adds the transitive @types/express-serve-static-core dependency as a direct devDependency

[mgyarmathy]

This PR adds the transitive @types/express-serve-static-core dependency as a direct devDependency to fix builds via strict package managers like pnpm. This is necessary because types from express-serve-static-core are currently referenced directly in https://github.com/modelcontextprotocol/typescript-sdk/blob/main/src/server/auth/middleware/bearerAuth.ts#L23-L30

Motivation and Context

Fixes #572

How Has This Been Tested?

• pnpm install + pnpm build on a fresh clone of this branch now succeeds
• rm -rf node_modules/ && pnpm i && pnpm build also succeeds
• Testing for regressions -- rm -rf node_modules/ && npm i && npm run build also succeeds.

Breaking Changes

n/a

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/sdk@1078

commit: 83cfb46

[KKonstantinov]

Hello,

Could you please provide the error that you have from pnpm, as well as your pnpm config?

Going forward, if @types/express-serve-static-core is added as a devDependency, should its types not be removed from https://github.com/modelcontextprotocol/typescript-sdk/blob/main/src/server/auth/middleware/bearerAuth.ts#L23-L30 ?

[mgyarmathy]

Hello,

Could you please provide the error that you have from pnpm, as well as your pnpm config?

Going forward, if @types/express-serve-static-core is added as a devDependency, should its types not be removed from https://github.com/modelcontextprotocol/typescript-sdk/blob/main/src/server/auth/middleware/bearerAuth.ts#L23-L30 ?

Hey @KKonstantinov -- here's the current build error when running pnpm install && pnpm build (pnpm default config) on this project with the latest commit on main:

$ pnpm build

> @modelcontextprotocol/sdk@1.22.0 build /Users/mgyarmathy/Code/mgyarmathy/modelcontextprotocol--typescript-sdk
> npm run build:esm && npm run build:cjs


> @modelcontextprotocol/sdk@1.22.0 build:esm
> mkdir -p dist/esm && echo '{"type": "module"}' > dist/esm/package.json && tsc -p tsconfig.prod.json

src/examples/server/simpleStreamableHttp.ts:539:25 - error TS2339: Property 'auth' does not exist on type 'Request<ParamsDictionary, any, any, ParsedQs, Record<string, any>>'.

539     if (useOAuth && req.auth) {
                            ~~~~

src/examples/server/simpleStreamableHttp.ts:540:48 - error TS2339: Property 'auth' does not exist on type 'Request<ParamsDictionary, any, any, ParsedQs, Record<string, any>>'.

540         console.log('Authenticated user:', req.auth);
                                                   ~~~~

src/examples/server/simpleStreamableHttp.ts:623:25 - error TS2339: Property 'auth' does not exist on type 'Request<ParamsDictionary, any, any, ParsedQs, Record<string, any>>'.

623     if (useOAuth && req.auth) {
                            ~~~~

src/examples/server/simpleStreamableHttp.ts:624:68 - error TS2339: Property 'auth' does not exist on type 'Request<ParamsDictionary, any, any, ParsedQs, Record<string, any>>'.

624         console.log('Authenticated SSE connection from user:', req.auth);
                                                                       ~~~~

src/server/auth/handlers/revoke.ts:59:32 - error TS2339: Property 'client' does not exist on type 'Request<{}, any, any, ParsedQs, Record<string, any>>'.

59             const client = req.client;
                                  ~~~~~~

src/server/auth/handlers/token.ts:82:32 - error TS2339: Property 'client' does not exist on type 'Request<{}, any, any, ParsedQs, Record<string, any>>'.

82             const client = req.client;
                                  ~~~~~~

src/server/auth/middleware/bearerAuth.ts:23:16 - error TS2664: Invalid module name in augmentation, module 'express-serve-static-core' cannot be found.

23 declare module 'express-serve-static-core' {
                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~

src/server/auth/middleware/bearerAuth.ts:71:17 - error TS2339: Property 'auth' does not exist on type 'Request<ParamsDictionary, any, any, ParsedQs, Record<string, any>>'.

71             req.auth = authInfo;
                   ~~~~

src/server/auth/middleware/clientAuth.ts:19:16 - error TS2664: Invalid module name in augmentation, module 'express-serve-static-core' cannot be found.

19 declare module 'express-serve-static-core' {
                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~

src/server/auth/middleware/clientAuth.ts:60:17 - error TS2339: Property 'client' does not exist on type 'Request<ParamsDictionary, any, any, ParsedQs, Record<string, any>>'.

60             req.client = client;
                   ~~~~~~


Found 10 errors in 5 files.

Errors  Files
     4  src/examples/server/simpleStreamableHttp.ts:539
     1  src/server/auth/handlers/revoke.ts:59
     1  src/server/auth/handlers/token.ts:82
     2  src/server/auth/middleware/bearerAuth.ts:23
     2  src/server/auth/middleware/clientAuth.ts:19
 ELIFECYCLE  Command failed with exit code 2.

tl;dr; here is that pnpm and other strict package managers don't allow imports to transitive dependencies, so we solve that here by adding hoisting the @types/express-serve-static-core module that's referenced in bearerAuth.ts into the package.json.

[mattzcarey]

I'm not sure we should be adding additional dependencies to satisfy a package manager we dont use in this repo. We should do this only if there is a strict mode with npm we can enable which requires this.

[mgyarmathy]

I'm not sure we should be adding additional dependencies to satisfy a package manager we dont use in this repo. We should do this only if there is a strict mode with npm we can enable which requires this.

@mattzcarey Fair point about pnpm not being used in the repo. I agree with you.

Counterpoint is that we do have a true dependency on @types/express-serve-static-core in bearerAuth.ts#L23-L30 -- it just so happens that it's pulled in as a transitive dependency today through @types/express, which is referenced as a devDependency. npm allows it, but strict package managers like pnpm will flag you for it.

I'd love to help close out some open issues in this repo. I picked up #572 because @felixweinberger marked as PR Welcome.

We can either a) merge this PR to resolve the issue, or b) respond to the original issue to let the author know we're not going to address it.

[mattzcarey]

Thanks for this!