fix: builds via pnpm

[mgyarmathy]

This PR adds the transitive @types/express-serve-static-core dependency as a direct devDependency to fix builds via strict package managers like pnpm. This is necessary because types from express-serve-static-core are currently referenced directly in https://github.com/modelcontextprotocol/typescript-sdk/blob/main/src/server/auth/middleware/bearerAuth.ts#L23-L30

Motivation and Context

Fixes #572

How Has This Been Tested?

• pnpm install + pnpm build on a fresh clone of this branch now succeeds
• rm -rf node_modules/ && pnpm i && pnpm build also succeeds
• Testing for regressions -- rm -rf node_modules/ && npm i && npm run build also succeeds.

Breaking Changes

n/a

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/sdk@1078

commit: 1207d30

[KKonstantinov]

Hello,

Could you please provide the error that you have from pnpm, as well as your pnpm config?

Going forward, if @types/express-serve-static-core is added as a devDependency, should its types not be removed from https://github.com/modelcontextprotocol/typescript-sdk/blob/main/src/server/auth/middleware/bearerAuth.ts#L23-L30 ?

[mgyarmathy]

Hello,

Could you please provide the error that you have from pnpm, as well as your pnpm config?

Going forward, if @types/express-serve-static-core is added as a devDependency, should its types not be removed from https://github.com/modelcontextprotocol/typescript-sdk/blob/main/src/server/auth/middleware/bearerAuth.ts#L23-L30 ?

Hey @KKonstantinov -- here's the current build error when running pnpm install && pnpm build (pnpm default config) on this project with the latest commit on main:

$ pnpm build

> @modelcontextprotocol/[email protected] build /Users/mgyarmathy/Code/mgyarmathy/modelcontextprotocol--typescript-sdk
> npm run build:esm && npm run build:cjs


> @modelcontextprotocol/[email protected] build:esm
> mkdir -p dist/esm && echo '{"type": "module"}' > dist/esm/package.json && tsc -p tsconfig.prod.json

src/examples/server/simpleStreamableHttp.ts:539:25 - error TS2339: Property 'auth' does not exist on type 'Request<ParamsDictionary, any, any, ParsedQs, Record<string, any>>'.

539     if (useOAuth && req.auth) {
                            ~~~~

src/examples/server/simpleStreamableHttp.ts:540:48 - error TS2339: Property 'auth' does not exist on type 'Request<ParamsDictionary, any, any, ParsedQs, Record<string, any>>'.

540         console.log('Authenticated user:', req.auth);
                                                   ~~~~

src/examples/server/simpleStreamableHttp.ts:623:25 - error TS2339: Property 'auth' does not exist on type 'Request<ParamsDictionary, any, any, ParsedQs, Record<string, any>>'.

623     if (useOAuth && req.auth) {
                            ~~~~

src/examples/server/simpleStreamableHttp.ts:624:68 - error TS2339: Property 'auth' does not exist on type 'Request<ParamsDictionary, any, any, ParsedQs, Record<string, any>>'.

624         console.log('Authenticated SSE connection from user:', req.auth);
                                                                       ~~~~

src/server/auth/handlers/revoke.ts:59:32 - error TS2339: Property 'client' does not exist on type 'Request<{}, any, any, ParsedQs, Record<string, any>>'.

59             const client = req.client;
                                  ~~~~~~

src/server/auth/handlers/token.ts:82:32 - error TS2339: Property 'client' does not exist on type 'Request<{}, any, any, ParsedQs, Record<string, any>>'.

82             const client = req.client;
                                  ~~~~~~

src/server/auth/middleware/bearerAuth.ts:23:16 - error TS2664: Invalid module name in augmentation, module 'express-serve-static-core' cannot be found.

23 declare module 'express-serve-static-core' {
                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~

src/server/auth/middleware/bearerAuth.ts:71:17 - error TS2339: Property 'auth' does not exist on type 'Request<ParamsDictionary, any, any, ParsedQs, Record<string, any>>'.

71             req.auth = authInfo;
                   ~~~~

src/server/auth/middleware/clientAuth.ts:19:16 - error TS2664: Invalid module name in augmentation, module 'express-serve-static-core' cannot be found.

19 declare module 'express-serve-static-core' {
                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~

src/server/auth/middleware/clientAuth.ts:60:17 - error TS2339: Property 'client' does not exist on type 'Request<ParamsDictionary, any, any, ParsedQs, Record<string, any>>'.

60             req.client = client;
                   ~~~~~~


Found 10 errors in 5 files.

Errors  Files
     4  src/examples/server/simpleStreamableHttp.ts:539
     1  src/server/auth/handlers/revoke.ts:59
     1  src/server/auth/handlers/token.ts:82
     2  src/server/auth/middleware/bearerAuth.ts:23
     2  src/server/auth/middleware/clientAuth.ts:19
 ELIFECYCLE  Command failed with exit code 2.

tl;dr; here is that pnpm and other strict package managers don't allow imports to transitive dependencies, so we solve that here by adding hoisting the @types/express-serve-static-core module that's referenced in bearerAuth.ts into the package.json.