to `@modelcontextprotocol/core` the same way (their auth TYPES keep resolving to `client` / `server`). The previous `specSchemaAccess` transform (which rewrote `.parse()` into `specTypeSchemas.X['~standard'].validate(...)`) is removed.

.changeset/codemod-infer-project-type.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/codemod': patch
+---
+
+Infer client/server project type from source for v1 projects. A project being migrated still declares the single v1 `@modelcontextprotocol/sdk` dependency, so detecting the project type from `package.json` came back "unknown" and every file importing only shared protocol symbols defaulted to `@modelcontextprotocol/server` with an action-required warning. The codemod now scans the source for quoted `@modelcontextprotocol/sdk/client/…` and `…/server/…` import specifiers to infer the type (both → "both", one → that side, neither → "unknown"), routing shared symbols to the installed package and replacing the spurious warnings with at most an info note for genuinely ambiguous "both" projects.

.changeset/codemod-task-handler-methods.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/codemod': patch
+---
+
+Map the task request/notification schemas to their v2 method strings in the handler-registration transform. `setRequestHandler(GetTaskRequestSchema, …)`, `setNotificationHandler(TaskStatusNotificationSchema, …)`, and the other task handlers (`tasks/get`, `tasks/result`, `tasks/list`, `tasks/cancel`, `notifications/tasks/status`) now rewrite to the v2 two-argument method-string form instead of falling through to the generic "use the 3-argument form" manual-migration diagnostic.

.changeset/custom-methods-minimal.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': minor
+'@modelcontextprotocol/core-internal': minor
 '@modelcontextprotocol/client': minor
 '@modelcontextprotocol/server': minor
 ---

.changeset/extract-task-manager.md

@@ -1,5 +1,5 @@
 ---
-"@modelcontextprotocol/core": minor
+"@modelcontextprotocol/core-internal": minor
 "@modelcontextprotocol/client": minor
 "@modelcontextprotocol/server": minor
 ---

.changeset/finish-sdkerror-capability.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 '@modelcontextprotocol/client': patch
 '@modelcontextprotocol/server': patch
 ---

.changeset/fix-abort-listener-leak.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Consolidate per-request cleanup in `_requestWithSchema` into a single `.finally()` block. This fixes an abort signal listener leak (listeners accumulated when a caller reused one `AbortSignal` across requests) and two cases where `_responseHandlers` entries leaked on send-failure paths.

.changeset/fix-task-session-isolation.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Fix InMemoryTaskStore to enforce session isolation. Previously, sessionId was accepted but ignored on all TaskStore methods, allowing any session to enumerate, read, and mutate tasks created by other sessions. The store now persists sessionId at creation time and enforces ownership on all reads and writes.

.changeset/fix-transport-exact-optional-property-types.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Add explicit `| undefined` to optional properties on the `Transport` interface and `TransportSendOptions` (`onclose`, `onerror`, `onmessage`, `sessionId`, `setProtocolVersion`, `setSupportedProtocolVersions`, `onresumptiontoken`).

.changeset/fix-unknown-tool-protocol-error.md

@@ -1,5 +1,5 @@
 ---
-"@modelcontextprotocol/core": minor
+"@modelcontextprotocol/core-internal": minor
 "@modelcontextprotocol/server": major
 ---
 

.changeset/funky-baths-attack.md

@@ -2,7 +2,7 @@
 '@modelcontextprotocol/node': patch
 '@modelcontextprotocol/test-integration': patch
 '@modelcontextprotocol/server': patch
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 remove deprecated .tool, .prompt, .resource method signatures

.changeset/idjag-spec-type-export.md

@@ -0,0 +1,6 @@
+---
+'@modelcontextprotocol/client': minor
+'@modelcontextprotocol/server': minor
+---
+
+Add the v2 `IdJagTokenExchangeResponse` type to the public API and register its schema as an MCP spec type. `IdJagTokenExchangeResponse` is now exported from `@modelcontextprotocol/client` and `@modelcontextprotocol/server`, `'IdJagTokenExchangeResponse'` joins the `SpecTypeName` union, and `isSpecType.IdJagTokenExchangeResponse(value)` / `specTypeSchemas.IdJagTokenExchangeResponse` validate it by name — matching how the OAuth/OpenID auth schemas are already exposed. The Zod schema itself, `IdJagTokenExchangeResponseSchema`, is available from `@modelcontextprotocol/core`.

.changeset/pre.json

@@ -11,13 +11,14 @@
     "@modelcontextprotocol/examples-server-quickstart": "2.0.0-alpha.0",
     "@modelcontextprotocol/examples-shared": "2.0.0-alpha.0",
     "@modelcontextprotocol/client": "2.0.0-alpha.0",
-    "@modelcontextprotocol/core": "2.0.0-alpha.0",
+    "@modelcontextprotocol/core-internal": "2.0.0-alpha.0",
     "@modelcontextprotocol/express": "2.0.0-alpha.0",
     "@modelcontextprotocol/fastify": "2.0.0-alpha.0",
     "@modelcontextprotocol/hono": "2.0.0-alpha.0",
     "@modelcontextprotocol/node": "2.0.0-alpha.0",
     "@modelcontextprotocol/server": "2.0.0-alpha.0",
     "@modelcontextprotocol/server-legacy": "2.0.0-alpha.0",
+    "@modelcontextprotocol/core": "2.0.0-alpha.0",
     "@modelcontextprotocol/codemod": "2.0.0-alpha.0",
     "@modelcontextprotocol/test-conformance": "2.0.0-alpha.0",
     "@modelcontextprotocol/test-helpers": "2.0.0-alpha.0",

.changeset/quick-islands-occur.md

@@ -4,7 +4,7 @@
 '@modelcontextprotocol/node': patch
 '@modelcontextprotocol/client': patch
 '@modelcontextprotocol/server': patch
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 remove npm references, use pnpm

.changeset/register-rawshape-compat.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 '@modelcontextprotocol/server': patch
 ---
 

.changeset/restore-task-wire-types.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': minor
+'@modelcontextprotocol/core-internal': minor
 '@modelcontextprotocol/server': minor
 '@modelcontextprotocol/client': minor
 ---

.changeset/rich-hounds-report.md

@@ -4,7 +4,7 @@
 '@modelcontextprotocol/node': patch
 '@modelcontextprotocol/client': patch
 '@modelcontextprotocol/server': patch
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 clean up package manager usage, all pnpm

.changeset/schema-object-type-for-unions.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Ensure `standardSchemaToJsonSchema` emits `type: "object"` at the root, fixing discriminated-union tool/prompt schemas that previously produced `{oneOf: [...]}` without the MCP-required top-level type. Also throws a clear error when given an explicitly non-object schema (e.g. `z.string()`). Fixes #1643.

.changeset/sep-2577-deprecate-runtime-apis.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 '@modelcontextprotocol/server': patch
 '@modelcontextprotocol/client': patch
 ---

.changeset/sep-2663-tasks-removal.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': major
+'@modelcontextprotocol/core-internal': major
 '@modelcontextprotocol/server': major
 '@modelcontextprotocol/client': major
 ---

.changeset/sep-414-trace-context-meta-keys.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Add reserved trace context `_meta` key constants (`TRACEPARENT_META_KEY`, `TRACESTATE_META_KEY`, `BAGGAGE_META_KEY`) per SEP-414, plus docs and a passthrough regression test. The spec reserves the unprefixed `_meta` keys `traceparent`, `tracestate`, and `baggage` (W3C Trace Context / W3C Baggage formats) for distributed tracing; the SDK passes them through untouched.

.changeset/shy-times-learn.md

@@ -2,7 +2,7 @@
 '@modelcontextprotocol/node': patch
 '@modelcontextprotocol/test-integration': patch
 '@modelcontextprotocol/server': patch
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 deprecated .tool, .prompt, .resource method removal

.changeset/spec-reference-types-2026-07-28.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 '@modelcontextprotocol/codemod': patch
 ---
 

.changeset/stdio-max-buffer-size.md

@@ -1,7 +1,7 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 '@modelcontextprotocol/client': patch
 '@modelcontextprotocol/server': patch
 ---
 
-Add a configurable `maxBufferSize` (default 10 MB) to the stdio transports. When a single message would push the read buffer past the limit, the transport now emits an `onerror` and closes instead of growing the buffer unbounded. Configure via `new StdioClientTransport({ ..., maxBufferSize })` or `new StdioServerTransport(stdin, stdout, { maxBufferSize })`. The default is exported from `@modelcontextprotocol/core` as `STDIO_DEFAULT_MAX_BUFFER_SIZE`.
+Add a configurable `maxBufferSize` (default 10 MB) to the stdio transports. When a single message would push the read buffer past the limit, the transport now emits an `onerror` and closes instead of growing the buffer unbounded. Configure via `new StdioClientTransport({ ..., maxBufferSize })` or `new StdioServerTransport(stdin, stdout, { maxBufferSize })`. The default is exported from `@modelcontextprotocol/core-internal` as `STDIO_DEFAULT_MAX_BUFFER_SIZE`.

.changeset/stdio-skip-non-json.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 `ReadBuffer.readMessage()` now silently skips non-JSON lines instead of throwing `SyntaxError`. This prevents noisy `onerror` callbacks when hot-reload tools (tsx, nodemon) write debug output like "Gracefully restarting..." to stdout. Lines that parse as JSON but fail JSONRPC schema validation still throw.

.changeset/support-standard-json-schema.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': minor
+'@modelcontextprotocol/core-internal': minor
 '@modelcontextprotocol/server': minor
 '@modelcontextprotocol/client': minor
 ---
@@ -30,5 +30,5 @@ server.registerTool('greet', {
 
 **Breaking changes:**
 - `experimental.tasks.getTaskResult()` no longer accepts a `resultSchema` parameter. Returns `GetTaskPayloadResult` (a loose `Result`); cast to the expected type at the call site.
-- Removed unused exports from `@modelcontextprotocol/core`: `SchemaInput`, `schemaToJson`, `parseSchemaAsync`, `getSchemaShape`, `getSchemaDescription`, `isOptionalSchema`, `unwrapOptionalSchema`. Use the new `standardSchemaToJsonSchema` and `validateStandardSchema` instead.
+- Removed unused exports from `@modelcontextprotocol/core-internal`: `SchemaInput`, `schemaToJson`, `parseSchemaAsync`, `getSchemaShape`, `getSchemaDescription`, `isOptionalSchema`, `unwrapOptionalSchema`. Use the new `standardSchemaToJsonSchema` and `validateStandardSchema` instead.
 - `completable()` remains Zod-specific (it relies on Zod's `.shape` introspection).

.changeset/workerd-shim-vendors-cfworker.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': minor
+'@modelcontextprotocol/core-internal': minor
 '@modelcontextprotocol/client': patch
 '@modelcontextprotocol/server': patch
 ---

.changeset/wraphandler-hook.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 '@modelcontextprotocol/client': patch
 '@modelcontextprotocol/server': patch
 ---

.changeset/zod-json-schema-compat.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 ---
 
 Allow additional JSON Schema properties in elicitInput's requestedSchema type by adding .catchall(z.unknown()), matching the pattern used by inputSchema. This fixes type incompatibility when using Zod v4's .toJSONSchema() output which includes extra properties like $schema and additionalProperties.

.changeset/zod-jsonschema-fallback.md

@@ -1,5 +1,5 @@
 ---
-'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/core-internal': patch
 '@modelcontextprotocol/server': patch
 '@modelcontextprotocol/client': patch
 ---

.github/workflows/publish.yml

@@ -39,5 +39,5 @@ jobs:
 
             - name: Publish preview packages
               run:
-                  pnpm dlx pkg-pr-new publish --packageManager=npm --pnpm './packages/server' './packages/server-legacy' './packages/client'
+                  pnpm dlx pkg-pr-new publish --packageManager=npm --pnpm './packages/core' './packages/server' './packages/server-legacy' './packages/client'
                   './packages/codemod' './packages/middleware/express' './packages/middleware/fastify' './packages/middleware/hono' './packages/middleware/node'

.github/workflows/update-spec-types.yml

@@ -39,11 +39,11 @@ jobs:
             - name: Check for changes
               id: check_changes
               run: |
-                  if git diff --quiet packages/core/src/types/spec.types.2026-07-28.ts; then
+                  if git diff --quiet packages/core-internal/src/types/spec.types.2026-07-28.ts; then
                     echo "has_changes=false" >> $GITHUB_OUTPUT
                   else
                     echo "has_changes=true" >> $GITHUB_OUTPUT
-                    LATEST_SHA=$(grep "Last updated from commit:" packages/core/src/types/spec.types.2026-07-28.ts | cut -d: -f2 | tr -d ' ')
+                    LATEST_SHA=$(grep "Last updated from commit:" packages/core-internal/src/types/spec.types.2026-07-28.ts | cut -d: -f2 | tr -d ' ')
                     echo "sha=$LATEST_SHA" >> $GITHUB_OUTPUT
                   fi
 
@@ -59,12 +59,12 @@ jobs:
                   git config user.email "github-actions[bot]@users.noreply.github.com"
 
                   git checkout -B update-spec-types
-                  git add packages/core/src/types/spec.types.2026-07-28.ts
+                  git add packages/core-internal/src/types/spec.types.2026-07-28.ts
                   git commit -m "chore: update spec.types.2026-07-28.ts from upstream"
                   git push -f --no-verify origin update-spec-types
 
                   # Create PR if it doesn't exist, or update if it does
-                  PR_BODY="This PR updates \`packages/core/src/types/spec.types.2026-07-28.ts\` from the Model Context Protocol specification.
+                  PR_BODY="This PR updates \`packages/core-internal/src/types/spec.types.2026-07-28.ts\` from the Model Context Protocol specification.
 
                   Source file: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/${{ steps.check_changes.outputs.sha }}/schema/draft/schema.ts