@modelcontextprotocol/server 2.0.0-alpha.4 → 2.0.0-beta.2

package/dist/index.d.cts

@@ -0,0 +1,1745 @@
+import { $ as StandardSchemaV1, $i as SdkErrorCode, $n as NotificationMethod, $r as SingleSelectEnumSchema, $t as HandlerResultTypeMap, A as ResourceMetadata, Ai as UnsupportedProtocolVersionErrorData, An as ListPromptsResult, Ar as Resource, At as CreateMessageResult, B as ClientContext, Bi as INVALID_REQUEST, Bn as ListToolsResult, Br as ResultTypeMap, Bt as ElicitResult, C as PromptCallback, Ci as ToolChoice, Cn as JSONRPCResultResponse, Cr as RequestId, Ct as CompleteRequestResourceTemplate, D as RegisteredResource, Di as ToolUseContent, Dn as ListChangedHandlers, Dr as RequestMethod, Dt as CreateMessageRequestParams, E as RegisteredPrompt, Ei as ToolResultContent, En as ListChangedCallback, Er as RequestMetaObject, Et as CreateMessageRequest, F as UriTemplate, Fi as CLIENT_CAPABILITIES_META_KEY, Fn as ListRootsRequest, Fr as ResourceTemplateReference, Ft as DiscoverResult, G as RequestHandlerSchemas, Gi as PARSE_ERROR, Gn as MessageExtraInfo, Gr as SamplingMessage, Gt as EnumSchema, H as NotificationOptions, Hi as LATEST_PROTOCOL_VERSION, Hn as LoggingMessageNotification, Hr as Root, Ht as ElicitationCompleteNotificationParams, I as Variables, Ii as CLIENT_INFO_META_KEY, In as ListRootsResult, Ir as ResourceTemplateType, It as ElicitRequest, J as ServerContext, Ji as SUBSCRIPTION_ID_META_KEY, Jn as MissingRequiredClientCapabilityErrorData, Jr as ServerNotification, Jt as GetPromptResult, K as RequestOptions, Ki as PROTOCOL_VERSION_META_KEY, Kn as MetaObject, Kr as SamplingMessageContentBlock, Kt as GetPromptRequest, L as CacheHint, Li as DEFAULT_NEGOTIATED_PROTOCOL_VERSION, Ln as ListTasksRequest, Lr as ResourceUpdatedNotification, Lt as ElicitRequestFormParams, M as ToolCallback, Mi as UntitledSingleSelectEnumSchema, Mn as ListResourceTemplatesResult, Mr as ResourceLink, Mt as CreateTaskResult, N as Server, Ni as schemas_d_exports, Nn as ListResourcesRequest, Nr as ResourceListChangedNotification, Nt as Cursor, O as RegisteredResourceTemplate, Oi as UnsubscribeRequest, On as ListChangedOptions, Or as RequestParams, Ot as CreateMessageRequestParamsBase, P as ServerOptions, Pi as BAGGAGE_META_KEY, Pn as ListResourcesResult, Pr as ResourceRequestParams, Pt as DiscoverRequest, Q as createFetchWithInit, Qi as SdkError, Qn as Notification, Qr as SetLevelRequestParams, Qt as GetTaskResult, R as CacheScope, Ri as INTERNAL_ERROR, Rn as ListTasksResult, Rr as ResourceUpdatedNotificationParams, Rt as ElicitRequestParams, S as McpServer, Si as ToolAnnotations, Sn as JSONRPCResponse, Sr as Request$1, St as CompleteRequestPrompt, T as ReadResourceTemplateCallback, Ti as ToolListChangedNotification, Tn as LegacyTitledEnumSchema, Tr as RequestMetaEnvelope, Tt as ContentBlock, U as ProgressCallback, Ui as LOG_LEVEL_META_KEY, Un as LoggingMessageNotificationParams, Ur as RootsListChangedNotification, Ut as EmbeddedResource, V as DEFAULT_REQUEST_TIMEOUT_MSEC, Vi as JSONRPC_VERSION, Vn as LoggingLevel, Vr as Role, Vt as ElicitationCompleteNotification, W as ProtocolOptions, Wi as METHOD_NOT_FOUND, Wn as MessageClassification, Wr as SamplingContent, Wt as EmptyResult, X as Transport, Xi as TRACEPARENT_META_KEY, Xn as ModelPreferences, Xr as ServerResult, Xt as GetTaskPayloadResult, Y as FetchLike, Yi as SUPPORTED_PROTOCOL_VERSIONS, Yn as ModelHint, Yr as ServerRequest, Yt as GetTaskPayloadRequest, Z as TransportSendOptions, Zi as TRACESTATE_META_KEY, Zn as MultiSelectEnumSchema, Zr as SetLevelRequest, Zt as GetTaskRequest, _ as PerRequestResponseMode, _i as TextContent, _n as JSONObject, _r as PromptReference, _t as ClientRequest, a as McpRequestContext, ai as SubscriptionsAcknowledgedNotificationParams, an as InitializeRequestParams, ar as PaginatedResult, at as BaseMetadata, b as CompleteResourceTemplateCallback, bi as TitledSingleSelectEnumSchema, bn as JSONRPCNotification, br as ReadResourceResult, bt as CompleteRequest, c as isLegacyRequest, ci as SubscriptionsListenResult, cn as InputRequest, cr as PrimitiveSchemaDefinition, ct as CallToolRequest, d as ServerEvent, di as TaskAugmentedRequestParams, dn as InputResponse, dr as ProgressNotificationParams, dt as CancelTaskRequest, ea as SdkHttpError, ei as StringSchema, en as Icon, er as NotificationParams, et as StandardSchemaV1Sync, f as ServerEventBus, fi as TaskCreationParams, fn as InputResponses, fr as ProgressToken, ft as CancelTaskResult, g as PerRequestMessageExtra, gi as TaskStatusNotificationParams, gn as JSONArray, gr as PromptMessage, gt as ClientNotification, h as PerRequestHTTPServerTransportOptions, hi as TaskStatusNotification, hn as InvalidRequestError, hr as PromptListChangedNotification, ht as ClientCapabilities, i as McpHttpHandler, ii as SubscriptionsAcknowledgedNotification, in as InitializeRequest, ir as PaginatedRequestParams, it as AuthInfo, j as ResourceTemplate, ji as UntitledMultiSelectEnumSchema, jn as ListResourceTemplatesRequest, jr as ResourceContents, jt as CreateMessageResultWithTools, k as RegisteredTool, ki as UnsubscribeRequestParams, kn as ListPromptsRequest, kr as RequestTypeMap, kt as CreateMessageRequestParamsWithTools, l as legacyStatelessFallback, li as SubscriptionsListenResultMeta, ln as InputRequests, lr as Progress, lt as CallToolRequestParams, m as PerRequestHTTPServerTransport, mi as TaskStatus, mn as InvalidParamsError, mr as PromptArgument, mt as CancelledNotificationParams, n as LegacyHttpHandler, ni as SubscribeRequestParams, nn as ImageContent, nr as NumberSchema, nt as Annotations, o as McpServerFactory, oi as SubscriptionsListenRequest, on as InitializeResult, or as ParseError, ot as BlobResourceContents, p as ServerNotifier, pi as TaskMetadata, pn as InternalError, pr as Prompt, pt as CancelledNotification, q as RequestStateAccessor, qi as RELATED_TASK_META_KEY, qn as MethodNotFoundError, qr as ServerCapabilities, qt as GetPromptRequestParams, r as McpHandlerRequestOptions, ri as SubscriptionFilter, rn as Implementation, rr as PaginatedRequest, rt as AudioContent, s as createMcpHandler, si as SubscriptionsListenRequestParams, sn as InitializedNotification, sr as PingRequest, st as BooleanSchema, t as CreateMcpHandlerOptions, ta as SdkHttpErrorData, ti as SubscribeRequest, tn as Icons, tr as NotificationTypeMap, tt as StandardSchemaWithJSON, u as InMemoryServerEventBus, ui as Task, un as InputRequiredResult, ur as ProgressNotification, ut as CallToolResult, v as AnyToolHandler, vi as TextResourceContents, vn as JSONRPCErrorResponse, vr as ReadResourceRequest, vt as ClientResult, w as ReadResourceCallback, wi as ToolExecution, wn as JSONValue, wr as RequestMeta, wt as CompleteResult, x as ListResourcesCallback, xi as Tool, xn as JSONRPCRequest, xr as RelatedTaskMetadata, xt as CompleteRequestParams, y as BaseToolCallback, yi as TitledMultiSelectEnumSchema, yn as JSONRPCMessage, yr as ReadResourceRequestParams, yt as CompatibilityCallToolResult, z as BaseContext, zi as INVALID_PARAMS, zn as ListToolsRequest, zr as Result, zt as ElicitRequestURLParams } from "./createMcpHandler-DyxapqGO.cjs";
+import { t as AjvJsonSchemaValidator } from "./ajvProvider-D2kRT_qB.cjs";
+import { i as jsonSchemaValidator, n as JsonSchemaValidator, r as JsonSchemaValidatorResult, t as JsonSchemaType } from "./types-Pc2fJzyM.cjs";
+import { n as CfWorkerSchemaDraft, t as CfWorkerJsonSchemaValidator } from "./cfWorkerProvider-RncldJmy.cjs";
+import * as z from "zod/v4";
+
+//#region ../core-internal/src/shared/auth.d.ts
+
+/**
+ * RFC 9728 OAuth Protected Resource Metadata
+ */
+declare const OAuthProtectedResourceMetadataSchema: z.ZodObject<{
+  resource: z.ZodString;
+  authorization_servers: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+  jwks_uri: z.ZodOptional<z.ZodString>;
+  scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  bearer_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  resource_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  resource_name: z.ZodOptional<z.ZodString>;
+  resource_documentation: z.ZodOptional<z.ZodString>;
+  resource_policy_uri: z.ZodOptional<z.ZodString>;
+  resource_tos_uri: z.ZodOptional<z.ZodString>;
+  tls_client_certificate_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+  authorization_details_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  dpop_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  dpop_bound_access_tokens_required: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+/**
+ * RFC 8414 OAuth 2.0 Authorization Server Metadata
+ */
+declare const OAuthMetadataSchema: z.ZodObject<{
+  issuer: z.ZodString;
+  authorization_endpoint: z.ZodURL;
+  token_endpoint: z.ZodURL;
+  registration_endpoint: z.ZodOptional<z.ZodURL>;
+  scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  response_types_supported: z.ZodArray<z.ZodString>;
+  response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  service_documentation: z.ZodOptional<z.ZodURL>;
+  revocation_endpoint: z.ZodOptional<z.ZodURL>;
+  revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  revocation_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  introspection_endpoint: z.ZodOptional<z.ZodString>;
+  introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+  authorization_response_iss_parameter_supported: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$loose>;
+/**
+ * OpenID Connect Discovery 1.0 Provider Metadata
+ *
+ * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+ */
+declare const OpenIdProviderMetadataSchema: z.ZodObject<{
+  issuer: z.ZodString;
+  authorization_endpoint: z.ZodURL;
+  token_endpoint: z.ZodURL;
+  userinfo_endpoint: z.ZodOptional<z.ZodURL>;
+  jwks_uri: z.ZodURL;
+  registration_endpoint: z.ZodOptional<z.ZodURL>;
+  scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  response_types_supported: z.ZodArray<z.ZodString>;
+  response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  acr_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  subject_types_supported: z.ZodArray<z.ZodString>;
+  id_token_signing_alg_values_supported: z.ZodArray<z.ZodString>;
+  id_token_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  id_token_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  userinfo_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  userinfo_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  userinfo_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  request_object_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  request_object_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  request_object_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  display_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  claim_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  claims_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  service_documentation: z.ZodOptional<z.ZodString>;
+  claims_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  ui_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  claims_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+  request_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+  request_uri_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+  require_request_uri_registration: z.ZodOptional<z.ZodBoolean>;
+  op_policy_uri: z.ZodOptional<z.ZodURL>;
+  op_tos_uri: z.ZodOptional<z.ZodURL>;
+  client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+  authorization_response_iss_parameter_supported: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$loose>;
+/**
+ * OpenID Connect Discovery metadata that may include OAuth 2.0 fields
+ * This schema represents the real-world scenario where OIDC providers
+ * return a mix of OpenID Connect and OAuth 2.0 metadata fields
+ */
+declare const OpenIdProviderDiscoveryMetadataSchema: z.ZodObject<{
+  code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  issuer: z.ZodString;
+  authorization_endpoint: z.ZodURL;
+  token_endpoint: z.ZodURL;
+  userinfo_endpoint: z.ZodOptional<z.ZodURL>;
+  jwks_uri: z.ZodURL;
+  registration_endpoint: z.ZodOptional<z.ZodURL>;
+  scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  response_types_supported: z.ZodArray<z.ZodString>;
+  response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  acr_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  subject_types_supported: z.ZodArray<z.ZodString>;
+  id_token_signing_alg_values_supported: z.ZodArray<z.ZodString>;
+  id_token_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  id_token_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  userinfo_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  userinfo_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  userinfo_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  request_object_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  request_object_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  request_object_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  display_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  claim_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  claims_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  service_documentation: z.ZodOptional<z.ZodString>;
+  claims_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  ui_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  claims_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+  request_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+  request_uri_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+  require_request_uri_registration: z.ZodOptional<z.ZodBoolean>;
+  op_policy_uri: z.ZodOptional<z.ZodURL>;
+  op_tos_uri: z.ZodOptional<z.ZodURL>;
+  client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+  authorization_response_iss_parameter_supported: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$strip>;
+/**
+ * OAuth 2.1 token response
+ */
+declare const OAuthTokensSchema: z.ZodObject<{
+  access_token: z.ZodString;
+  id_token: z.ZodOptional<z.ZodString>;
+  token_type: z.ZodString;
+  expires_in: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+  scope: z.ZodOptional<z.ZodString>;
+  refresh_token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * RFC 8693 §2.2.1 Token Exchange response for ID-JAG tokens.
+ *
+ * `token_type` is intentionally optional: per RFC 8693 §2.2.1 it is informational when
+ * the issued token is not an access token, and per RFC 6749 §5.1 it is case-insensitive,
+ * so strict checking rejects conformant IdPs.
+ */
+declare const IdJagTokenExchangeResponseSchema: z.ZodObject<{
+  issued_token_type: z.ZodLiteral<"urn:ietf:params:oauth:token-type:id-jag">;
+  access_token: z.ZodString;
+  token_type: z.ZodOptional<z.ZodString>;
+  expires_in: z.ZodOptional<z.ZodNumber>;
+  scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type IdJagTokenExchangeResponse = z.infer<typeof IdJagTokenExchangeResponseSchema>;
+/**
+ * OAuth 2.1 error response
+ */
+declare const OAuthErrorResponseSchema: z.ZodObject<{
+  error: z.ZodString;
+  error_description: z.ZodOptional<z.ZodString>;
+  error_uri: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration metadata
+ */
+declare const OAuthClientMetadataSchema: z.ZodObject<{
+  redirect_uris: z.ZodArray<z.ZodURL>;
+  token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
+  grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  application_type: z.ZodOptional<z.ZodString>;
+  client_name: z.ZodOptional<z.ZodString>;
+  client_uri: z.ZodOptional<z.ZodURL>;
+  logo_uri: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+  scope: z.ZodOptional<z.ZodString>;
+  contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  tos_uri: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+  policy_uri: z.ZodOptional<z.ZodString>;
+  jwks_uri: z.ZodOptional<z.ZodURL>;
+  jwks: z.ZodOptional<z.ZodAny>;
+  software_id: z.ZodOptional<z.ZodString>;
+  software_version: z.ZodOptional<z.ZodString>;
+  software_statement: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration client information
+ */
+declare const OAuthClientInformationSchema: z.ZodObject<{
+  client_id: z.ZodString;
+  client_secret: z.ZodOptional<z.ZodString>;
+  client_id_issued_at: z.ZodOptional<z.ZodNumber>;
+  client_secret_expires_at: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration full response (client information plus metadata)
+ */
+declare const OAuthClientInformationFullSchema: z.ZodObject<{
+  redirect_uris: z.ZodArray<z.ZodURL>;
+  token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
+  grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  application_type: z.ZodOptional<z.ZodString>;
+  client_name: z.ZodOptional<z.ZodString>;
+  client_uri: z.ZodOptional<z.ZodURL>;
+  logo_uri: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+  scope: z.ZodOptional<z.ZodString>;
+  contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  tos_uri: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+  policy_uri: z.ZodOptional<z.ZodString>;
+  jwks_uri: z.ZodOptional<z.ZodURL>;
+  jwks: z.ZodOptional<z.ZodAny>;
+  software_id: z.ZodOptional<z.ZodString>;
+  software_version: z.ZodOptional<z.ZodString>;
+  software_statement: z.ZodOptional<z.ZodString>;
+  client_id: z.ZodString;
+  client_secret: z.ZodOptional<z.ZodString>;
+  client_id_issued_at: z.ZodOptional<z.ZodNumber>;
+  client_secret_expires_at: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration error response
+ */
+declare const OAuthClientRegistrationErrorSchema: z.ZodObject<{
+  error: z.ZodString;
+  error_description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * RFC 7009 OAuth 2.0 Token Revocation request
+ */
+declare const OAuthTokenRevocationRequestSchema: z.ZodObject<{
+  token: z.ZodString;
+  token_type_hint: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type OAuthMetadata = z.infer<typeof OAuthMetadataSchema>;
+type OpenIdProviderMetadata = z.infer<typeof OpenIdProviderMetadataSchema>;
+type OpenIdProviderDiscoveryMetadata = z.infer<typeof OpenIdProviderDiscoveryMetadataSchema>;
+type OAuthTokens = z.infer<typeof OAuthTokensSchema>;
+type OAuthErrorResponse = z.infer<typeof OAuthErrorResponseSchema>;
+type OAuthClientMetadata = z.infer<typeof OAuthClientMetadataSchema>;
+type OAuthClientInformation = z.infer<typeof OAuthClientInformationSchema>;
+type OAuthClientInformationFull = z.infer<typeof OAuthClientInformationFullSchema>;
+type OAuthClientInformationMixed = OAuthClientInformation | OAuthClientInformationFull;
+/**
+ * {@linkcode OAuthTokens} as persisted by an `OAuthClientProvider`. Adds an
+ * SDK-stamped authorization-server `issuer` identifier so stored tokens are
+ * bound to the AS that issued them. The `issuer` field is **not** part of the
+ * RFC 6749 wire response and is intentionally absent from the wire-response
+ * schema; the client SDK writes it before calling `saveTokens`.
+ */
+type StoredOAuthTokens = OAuthTokens & {
+  issuer?: string;
+};
+/**
+ * {@linkcode OAuthClientInformationMixed} as persisted by an
+ * `OAuthClientProvider`. Adds an SDK-stamped authorization-server `issuer`
+ * identifier so stored client credentials are bound to the AS that issued them.
+ * The `issuer` field is **not** part of the RFC 7591 wire response and is
+ * intentionally absent from the wire-response schema; the client SDK writes it
+ * before calling `saveClientInformation`.
+ */
+type StoredOAuthClientInformation = OAuthClientInformationMixed & {
+  issuer?: string;
+};
+type OAuthClientRegistrationError = z.infer<typeof OAuthClientRegistrationErrorSchema>;
+type OAuthTokenRevocationRequest = z.infer<typeof OAuthTokenRevocationRequestSchema>;
+type OAuthProtectedResourceMetadata = z.infer<typeof OAuthProtectedResourceMetadataSchema>;
+type AuthorizationServerMetadata = OAuthMetadata | OpenIdProviderDiscoveryMetadata;
+//#endregion
+//#region ../core-internal/src/auth/errors.d.ts
+/**
+ * OAuth error codes as defined by {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC 6749}
+ * and extensions.
+ */
+declare enum OAuthErrorCode {
+  /**
+   * The request is missing a required parameter, includes an invalid parameter value,
+   * includes a parameter more than once, or is otherwise malformed.
+   */
+  InvalidRequest = "invalid_request",
+  /**
+   * Client authentication failed (e.g., unknown client, no client authentication included,
+   * or unsupported authentication method).
+   */
+  InvalidClient = "invalid_client",
+  /**
+   * The provided authorization grant or refresh token is invalid, expired, revoked,
+   * does not match the redirection URI used in the authorization request, or was issued to another client.
+   */
+  InvalidGrant = "invalid_grant",
+  /**
+   * The authenticated client is not authorized to use this authorization grant type.
+   */
+  UnauthorizedClient = "unauthorized_client",
+  /**
+   * The authorization grant type is not supported by the authorization server.
+   */
+  UnsupportedGrantType = "unsupported_grant_type",
+  /**
+   * The requested scope is invalid, unknown, malformed, or exceeds the scope granted by the resource owner.
+   */
+  InvalidScope = "invalid_scope",
+  /**
+   * The resource owner or authorization server denied the request.
+   */
+  AccessDenied = "access_denied",
+  /**
+   * The authorization server encountered an unexpected condition that prevented it from fulfilling the request.
+   */
+  ServerError = "server_error",
+  /**
+   * The authorization server is currently unable to handle the request due to temporary overloading or maintenance.
+   */
+  TemporarilyUnavailable = "temporarily_unavailable",
+  /**
+   * The authorization server does not support obtaining an authorization code using this method.
+   */
+  UnsupportedResponseType = "unsupported_response_type",
+  /**
+   * The authorization server does not support the requested token type.
+   */
+  UnsupportedTokenType = "unsupported_token_type",
+  /**
+   * The access token provided is expired, revoked, malformed, or invalid for other reasons.
+   */
+  InvalidToken = "invalid_token",
+  /**
+   * The HTTP method used is not allowed for this endpoint. (Custom, non-standard error)
+   */
+  MethodNotAllowed = "method_not_allowed",
+  /**
+   * Rate limit exceeded. (Custom, non-standard error based on RFC 6585)
+   */
+  TooManyRequests = "too_many_requests",
+  /**
+   * The client metadata is invalid. (Custom error for dynamic client registration - RFC 7591)
+   */
+  InvalidClientMetadata = "invalid_client_metadata",
+  /**
+   * The value of one or more redirection URIs is invalid. (Dynamic client registration - RFC 7591 §3.2.2)
+   */
+  InvalidRedirectUri = "invalid_redirect_uri",
+  /**
+   * The request requires higher privileges than provided by the access token.
+   */
+  InsufficientScope = "insufficient_scope",
+  /**
+   * The requested resource is invalid, missing, unknown, or malformed. (Custom error for resource indicators - RFC 8707)
+   */
+  InvalidTarget = "invalid_target",
+}
+/**
+ * OAuth error class for all OAuth-related errors.
+ */
+declare class OAuthError extends Error {
+  readonly code: OAuthErrorCode | string;
+  readonly errorUri?: string | undefined;
+  constructor(code: OAuthErrorCode | string, message: string, errorUri?: string | undefined);
+  /**
+   * Converts the error to a standard OAuth error response object.
+   */
+  toResponseObject(): OAuthErrorResponse;
+  /**
+   * Creates an {@linkcode OAuthError} from an OAuth error response.
+   */
+  static fromResponse(response: OAuthErrorResponse): OAuthError;
+}
+//#endregion
+//#region ../core-internal/src/shared/authUtils.d.ts
+/**
+ * Utilities for handling OAuth resource URIs.
+ */
+/**
+ * Converts a server URL to a resource URL by removing the fragment.
+ * {@link https://datatracker.ietf.org/doc/html/rfc8707#section-2 | RFC 8707 section 2}
+ * states that resource URIs "MUST NOT include a fragment component".
+ * Keeps everything else unchanged (scheme, domain, port, path, query).
+ */
+declare function resourceUrlFromServerUrl(url: URL | string): URL;
+/**
+ * Checks if a requested resource URL matches a configured resource URL.
+ * A requested resource matches if it has the same scheme, domain, port,
+ * and its path starts with the configured resource's path.
+ *
+ * @param options - The options object
+ * @param options.requestedResource - The resource URL being requested
+ * @param options.configuredResource - The resource URL that has been configured
+ * @returns true if the requested resource matches the configured resource, false otherwise
+ */
+declare function checkResourceAllowed({
+  requestedResource,
+  configuredResource
+}: {
+  requestedResource: URL | string;
+  configuredResource: URL | string;
+}): boolean;
+//#endregion
+//#region ../core-internal/src/shared/inboundClassification.d.ts
+/**
+ * The transport-neutral description of an inbound HTTP request the classifier
+ * evaluates. The caller (the HTTP entry) reads the body exactly once and
+ * extracts the two protocol headers; the classifier never touches a request
+ * object itself.
+ */
+interface InboundHttpRequest {
+  /** The HTTP request method, e.g. `POST`, `GET`, `DELETE`. */
+  httpMethod: string;
+  /** The value of the `MCP-Protocol-Version` header, when present. */
+  protocolVersionHeader?: string;
+  /** The value of the `Mcp-Method` header, when present. */
+  mcpMethodHeader?: string;
+  /** The value of the `Mcp-Name` header, when present. */
+  mcpNameHeader?: string;
+  /** The parsed JSON request body (`undefined` for body-less methods). */
+  body?: unknown;
+}
+/** Why an inbound request was routed to legacy-era serving. */
+type InboundLegacyRouteReason = /** Non-`POST` HTTP method: a body-less 2025-era session operation. */
+'http-method'
+/** An `initialize` request without a valid modern envelope claim — the legacy handshake by definition. */ | 'initialize'
+/** A request without a per-request envelope claim. */ | 'no-claim'
+/** A notification without a body claim or a modern protocol-version header. */ | 'notification'
+/** An all-legacy JSON-RPC batch array. */ | 'batch'
+/** A JSON-RPC response posted to the endpoint (2025-era session traffic). */ | 'response';
+/**
+ * The request is legacy-era traffic. It carries no classification on purpose:
+ * legacy serving receives it exactly as a hand-wired 2025 transport would.
+ */
+interface InboundLegacyRoute {
+  kind: 'legacy';
+  reason: InboundLegacyRouteReason;
+  /**
+   * The protocol version the request named, when it named one (an
+   * `initialize` body's `protocolVersion`, or the `MCP-Protocol-Version`
+   * header). Used to echo `requested` when legacy serving is not configured.
+   */
+  requestedVersion?: string;
+}
+/**
+ * The request claims the per-request envelope mechanism and is served on the
+ * modern path. Discriminated by `messageKind` so the typed `message` narrows
+ * with it — the classifier has already proved the JSON-RPC shape via the
+ * `isJSONRPCRequest` / `isJSONRPCNotification` guards, so consumers never
+ * cast the body again.
+ */
+type InboundModernRoute = {
+  kind: 'modern';
+  messageKind: 'request';
+  /** The classified body — guard-proved {@linkcode JSONRPCRequest} shape. */
+  message: JSONRPCRequest;
+  /**
+   * The classification handed to the per-request transport and validated by
+   * the protocol layer against the serving instance's negotiated era.
+   */
+  classification: MessageClassification;
+} | {
+  kind: 'modern';
+  messageKind: 'notification';
+  /** The classified body — guard-proved {@linkcode JSONRPCNotification} shape. */
+  message: JSONRPCNotification;
+  classification: MessageClassification;
+};
+/** The named steps of the inbound validation ladder, in evaluation order. */
+type InboundValidationRung = 'http-method' | 'jsonrpc-shape' | 'era-classification' | 'envelope' | 'method-registry' | 'request-params' | 'standard-header-validation' | 'client-capabilities' | 'param-header-validation';
+/** A ladder rejection: the JSON-RPC error to emit and the HTTP status to emit it with. */
+interface InboundLadderRejection {
+  kind: 'reject';
+  /** The ladder rung that produced the rejection. */
+  rung: InboundValidationRung;
+  /** The cell this rejection corresponds to on the ladder cell sheet (stable identifier for tests). */
+  cell: string;
+  /** The HTTP status the rejection is emitted with. */
+  httpStatus: number;
+  /** The JSON-RPC error code. */
+  code: number;
+  /** The JSON-RPC error message. */
+  message: string;
+  /** Structured error data (recognizers parse this; they never rely on class identity). */
+  data?: unknown;
+  /**
+   * `false` when the exact error code for this cell is not settled upstream
+   * yet and the emitted code is provisional.
+   */
+  settled: boolean;
+}
+/** The outcome of classifying one inbound HTTP request. */
+type InboundClassificationOutcome = InboundLegacyRoute | InboundModernRoute | InboundLadderRejection;
+/**
+ * Classifies one inbound HTTP request for dual-era serving.
+ *
+ * The body-primary predicate, evaluated once at the entry boundary: see the
+ * module documentation for the rules. Returns a routing outcome (`legacy` or
+ * `modern`) or a ladder rejection; it never throws.
+ */
+declare function classifyInboundRequest(request: InboundHttpRequest): InboundClassificationOutcome;
+//#endregion
+//#region ../core-internal/src/shared/inputRequired.d.ts
+/** The shape accepted by {@linkcode inputRequired}. */
+interface InputRequiredSpec {
+  /** Embedded requests the client must fulfil before retrying. */
+  inputRequests?: InputRequests;
+  /** Opaque server state echoed back verbatim by the client on retry. */
+  requestState?: string;
+}
+interface InputRequiredBuilder {
+  /**
+   * Builds the input-required return value for a multi-round-trip handler.
+   *
+   * At least one of `inputRequests` or `requestState` must be provided
+   * (spec: basic/patterns/mrtr, server requirements) — the builder throws a
+   * `TypeError` otherwise, and the server seam re-checks the same rule for
+   * hand-built results.
+   *
+   * `requestState` is opaque, server-minted state. It round-trips through
+   * the client and comes back as attacker-controlled input: a server that
+   * lets it influence authorization, resource access, or business logic
+   * MUST integrity-protect it (e.g. HMAC or AEAD) and MUST reject state
+   * that fails verification. The SDK does not do this for you.
+   */
+  (spec: InputRequiredSpec): InputRequiredResult;
+  /** Builds an embedded form-mode elicitation request (`elicitation/create`). */
+  elicit(params: Omit<ElicitRequestFormParams, 'mode'> & {
+    mode?: 'form';
+  }): InputRequest;
+  /**
+   * Builds an embedded URL-mode elicitation request (`elicitation/create`).
+   * On the 2026-07-28 revision URL elicitation rides the multi-round-trip
+   * flow — the `-32042` error of earlier revisions never appears on this
+   * era's wire. The 2025-era `elicitationId` is not part of the 2026-07-28
+   * URL-mode shape; correlation across retries is the server's own
+   * identifier inside `requestState`.
+   */
+  elicitUrl(params: Omit<ElicitRequestURLParams, 'mode' | 'elicitationId'>): InputRequest;
+  /** Builds an embedded sampling request (`sampling/createMessage`). */
+  createMessage(params: CreateMessageRequestParams): InputRequest;
+  /** Builds an embedded roots listing request (`roots/list`). */
+  listRoots(): InputRequest;
+}
+/**
+ * Builder for the input-required return value of multi-round-trip handlers,
+ * with per-kind constructors for the embedded requests
+ * (`inputRequired.elicit`, `inputRequired.elicitUrl`,
+ * `inputRequired.createMessage`, `inputRequired.listRoots`).
+ *
+ * @example Write-once tool requesting confirmation
+ * ```ts
+ * server.registerTool('deploy', { inputSchema: z.object({ env: z.string() }) }, async ({ env }, ctx) => {
+ *     const confirmed = acceptedContent<{ confirm: boolean }>(ctx.mcpReq.inputResponses, 'confirm');
+ *     if (!confirmed) {
+ *         return inputRequired({
+ *             inputRequests: {
+ *                 confirm: inputRequired.elicit({
+ *                     message: `Deploy to ${env}?`,
+ *                     requestedSchema: { type: 'object', properties: { confirm: { type: 'boolean' } }, required: ['confirm'] }
+ *                 })
+ *             }
+ *         });
+ *     }
+ *     return { content: [{ type: 'text', text: `deployed to ${env}` }] };
+ * });
+ * ```
+ */
+declare const inputRequired: InputRequiredBuilder;
+/**
+ * Reads the accepted content of a form-mode elicitation response from a
+ * retried request's `inputResponses` (`ctx.mcpReq.inputResponses`).
+ *
+ * Returns the response's `content` for `key` when the entry is an accepted
+ * elicitation result, and `undefined` otherwise (missing key, declined or
+ * cancelled elicitation, or a response of another kind). The values arrive
+ * from the client and are not re-validated here — treat them as untrusted
+ * input.
+ */
+declare function acceptedContent<T extends Record<string, unknown> = Record<string, unknown>>(responses: InputResponses | Record<string, unknown> | undefined, key: string): T | undefined;
+/**
+ * Schema-aware overload: validates the accepted content against the given
+ * schema (any Standard Schema, e.g. a zod object) before returning it, so the
+ * untrusted client value arrives in the handler already validated and typed.
+ *
+ * Returns `undefined` when the response is missing/declined/of another kind
+ * (as the two-argument form does) AND when the accepted content fails schema
+ * validation — handlers treat both the same way (re-issue the request or
+ * give up). Only synchronous schemas are supported (zod schemas without async
+ * refinements are synchronous); an asynchronously-validating schema throws a
+ * `TypeError`.
+ */
+declare function acceptedContent<S extends StandardSchemaV1>(responses: InputResponses | Record<string, unknown> | undefined, key: string, schema: S): StandardSchemaV1.InferOutput<S> | undefined;
+/**
+ * The discriminated view {@linkcode inputResponse} returns: which kind of
+ * embedded response (if any) a retried request carried for a key. Bare
+ * response objects are discriminated structurally — an `action` member means
+ * an elicitation result, a `roots` array a roots listing, a `role` + `content`
+ * pair a sampling result. A missing key or an entry that matches none of the
+ * three shapes reads as `{ kind: 'missing' }`.
+ */
+type InputResponseView = {
+  kind: 'missing';
+} | {
+  kind: 'elicit';
+  action: 'accept' | 'decline' | 'cancel';
+  content?: Record<string, unknown>;
+} | {
+  kind: 'sampling';
+  result: CreateMessageResult | CreateMessageResultWithTools;
+} | {
+  kind: 'roots';
+  roots: Root[];
+};
+/**
+ * Reads one entry of a retried request's `inputResponses`
+ * (`ctx.mcpReq.inputResponses`) as a discriminated view, covering
+ * decline/cancel detection and the non-elicitation response kinds that
+ * {@linkcode acceptedContent} does not surface.
+ *
+ * The values arrive from the client and are not re-validated here — treat
+ * them as untrusted input (validate elicitation content with the
+ * schema-aware {@linkcode acceptedContent} overload where it matters).
+ */
+declare function inputResponse(responses: InputResponses | Record<string, unknown> | undefined, key: string): InputResponseView;
+//#endregion
+//#region ../core-internal/src/types/enums.d.ts
+/**
+ * Error codes for protocol errors that cross the wire as JSON-RPC error responses.
+ * These follow the JSON-RPC specification and MCP-specific extensions.
+ */
+declare enum ProtocolErrorCode {
+  ParseError = -32700,
+  InvalidRequest = -32600,
+  MethodNotFound = -32601,
+  InvalidParams = -32602,
+  InternalError = -32603,
+  /**
+   * Resource not found.
+   *
+   * Receive-tolerated only: the SDK never EMITS `-32002` — `resources/read`
+   * misses answer `-32602` (Invalid Params) on every protocol revision per
+   * the 2026-07-28 spec MUST, and a handler-thrown `-32002` is mapped to
+   * `-32602` at the era encode seam. The member stays importable so clients
+   * can recognise `-32002` from peers built on earlier SDK releases (the
+   * spec's "clients SHOULD also accept `-32002`" backwards-compatibility
+   * clause). Throw `ResourceNotFoundError` instead.
+   */
+  ResourceNotFound = -32002,
+  /**
+   * Processing the request requires a capability the client did not declare
+   * in the request's `clientCapabilities` (protocol revision 2026-07-28).
+   */
+  MissingRequiredClientCapability = -32021,
+  /**
+   * The request's protocol version is unknown to the server or unsupported
+   * by it (protocol revision 2026-07-28).
+   */
+  UnsupportedProtocolVersion = -32022,
+  UrlElicitationRequired = -32042,
+}
+//#endregion
+//#region ../core-internal/src/types/errors.d.ts
+/**
+ * Protocol errors are JSON-RPC errors that cross the wire as error responses.
+ * They use numeric error codes from the {@linkcode ProtocolErrorCode} enum.
+ */
+declare class ProtocolError extends Error {
+  readonly code: number;
+  readonly data?: unknown | undefined;
+  constructor(code: number, message: string, data?: unknown | undefined);
+  /**
+   * Factory method to create the appropriate error type based on the error code and data
+   */
+  static fromError(code: number, message: string, data?: unknown): ProtocolError;
+}
+/**
+ * Error type for a `resources/read` miss: the requested resource does not
+ * exist. The wire code is `-32602` (Invalid Params) on every protocol
+ * revision — the spec MUST for revision 2026-07-28, and the value the v1.x
+ * SDK has always emitted on earlier revisions. The error data echoes the
+ * requested URI.
+ *
+ * Recognise this error by checking `error.data` is exactly `{ uri: string }`
+ * (a `-32602` whose data carries `uri` and nothing else is resource-not-found;
+ * any other `-32602` is an ordinary Invalid Params). For backwards compatibility, clients should also
+ * accept `-32002` as resource not found — earlier SDK builds emitted that
+ * code, and {@linkcode ProtocolError.fromError} reconstructs this class for
+ * either code **when `error.data` carries `uri`** (a bare `-32002` without
+ * `data.uri` stays a generic {@linkcode ProtocolError}). Do not rely on
+ * `instanceof` — it does not work across separately bundled copies of the
+ * SDK.
+ */
+declare class ResourceNotFoundError extends ProtocolError {
+  constructor(uri: string, message?: string);
+  /** The URI that was requested and not found. */
+  get uri(): string;
+}
+/**
+ * Specialized error type when a tool requires a URL mode elicitation.
+ * This makes it nicer for the client to handle since there is specific data to work with instead of just a code to check against.
+ */
+declare class UrlElicitationRequiredError extends ProtocolError {
+  constructor(elicitations: ElicitRequestURLParams[], message?: string);
+  get elicitations(): ElicitRequestURLParams[];
+}
+/**
+ * Error type for the `-32022` UnsupportedProtocolVersion protocol error (protocol
+ * revision 2026-07-28): the request's protocol version is unknown to the server or
+ * unsupported by it.
+ *
+ * The error data lists the protocol versions the receiver supports (`supported`),
+ * so the sender can choose a mutually supported version and retry, and echoes the
+ * version that was requested (`requested`).
+ */
+declare class UnsupportedProtocolVersionError extends ProtocolError {
+  constructor(data: UnsupportedProtocolVersionErrorData, message?: string);
+  /**
+   * Protocol versions the receiver supports.
+   */
+  get supported(): string[];
+  /**
+   * The protocol version that was requested.
+   */
+  get requested(): string;
+}
+/**
+ * Error type for the `-32021` MissingRequiredClientCapability protocol error
+ * (protocol revision 2026-07-28): processing the request requires a capability
+ * the client did not declare in the request's `clientCapabilities`.
+ *
+ * The error data lists the missing capabilities (`requiredCapabilities`) in
+ * the `ClientCapabilities` shape, so the client can see exactly what it would
+ * have to declare for the request to be served. On HTTP, the response status
+ * is `400 Bad Request`.
+ *
+ * Recognize this error by its code and `data.requiredCapabilities` rather than
+ * by class identity (`instanceof` does not work across separately bundled
+ * copies of the SDK).
+ */
+declare class MissingRequiredClientCapabilityError extends ProtocolError {
+  constructor(data: MissingRequiredClientCapabilityErrorData, message?: string);
+  /**
+   * The capabilities the server requires from the client to process the
+   * request (only the missing capabilities are listed).
+   */
+  get requiredCapabilities(): ClientCapabilities;
+}
+//#endregion
+//#region ../core-internal/src/types/guards.d.ts
+/**
+ * Validates and parses an unknown value as a JSON-RPC message.
+ *
+ * Use this to validate incoming messages in custom transport implementations.
+ * Throws if the value does not conform to the JSON-RPC message schema.
+ *
+ * @param value - The value to validate (typically a parsed JSON object).
+ * @returns The validated {@linkcode JSONRPCMessage}.
+ * @throws If validation fails.
+ */
+declare function parseJSONRPCMessage(value: unknown): JSONRPCMessage;
+declare const isJSONRPCRequest: (value: unknown) => value is JSONRPCRequest;
+declare const isJSONRPCNotification: (value: unknown) => value is JSONRPCNotification;
+/**
+ * Checks if a value is a valid {@linkcode JSONRPCResultResponse}.
+ * @param value - The value to check.
+ *
+ * @returns True if the value is a valid {@linkcode JSONRPCResultResponse}, false otherwise.
+ */
+declare const isJSONRPCResultResponse: (value: unknown) => value is JSONRPCResultResponse;
+/**
+ * Checks if a value is a valid {@linkcode JSONRPCErrorResponse}.
+ * @param value - The value to check.
+ *
+ * @returns True if the value is a valid {@linkcode JSONRPCErrorResponse}, false otherwise.
+ */
+declare const isJSONRPCErrorResponse: (value: unknown) => value is JSONRPCErrorResponse;
+/**
+ * Checks if a value is a valid {@linkcode JSONRPCResponse} (either a result or error response).
+ * @param value - The value to check.
+ *
+ * @returns True if the value is a valid {@linkcode JSONRPCResponse}, false otherwise.
+ */
+declare const isJSONRPCResponse: (value: unknown) => value is JSONRPCResponse;
+/**
+ * Checks if a value is a valid {@linkcode CallToolResult}.
+ *
+ * This is a consumer-side VALUE check against the neutral model, not a wire
+ * validator: a raw wire object that additionally carries wire-only members
+ * (e.g. `resultType`) still passes through the loose index signature. Use a
+ * transport-level parse to validate raw wire traffic.
+ *
+ * @param value - The value to check.
+ *
+ * @returns True if the value is a valid {@linkcode CallToolResult}, false otherwise.
+ */
+declare const isCallToolResult: (value: unknown) => value is CallToolResult;
+/**
+ * Checks whether a value is an input-required result (protocol revision
+ * 2026-07-28): the multi-round-trip return shape discriminated by
+ * `resultType: 'input_required'`.
+ *
+ * This is a discriminator check, not a full validator — the at-least-one rule
+ * (`inputRequests` or `requestState`) is enforced by the `inputRequired()`
+ * builder and re-checked by the server seam for hand-built values.
+ *
+ * @param value - The value to check.
+ * @returns True if the value carries the `input_required` discriminator.
+ */
+declare const isInputRequiredResult: (value: unknown) => value is InputRequiredResult;
+/**
+ * Checks if a value is a valid {@linkcode TaskAugmentedRequestParams}.
+ * @param value - The value to check.
+ *
+ * @returns True if the value is a valid {@linkcode TaskAugmentedRequestParams}, false otherwise.
+ *
+ * @deprecated Recognizes 2025-11-25 task wire vocabulary, which has no SDK
+ * runtime; kept importable for interoperability only.
+ */
+declare const isTaskAugmentedRequestParams: (value: unknown) => value is TaskAugmentedRequestParams;
+declare const isInitializeRequest: (value: unknown) => value is InitializeRequest;
+declare const isInitializedNotification: (value: unknown) => value is InitializedNotification;
+declare function assertCompleteRequestPrompt(request: CompleteRequest): asserts request is CompleteRequestPrompt;
+declare function assertCompleteRequestResourceTemplate(request: CompleteRequest): asserts request is CompleteRequestResourceTemplate;
+//#endregion
+//#region ../core-internal/src/types/specTypeSchema.d.ts
+/**
+ * Explicit allowlist of protocol Zod schemas that correspond to a public spec type in `types.ts`.
+ *
+ * This intentionally excludes internal helper schemas exported from `schemas.ts` that have no
+ * matching public type (e.g. `ListChangedOptionsBaseSchema`, `BaseRequestParamsSchema`,
+ * `NotificationsParamsSchema`, `ClientTasksCapabilitySchema`, `ServerTasksCapabilitySchema`).
+ * Keeping the list explicit means new public spec types must be added here deliberately, and
+ * internals never leak into `SpecTypeName`.
+ *
+ * `ResourceTemplateSchema` is included; its public type is exported as `ResourceTemplateType`
+ * (the bare name collides with the server package's `ResourceTemplate` class), so
+ * `SpecTypes['ResourceTemplate']` is structurally equal to `ResourceTemplateType` rather than to
+ * a type literally named `ResourceTemplate`.
+ */
+declare const SPEC_SCHEMA_KEYS: readonly ["AnnotationsSchema", "AudioContentSchema", "BaseMetadataSchema", "BlobResourceContentsSchema", "BooleanSchemaSchema", "CallToolRequestSchema", "CallToolRequestParamsSchema", "CallToolResultSchema", "CancelledNotificationSchema", "CancelledNotificationParamsSchema", "CancelTaskRequestSchema", "CancelTaskResultSchema", "ClientCapabilitiesSchema", "ClientNotificationSchema", "ClientRequestSchema", "ClientResultSchema", "CompatibilityCallToolResultSchema", "CompleteRequestSchema", "CompleteRequestParamsSchema", "CompleteResultSchema", "ContentBlockSchema", "CreateMessageRequestSchema", "CreateMessageRequestParamsSchema", "CreateMessageResultSchema", "CreateMessageResultWithToolsSchema", "CreateTaskResultSchema", "CursorSchema", "DiscoverRequestSchema", "DiscoverResultSchema", "ElicitationCompleteNotificationSchema", "ElicitationCompleteNotificationParamsSchema", "ElicitRequestSchema", "ElicitRequestFormParamsSchema", "ElicitRequestParamsSchema", "ElicitRequestURLParamsSchema", "ElicitResultSchema", "EmbeddedResourceSchema", "EmptyResultSchema", "EnumSchemaSchema", "GetPromptRequestSchema", "GetPromptRequestParamsSchema", "GetPromptResultSchema", "GetTaskPayloadRequestSchema", "GetTaskPayloadResultSchema", "GetTaskRequestSchema", "GetTaskResultSchema", "IconSchema", "IconsSchema", "ImageContentSchema", "ImplementationSchema", "InitializedNotificationSchema", "InitializeRequestSchema", "InitializeRequestParamsSchema", "InitializeResultSchema", "JSONArraySchema", "JSONObjectSchema", "JSONRPCErrorResponseSchema", "JSONRPCMessageSchema", "JSONRPCNotificationSchema", "JSONRPCRequestSchema", "JSONRPCResponseSchema", "JSONRPCResultResponseSchema", "JSONValueSchema", "LegacyTitledEnumSchemaSchema", "ListPromptsRequestSchema", "ListPromptsResultSchema", "ListResourcesRequestSchema", "ListResourcesResultSchema", "ListResourceTemplatesRequestSchema", "ListResourceTemplatesResultSchema", "ListRootsRequestSchema", "ListRootsResultSchema", "ListTasksRequestSchema", "ListTasksResultSchema", "ListToolsRequestSchema", "ListToolsResultSchema", "LoggingLevelSchema", "LoggingMessageNotificationSchema", "LoggingMessageNotificationParamsSchema", "ModelHintSchema", "ModelPreferencesSchema", "MultiSelectEnumSchemaSchema", "NotificationSchema", "NumberSchemaSchema", "PaginatedRequestSchema", "PaginatedRequestParamsSchema", "PaginatedResultSchema", "PingRequestSchema", "PrimitiveSchemaDefinitionSchema", "ProgressSchema", "ProgressNotificationSchema", "ProgressNotificationParamsSchema", "ProgressTokenSchema", "PromptSchema", "PromptArgumentSchema", "PromptListChangedNotificationSchema", "PromptMessageSchema", "PromptReferenceSchema", "ReadResourceRequestSchema", "ReadResourceRequestParamsSchema", "ReadResourceResultSchema", "RelatedTaskMetadataSchema", "RequestSchema", "RequestIdSchema", "RequestMetaSchema", "ResourceSchema", "ResourceContentsSchema", "ResourceLinkSchema", "ResourceListChangedNotificationSchema", "ResourceRequestParamsSchema", "ResourceTemplateSchema", "ResourceTemplateReferenceSchema", "ResourceUpdatedNotificationSchema", "ResourceUpdatedNotificationParamsSchema", "ResultSchema", "RoleSchema", "RootSchema", "RootsListChangedNotificationSchema", "SamplingContentSchema", "SamplingMessageSchema", "SamplingMessageContentBlockSchema", "ServerCapabilitiesSchema", "ServerNotificationSchema", "ServerRequestSchema", "ServerResultSchema", "SetLevelRequestSchema", "SetLevelRequestParamsSchema", "SingleSelectEnumSchemaSchema", "StringSchemaSchema", "SubscribeRequestSchema", "SubscribeRequestParamsSchema", "SubscriptionFilterSchema", "SubscriptionsAcknowledgedNotificationSchema", "SubscriptionsAcknowledgedNotificationParamsSchema", "SubscriptionsListenRequestSchema", "SubscriptionsListenRequestParamsSchema", "SubscriptionsListenResultSchema", "SubscriptionsListenResultMetaSchema", "TaskAugmentedRequestParamsSchema", "TaskCreationParamsSchema", "TaskMetadataSchema", "TaskSchema", "TaskStatusSchema", "TaskStatusNotificationSchema", "TaskStatusNotificationParamsSchema", "TextContentSchema", "TextResourceContentsSchema", "TitledMultiSelectEnumSchemaSchema", "TitledSingleSelectEnumSchemaSchema", "ToolSchema", "ToolAnnotationsSchema", "ToolChoiceSchema", "ToolExecutionSchema", "ToolListChangedNotificationSchema", "ToolResultContentSchema", "ToolUseContentSchema", "UnsubscribeRequestSchema", "UnsubscribeRequestParamsSchema", "UntitledMultiSelectEnumSchemaSchema", "UntitledSingleSelectEnumSchemaSchema"];
+declare const authSchemas: {
+  readonly IdJagTokenExchangeResponseSchema: z.ZodObject<{
+    issued_token_type: z.ZodLiteral<"urn:ietf:params:oauth:token-type:id-jag">;
+    access_token: z.ZodString;
+    token_type: z.ZodOptional<z.ZodString>;
+    expires_in: z.ZodOptional<z.ZodNumber>;
+    scope: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  readonly OAuthClientInformationFullSchema: z.ZodObject<{
+    redirect_uris: z.ZodArray<z.ZodURL>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    application_type: z.ZodOptional<z.ZodString>;
+    client_name: z.ZodOptional<z.ZodString>;
+    client_uri: z.ZodOptional<z.ZodURL>;
+    logo_uri: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+    scope: z.ZodOptional<z.ZodString>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    tos_uri: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+    policy_uri: z.ZodOptional<z.ZodString>;
+    jwks_uri: z.ZodOptional<z.ZodURL>;
+    jwks: z.ZodOptional<z.ZodAny>;
+    software_id: z.ZodOptional<z.ZodString>;
+    software_version: z.ZodOptional<z.ZodString>;
+    software_statement: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+    client_id_issued_at: z.ZodOptional<z.ZodNumber>;
+    client_secret_expires_at: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>;
+  readonly OAuthClientInformationSchema: z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+    client_id_issued_at: z.ZodOptional<z.ZodNumber>;
+    client_secret_expires_at: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>;
+  readonly OAuthClientMetadataSchema: z.ZodObject<{
+    redirect_uris: z.ZodArray<z.ZodURL>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    application_type: z.ZodOptional<z.ZodString>;
+    client_name: z.ZodOptional<z.ZodString>;
+    client_uri: z.ZodOptional<z.ZodURL>;
+    logo_uri: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+    scope: z.ZodOptional<z.ZodString>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    tos_uri: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+    policy_uri: z.ZodOptional<z.ZodString>;
+    jwks_uri: z.ZodOptional<z.ZodURL>;
+    jwks: z.ZodOptional<z.ZodAny>;
+    software_id: z.ZodOptional<z.ZodString>;
+    software_version: z.ZodOptional<z.ZodString>;
+    software_statement: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  readonly OAuthClientRegistrationErrorSchema: z.ZodObject<{
+    error: z.ZodString;
+    error_description: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  readonly OAuthErrorResponseSchema: z.ZodObject<{
+    error: z.ZodString;
+    error_description: z.ZodOptional<z.ZodString>;
+    error_uri: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  readonly OAuthMetadataSchema: z.ZodObject<{
+    issuer: z.ZodString;
+    authorization_endpoint: z.ZodURL;
+    token_endpoint: z.ZodURL;
+    registration_endpoint: z.ZodOptional<z.ZodURL>;
+    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    response_types_supported: z.ZodArray<z.ZodString>;
+    response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    service_documentation: z.ZodOptional<z.ZodURL>;
+    revocation_endpoint: z.ZodOptional<z.ZodURL>;
+    revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    revocation_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    introspection_endpoint: z.ZodOptional<z.ZodString>;
+    introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+    authorization_response_iss_parameter_supported: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+  }, z.core.$loose>;
+  readonly OAuthProtectedResourceMetadataSchema: z.ZodObject<{
+    resource: z.ZodString;
+    authorization_servers: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+    jwks_uri: z.ZodOptional<z.ZodString>;
+    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    bearer_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    resource_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    resource_name: z.ZodOptional<z.ZodString>;
+    resource_documentation: z.ZodOptional<z.ZodString>;
+    resource_policy_uri: z.ZodOptional<z.ZodString>;
+    resource_tos_uri: z.ZodOptional<z.ZodString>;
+    tls_client_certificate_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+    authorization_details_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    dpop_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    dpop_bound_access_tokens_required: z.ZodOptional<z.ZodBoolean>;
+  }, z.core.$loose>;
+  readonly OAuthTokenRevocationRequestSchema: z.ZodObject<{
+    token: z.ZodString;
+    token_type_hint: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  readonly OAuthTokensSchema: z.ZodObject<{
+    access_token: z.ZodString;
+    id_token: z.ZodOptional<z.ZodString>;
+    token_type: z.ZodString;
+    expires_in: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    scope: z.ZodOptional<z.ZodString>;
+    refresh_token: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  readonly OpenIdProviderDiscoveryMetadataSchema: z.ZodObject<{
+    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    issuer: z.ZodString;
+    authorization_endpoint: z.ZodURL;
+    token_endpoint: z.ZodURL;
+    userinfo_endpoint: z.ZodOptional<z.ZodURL>;
+    jwks_uri: z.ZodURL;
+    registration_endpoint: z.ZodOptional<z.ZodURL>;
+    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    response_types_supported: z.ZodArray<z.ZodString>;
+    response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    acr_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    subject_types_supported: z.ZodArray<z.ZodString>;
+    id_token_signing_alg_values_supported: z.ZodArray<z.ZodString>;
+    id_token_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    id_token_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    userinfo_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    userinfo_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    userinfo_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    request_object_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    request_object_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    request_object_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    display_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    claim_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    claims_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    service_documentation: z.ZodOptional<z.ZodString>;
+    claims_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    ui_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    claims_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+    request_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+    request_uri_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+    require_request_uri_registration: z.ZodOptional<z.ZodBoolean>;
+    op_policy_uri: z.ZodOptional<z.ZodURL>;
+    op_tos_uri: z.ZodOptional<z.ZodURL>;
+    client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+    authorization_response_iss_parameter_supported: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+  }, z.core.$strip>;
+  readonly OpenIdProviderMetadataSchema: z.ZodObject<{
+    issuer: z.ZodString;
+    authorization_endpoint: z.ZodURL;
+    token_endpoint: z.ZodURL;
+    userinfo_endpoint: z.ZodOptional<z.ZodURL>;
+    jwks_uri: z.ZodURL;
+    registration_endpoint: z.ZodOptional<z.ZodURL>;
+    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    response_types_supported: z.ZodArray<z.ZodString>;
+    response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    acr_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    subject_types_supported: z.ZodArray<z.ZodString>;
+    id_token_signing_alg_values_supported: z.ZodArray<z.ZodString>;
+    id_token_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    id_token_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    userinfo_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    userinfo_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    userinfo_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    request_object_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    request_object_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    request_object_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    display_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    claim_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    claims_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    service_documentation: z.ZodOptional<z.ZodString>;
+    claims_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    ui_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    claims_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+    request_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+    request_uri_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+    require_request_uri_registration: z.ZodOptional<z.ZodBoolean>;
+    op_policy_uri: z.ZodOptional<z.ZodURL>;
+    op_tos_uri: z.ZodOptional<z.ZodURL>;
+    client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+    authorization_response_iss_parameter_supported: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+  }, z.core.$loose>;
+};
+type ProtocolSchemaKey = (typeof SPEC_SCHEMA_KEYS)[number];
+type AuthSchemaKey = keyof typeof authSchemas;
+type SchemaKey = ProtocolSchemaKey | AuthSchemaKey;
+type SchemaFor<K$1 extends SchemaKey> = K$1 extends ProtocolSchemaKey ? (typeof schemas_d_exports)[K$1] : K$1 extends AuthSchemaKey ? (typeof authSchemas)[K$1] : never;
+type StripSchemaSuffix<K$1> = K$1 extends `${infer N}Schema` ? N : never;
+/**
+ * Union of every named type in the SDK's protocol and OAuth schemas (e.g. `'CallToolResult'`,
+ * `'ContentBlock'`, `'Tool'`, `'OAuthTokens'`). Derived from the internal Zod schemas, so it stays
+ * in sync with the spec.
+ */
+type SpecTypeName = StripSchemaSuffix<SchemaKey>;
+/**
+ * Maps each {@linkcode SpecTypeName} to its TypeScript type.
+ *
+ * `SpecTypes['Tool']` is equivalent to importing the `Tool` type directly.
+ * These validators cover the NEUTRAL model — the consumer-facing shapes with
+ * no wire-only members (`resultType`, the reserved `_meta` envelope keys).
+ * Per-revision WIRE validators are deliberately not public surface; they are
+ * planned to return as versioned `zod-schemas/<revision>` exports for
+ * consumers who validate raw wire traffic themselves.
+ */
+type SpecTypes = { [K in SchemaKey as StripSchemaSuffix<K>]: SchemaFor<K> extends z.ZodType ? z.output<SchemaFor<K>> : never };
+/**
+ * Input shape for each {@linkcode SpecTypeName}. For most types this equals {@linkcode SpecTypes},
+ * but a few schemas apply defaults/preprocessing, so the accepted input may be looser than the
+ * resulting output type.
+ */
+type SpecTypeInputs = { [K in SchemaKey as StripSchemaSuffix<K>]: SchemaFor<K> extends z.ZodType ? z.input<SchemaFor<K>> : never };
+type SchemaRecord = { readonly [K in SpecTypeName]: StandardSchemaV1Sync<SpecTypeInputs[K], SpecTypes[K]> };
+type GuardRecord = { readonly [K in SpecTypeName]: (value: unknown) => value is SpecTypeInputs[K] };
+/**
+ * Runtime validators for every MCP spec type, keyed by type name.
+ *
+ * Use this when you need to validate a spec-defined shape at a boundary the SDK does not own, for
+ * example an extension's custom-method payload that embeds a `CallToolResult`, or a value read from
+ * storage that should be a `Tool`.
+ *
+ * Each entry implements the Standard Schema interface, so it composes with any
+ * Standard-Schema-aware library. For a simple boolean check, use {@linkcode isSpecType} instead.
+ *
+ * @example
+ * ```ts source="./specTypeSchema.examples.ts#specTypeSchemas_basicUsage"
+ * const result = specTypeSchemas.CallToolResult['~standard'].validate(untrusted);
+ * if (result.issues === undefined) {
+ *     // result.value is CallToolResult
+ * }
+ * ```
+ */
+declare const specTypeSchemas: SchemaRecord;
+/**
+ * Type predicates for every MCP spec type, keyed by type name.
+ *
+ * Returns `true` if the value satisfies the schema's input type (`z.input<>`, before defaults and
+ * transforms are applied), and narrows to that input type. For schemas with `.default()` or
+ * `.preprocess()`, this may accept values that do not structurally match the named output type;
+ * for example `isSpecType.CallToolResult({})` is `true` because `content` has a default. Use
+ * `specTypeSchemas.X['~standard'].validate(value)` when you need the validated output value.
+ *
+ * Each guard is a standalone function, so it can be passed directly as a callback.
+ *
+ * @example
+ * ```ts source="./specTypeSchema.examples.ts#isSpecType_basicUsage"
+ * if (isSpecType.ContentBlock(value)) {
+ *     // value is ContentBlock
+ * }
+ *
+ * const blocks = mixed.filter(isSpecType.ContentBlock);
+ * ```
+ */
+declare const isSpecType: GuardRecord;
+//#endregion
+//#region ../core-internal/src/shared/metadataUtils.d.ts
+/**
+ * Utilities for working with {@linkcode BaseMetadata} objects.
+ */
+/**
+ * Gets the display name for an object with {@linkcode BaseMetadata}.
+ * For tools, the precedence is: `title` → {@linkcode index.ToolAnnotations | annotations}.`title` → `name`
+ * For other objects: `title` → `name`
+ * This implements the spec requirement: "if no title is provided, name should be used for display purposes"
+ */
+declare function getDisplayName(metadata: BaseMetadata | (BaseMetadata & {
+  annotations?: {
+    title?: string;
+  };
+})): string;
+//#endregion
+//#region ../core-internal/src/shared/protocolEras.d.ts
+/**
+ * Protocol-era helpers (pure module). The MCP wire protocol splits into two eras:
+ * legacy (the 2025-11-25 family and earlier; the version is negotiated via the
+ * `initialize` handshake) and modern (2026-07-28 and later; no `initialize` —
+ * servers advertise versions via `server/discover` and every request carries a
+ * `_meta` envelope).
+ *
+ * An operation that belongs to one era must only ever consult that era's subset
+ * of a supported-versions list: `initialize` never accepts or counter-offers a
+ * modern revision, and the `server/discover` advertisement only ever contains
+ * modern revisions.
+ */
+/**
+ * The protocol era of a connection: `'legacy'` for the 2025-11-25 family and
+ * earlier (negotiated via `initialize`), `'modern'` for 2026-07-28 and later
+ * (negotiated via `server/discover`; every request carries a `_meta` envelope).
+ */
+type ProtocolEra = 'legacy' | 'modern';
+//#endregion
+//#region ../core-internal/src/shared/stdio.d.ts
+declare const STDIO_DEFAULT_MAX_BUFFER_SIZE: number;
+/**
+ * Buffers a continuous stdio stream into discrete JSON-RPC messages.
+ */
+declare class ReadBuffer {
+  private _buffer?;
+  private _maxBufferSize;
+  constructor(options?: {
+    maxBufferSize?: number;
+  });
+  append(chunk: Buffer): void;
+  readMessage(): JSONRPCMessage | null;
+  clear(): void;
+}
+declare function deserializeMessage(line: string): JSONRPCMessage;
+declare function serializeMessage(message: JSONRPCMessage): string;
+//#endregion
+//#region ../core-internal/src/util/inMemory.d.ts
+/**
+ * In-memory transport for creating clients and servers that talk to each other within the same process.
+ *
+ * Intended for testing and development. For production in-process connections, use
+ * `StreamableHTTPClientTransport` against a local server URL.
+ */
+declare class InMemoryTransport implements Transport {
+  private _otherTransport?;
+  private _messageQueue;
+  private _closed;
+  onclose?: () => void;
+  onerror?: (error: Error) => void;
+  onmessage?: (message: JSONRPCMessage, extra?: {
+    authInfo?: AuthInfo;
+  }) => void;
+  sessionId?: string;
+  /**
+   * Creates a pair of linked in-memory transports that can communicate with each other. One should be passed to a {@linkcode @modelcontextprotocol/client!client/client.Client | Client} and one to a {@linkcode @modelcontextprotocol/server!server/server.Server | Server}.
+   */
+  static createLinkedPair(): [InMemoryTransport, InMemoryTransport];
+  start(): Promise<void>;
+  close(): Promise<void>;
+  /**
+   * Sends a message with optional auth info.
+   * This is useful for testing authentication scenarios.
+   */
+  send(message: JSONRPCMessage, options?: {
+    relatedRequestId?: RequestId;
+    authInfo?: AuthInfo;
+  }): Promise<void>;
+}
+//#endregion
+//#region src/server/completable.d.ts
+declare const COMPLETABLE_SYMBOL: unique symbol;
+type CompleteCallback<T extends StandardSchemaV1 = StandardSchemaV1> = (value: StandardSchemaV1.InferInput<T>, context?: {
+  arguments?: Record<string, string>;
+}) => StandardSchemaV1.InferInput<T>[] | Promise<StandardSchemaV1.InferInput<T>[]>;
+type CompletableMeta<T extends StandardSchemaV1 = StandardSchemaV1> = {
+  complete: CompleteCallback<T>;
+};
+type CompletableSchema<T extends StandardSchemaV1> = T & {
+  [COMPLETABLE_SYMBOL]: CompletableMeta<T>;
+};
+/**
+ * Wraps a schema to provide autocompletion capabilities. Useful for, e.g., prompt arguments in MCP.
+ *
+ * @example
+ * ```ts source="./completable.examples.ts#completable_basicUsage"
+ * server.registerPrompt(
+ *     'review-code',
+ *     {
+ *         title: 'Code Review',
+ *         argsSchema: z.object({
+ *             language: completable(z.string().describe('Programming language'), value =>
+ *                 ['typescript', 'javascript', 'python', 'rust', 'go'].filter(lang => lang.startsWith(value))
+ *             )
+ *         })
+ *     },
+ *     ({ language }) => ({
+ *         messages: [
+ *             {
+ *                 role: 'user' as const,
+ *                 content: {
+ *                     type: 'text' as const,
+ *                     text: `Review this ${language} code.`
+ *                 }
+ *             }
+ *         ]
+ *     })
+ * );
+ * ```
+ *
+ * @see {@linkcode server/mcp.McpServer.registerPrompt | McpServer.registerPrompt} for using completable schemas in prompt argument definitions
+ */
+declare function completable<T extends StandardSchemaV1>(schema: T, complete: CompleteCallback<T>): CompletableSchema<T>;
+/**
+ * Checks if a schema is completable (has completion metadata).
+ */
+declare function isCompletable(schema: unknown): schema is CompletableSchema<StandardSchemaV1>;
+//#endregion
+//#region src/server/middleware/hostHeaderValidation.d.ts
+type HostHeaderValidationResult = {
+  ok: true;
+  hostname: string;
+} | {
+  ok: false;
+  errorCode: 'missing_host' | 'invalid_host_header' | 'invalid_host';
+  message: string;
+  hostHeader?: string;
+  hostname?: string;
+};
+/**
+ * Parse and validate a `Host` header against an allowlist of hostnames (port-agnostic).
+ *
+ * - Input host header may include a port (e.g. `localhost:3000`) or IPv6 brackets (e.g. `[::1]:3000`).
+ * - Allowlist items should be hostnames only (no ports). For IPv6, include brackets (e.g. `[::1]`).
+ */
+declare function validateHostHeader(hostHeader: string | null | undefined, allowedHostnames: string[]): HostHeaderValidationResult;
+/**
+ * Convenience allowlist for `localhost` DNS rebinding protection.
+ */
+declare function localhostAllowedHostnames(): string[];
+/**
+ * Web-standard `Request` helper for DNS rebinding protection.
+ * @example
+ * ```ts source="./hostHeaderValidation.examples.ts#hostHeaderValidationResponse_basicUsage"
+ * const result = validateHostHeader(req.headers.get('host'), ['localhost']);
+ * ```
+ */
+declare function hostHeaderValidationResponse(req: Request, allowedHostnames: string[]): Response | undefined;
+//#endregion
+//#region src/server/middleware/originValidation.d.ts
+/**
+ * Framework-agnostic Origin header validation helpers.
+ *
+ * Browsers attach an `Origin` header to cross-origin requests; validating it
+ * against an allowlist (alongside Host header validation) protects local and
+ * development MCP servers against DNS rebinding and cross-site request
+ * forgery. The framework middleware packages (`@modelcontextprotocol/express`,
+ * `@modelcontextprotocol/hono`, `@modelcontextprotocol/fastify`,
+ * `@modelcontextprotocol/node`) wrap these helpers; use them directly when
+ * mounting a handler bare on a fetch-native runtime.
+ *
+ * Validation is deny-on-failure: a present `Origin` value that cannot be
+ * parsed (including the opaque `null` origin) is rejected, never passed
+ * through. Requests without an `Origin` header pass — non-browser MCP clients
+ * do not send one.
+ */
+type OriginValidationResult = {
+  ok: true;
+  origin?: string;
+  hostname?: string;
+} | {
+  ok: false;
+  errorCode: 'invalid_origin_header' | 'invalid_origin';
+  message: string;
+  originHeader?: string;
+  hostname?: string;
+};
+/**
+ * Validate an `Origin` header against an allowlist of hostnames (port-agnostic).
+ *
+ * - A missing/empty `Origin` header passes: non-browser clients do not send one,
+ *   and only browser-originated requests carry the header this check defends against.
+ * - Allowlist items are hostnames only (no scheme, no port), the same convention as
+ *   `validateHostHeader`. For IPv6, include brackets (e.g. `[::1]`).
+ * - Any present value that cannot be parsed as an origin URL — including the literal
+ *   `null` origin browsers send for opaque contexts — is rejected (deny on failure).
+ */
+declare function validateOriginHeader(originHeader: string | null | undefined, allowedOriginHostnames: string[]): OriginValidationResult;
+/**
+ * Convenience allowlist of localhost-class origin hostnames, mirroring
+ * `localhostAllowedHostnames`.
+ */
+declare function localhostAllowedOrigins(): string[];
+/**
+ * Web-standard `Request` helper for Origin validation: returns a `403` JSON-RPC
+ * error response when the request's `Origin` header is not allowed, and
+ * `undefined` when the request may proceed.
+ *
+ * ```ts
+ * const rejected = originValidationResponse(request, localhostAllowedOrigins());
+ * if (rejected) return rejected;
+ * ```
+ */
+declare function originValidationResponse(req: Request, allowedOriginHostnames: string[]): Response | undefined;
+//#endregion
+//#region src/server/requestStateCodec.d.ts
+/**
+ * Options for {@linkcode createRequestStateCodec}.
+ */
+interface RequestStateCodecOptions {
+  /**
+   * The HMAC secret. A `string` value is UTF-8-encoded. MUST be at least
+   * 32 bytes (256 bits) long; a `RangeError` is thrown at
+   * construction otherwise. The same key must be available to every server
+   * instance that may receive an echoed `requestState` (so a per-process
+   * random key only works when one process serves every round of a flow).
+   */
+  key: Uint8Array | string;
+  /**
+   * How long a minted `requestState` stays valid, in seconds. An echoed
+   * value past its expiry is rejected by {@linkcode RequestStateCodec.verify}.
+   * Defaults to `600` (ten minutes).
+   */
+  ttlSeconds?: number;
+  /**
+   * Optional context binding. Called at mint time and again at verify time;
+   * a `requestState` minted under one binding value is rejected when echoed
+   * under a different one. Use this to bind state to the authenticated
+   * principal and/or the originating method (the spec's user-binding MUST
+   * for state that influences authorization), for example:
+   *
+   * ```ts
+   * bind: ctx => `${ctx.mcpReq.method}\0${ctx.http?.authInfo?.clientId ?? ''}`
+   * ```
+   *
+   * The returned value is stored in the envelope as a domain-separated HMAC
+   * tag (keyed by the codec's `key`), not the raw string — so a principal
+   * identifier in the binding does not appear in the wire value the client
+   * holds.
+   *
+   * When configured, {@linkcode RequestStateCodec.mint} requires its `ctx`
+   * argument.
+   */
+  bind?: (ctx: ServerContext) => string;
+}
+/**
+ * The codec returned by {@linkcode createRequestStateCodec}: `mint` seals a
+ * JSON-serializable payload into the wire string a handler returns from
+ * `inputRequired({ requestState })`; `verify` is the function to drop into
+ * {@linkcode server/server.ServerOptions | ServerOptions}`.requestState.verify`
+ * (it throws on any failure, which the seam answers as the frozen `-32602`).
+ * The decoded payload `verify` resolves with is handed to the handler by the
+ * seam via the typed `ctx.mcpReq.requestState<T>()` accessor — `mint<T>` and
+ * `requestState<T>()` are the typed encode/read pair.
+ */
+interface RequestStateCodec<T = unknown> {
+  /**
+   * Seal `payload` into an opaque wire string. The result is what the
+   * handler returns from `inputRequired({ requestState })`.
+   *
+   * @param ctx The handler's context. Required when the codec was created
+   *            with a {@linkcode RequestStateCodecOptions.bind | bind}
+   *            callback; ignored otherwise.
+   */
+  mint(payload: T, ctx?: ServerContext): Promise<string>;
+  /**
+   * Verify an echoed `requestState` and return the original payload. Throws
+   * on any failure (bad MAC, expired, bind mismatch, malformed). The thrown
+   * message is a fixed opaque reason code (`'malformed'` / `'mac'` /
+   * `'expired'` / `'bind'`) — never the decoded payload, the binding value,
+   * or any other context-derived field.
+   *
+   * Pass this directly as `ServerOptions.requestState.verify`.
+   */
+  verify(state: string, ctx: ServerContext): Promise<T>;
+}
+/**
+ * Create an opt-in HMAC-SHA256 codec for the multi-round-trip `requestState`
+ * (protocol revision 2026-07-28).
+ *
+ * `requestState` round-trips through the client and is attacker-controlled
+ * input on re-entry. The SDK applies no protection of its own; this helper is
+ * the convenience implementation of the spec's integrity MUST so authors don't
+ * hand-roll HMAC. Wire shape:
+ *
+ *     "v1." b64url({"p":<payload>,"exp":<unixSeconds>,"b":<bindTag>?}) "." b64url(mac)
+ *
+ * where `bindTag` is `b64url(HMAC(key, "mcp.requestState.bind:" + bind(ctx))[:16])`
+ * — the binding value is never embedded raw.
+ *
+ * The codec is **signed, not encrypted**: the body is integrity-protected but
+ * the client can base64url-decode it and read the payload (`p`) in clear. Do
+ * not put secrets in the payload; use an AEAD construction if confidentiality
+ * is required. The handler reads its payload back via the typed
+ * `ctx.mcpReq.requestState<T>()` accessor — the seam has already run `verify`
+ * (integrity proven, payload decoded) by the time the handler is entered.
+ *
+ * Verification is fail-closed and constant-time (WebCrypto `subtle.verify` for
+ * the body MAC; a fixed-length XOR-accumulator compare for the bind tag).
+ * See `examples/mrtr/server.ts` for a worked end-to-end example.
+ *
+ * Design comparison (mcp.d `secureRequestState`, the peer SDK's reference
+ * implementation): mcp.d additionally offers an AES-256-GCM encrypted mode and
+ * derives independent cipher / bind-HMAC sub-keys from the operator secret via
+ * HKDF-SHA256, with an auto-generated per-process ephemeral key when none is
+ * supplied. This codec deliberately ships only the signed mode and a single
+ * keyed HMAC (domain-separated by input prefix) — HKDF sub-key derivation and
+ * an encrypted mode are intentionally out of scope for the initial release.
+ */
+declare function createRequestStateCodec<T = unknown>(options: RequestStateCodecOptions): RequestStateCodec<T>;
+//#endregion
+//#region src/server/streamableHttp.d.ts
+type StreamId = string;
+type EventId = string;
+/**
+ * Interface for resumability support via event storage
+ */
+interface EventStore {
+  /**
+   * Stores an event for later retrieval
+   * @param streamId ID of the stream the event belongs to
+   * @param message The JSON-RPC message to store
+   * @returns The generated event ID for the stored event
+   */
+  storeEvent(streamId: StreamId, message: JSONRPCMessage): Promise<EventId>;
+  /**
+   * Get the stream ID associated with a given event ID.
+   * @param eventId The event ID to look up
+   * @returns The stream ID, or `undefined` if not found
+   *
+   * Optional: If not provided, the SDK will use the `streamId` returned by
+   * {@linkcode replayEventsAfter} for stream mapping.
+   */
+  getStreamIdForEventId?(eventId: EventId): Promise<StreamId | undefined>;
+  replayEventsAfter(lastEventId: EventId, {
+    send
+  }: {
+    send: (eventId: EventId, message: JSONRPCMessage) => Promise<void>;
+  }): Promise<StreamId>;
+}
+/**
+ * Configuration options for {@linkcode WebStandardStreamableHTTPServerTransport}
+ */
+interface WebStandardStreamableHTTPServerTransportOptions {
+  /**
+   * Function that generates a session ID for the transport.
+   * The session ID SHOULD be globally unique and cryptographically secure (e.g., a securely generated UUID, a JWT, or a cryptographic hash)
+   *
+   * If not provided, session management is disabled (stateless mode).
+   */
+  sessionIdGenerator?: (() => string) | undefined;
+  /**
+   * A callback for session initialization events
+   * This is called when the server initializes a new session.
+   * Useful in cases when you need to register multiple mcp sessions
+   * and need to keep track of them.
+   * @param sessionId The generated session ID
+   */
+  onsessioninitialized?: ((sessionId: string) => void | Promise<void>) | undefined;
+  /**
+   * A callback for session close events
+   * This is called when the server closes a session due to a `DELETE` request.
+   * Useful in cases when you need to clean up resources associated with the session.
+   * Note that this is different from the transport closing, if you are handling
+   * HTTP requests from multiple nodes you might want to close each
+   * {@linkcode WebStandardStreamableHTTPServerTransport} after a request is completed while still keeping the
+   * session open/running.
+   * @param sessionId The session ID that was closed
+   */
+  onsessionclosed?: ((sessionId: string) => void | Promise<void>) | undefined;
+  /**
+   * If `true`, the server will return JSON responses instead of starting an SSE stream.
+   * This can be useful for simple request/response scenarios without streaming.
+   * Default is `false` (SSE streams are preferred).
+   */
+  enableJsonResponse?: boolean;
+  /**
+   * Event store for resumability support
+   * If provided, resumability will be enabled, allowing clients to reconnect and resume messages
+   */
+  eventStore?: EventStore;
+  /**
+   * List of allowed `Host` header values for DNS rebinding protection.
+   * If not specified, host validation is disabled.
+   * @deprecated Use external middleware for host validation instead.
+   */
+  allowedHosts?: string[];
+  /**
+   * List of allowed `Origin` header values for DNS rebinding protection.
+   * If not specified, origin validation is disabled.
+   * @deprecated Use external middleware for origin validation instead.
+   */
+  allowedOrigins?: string[];
+  /**
+   * Enable DNS rebinding protection (requires `allowedHosts` and/or `allowedOrigins` to be configured).
+   * Default is `false` for backwards compatibility.
+   * @deprecated Use external middleware for DNS rebinding protection instead.
+   */
+  enableDnsRebindingProtection?: boolean;
+  /**
+   * Retry interval in milliseconds to suggest to clients in SSE `retry` field.
+   * When set, the server will send a `retry` field in SSE priming events to control
+   * client reconnection timing for polling behavior.
+   */
+  retryInterval?: number;
+  /**
+   * List of protocol versions that this transport will accept.
+   * Used to validate the `mcp-protocol-version` header in incoming requests.
+   *
+   * Note: When using {@linkcode server/server.Server.connect | Server.connect()}, the server automatically passes its
+   * `supportedProtocolVersions` to the transport, so you typically don't need
+   * to set this option directly.
+   *
+   * @default {@linkcode SUPPORTED_PROTOCOL_VERSIONS}
+   */
+  supportedProtocolVersions?: string[];
+}
+/**
+ * Options for handling a request
+ */
+interface HandleRequestOptions {
+  /**
+   * Pre-parsed request body. If provided, the transport will use this instead of parsing `req.json()`.
+   * Useful when using body-parser middleware that has already parsed the body.
+   */
+  parsedBody?: unknown;
+  /**
+   * Authentication info from middleware. If provided, will be passed to message handlers.
+   */
+  authInfo?: AuthInfo;
+}
+/**
+ * Server transport for Web Standards Streamable HTTP: this implements the MCP Streamable HTTP transport specification
+ * using Web Standard APIs (`Request`, `Response`, `ReadableStream`).
+ *
+ * This transport works on any runtime that supports Web Standards: Node.js 18+, Cloudflare Workers, Deno, Bun, etc.
+ *
+ * In stateful mode:
+ * - Session ID is generated and included in response headers
+ * - Session ID is always included in initialization responses
+ * - Requests with invalid session IDs are rejected with `404 Not Found`
+ * - Non-initialization requests without a session ID are rejected with `400 Bad Request`
+ * - State is maintained in-memory (connections, message history)
+ *
+ * In stateless mode:
+ * - No Session ID is included in any responses
+ * - No session validation is performed
+ *
+ * @example Stateful setup
+ * ```ts source="./streamableHttp.examples.ts#WebStandardStreamableHTTPServerTransport_stateful"
+ * const server = new McpServer({ name: 'my-server', version: '1.0.0' });
+ *
+ * const transport = new WebStandardStreamableHTTPServerTransport({
+ *     sessionIdGenerator: () => crypto.randomUUID()
+ * });
+ *
+ * await server.connect(transport);
+ * ```
+ *
+ * @example Stateless setup
+ * ```ts source="./streamableHttp.examples.ts#WebStandardStreamableHTTPServerTransport_stateless"
+ * const transport = new WebStandardStreamableHTTPServerTransport({
+ *     sessionIdGenerator: undefined
+ * });
+ * ```
+ *
+ * @example Hono.js
+ * ```ts source="./streamableHttp.examples.ts#WebStandardStreamableHTTPServerTransport_hono"
+ * app.all('/mcp', async c => {
+ *     return transport.handleRequest(c.req.raw);
+ * });
+ * ```
+ *
+ * @example Cloudflare Workers
+ * ```ts source="./streamableHttp.examples.ts#WebStandardStreamableHTTPServerTransport_workers"
+ * const worker = {
+ *     async fetch(request: Request): Promise<Response> {
+ *         return transport.handleRequest(request);
+ *     }
+ * };
+ * ```
+ */
+declare class WebStandardStreamableHTTPServerTransport implements Transport {
+  private sessionIdGenerator;
+  private _started;
+  private _closed;
+  private _streamMapping;
+  private _requestToStreamMapping;
+  private _requestResponseMap;
+  private _initialized;
+  private _enableJsonResponse;
+  private _standaloneSseStreamId;
+  private _eventStore?;
+  private _onsessioninitialized?;
+  private _onsessionclosed?;
+  private _allowedHosts?;
+  private _allowedOrigins?;
+  private _enableDnsRebindingProtection;
+  private _retryInterval?;
+  private _supportedProtocolVersions;
+  sessionId?: string;
+  onclose?: () => void;
+  onerror?: (error: Error) => void;
+  onmessage?: (message: JSONRPCMessage, extra?: MessageExtraInfo) => void;
+  constructor(options?: WebStandardStreamableHTTPServerTransportOptions);
+  /**
+   * Starts the transport. This is required by the {@linkcode Transport} interface but is a no-op
+   * for the Streamable HTTP transport as connections are managed per-request.
+   */
+  start(): Promise<void>;
+  /**
+   * Sets the supported protocol versions for header validation.
+   * Called by the server during {@linkcode server/server.Server.connect | connect()} to pass its supported versions.
+   */
+  setSupportedProtocolVersions(versions: string[]): void;
+  /**
+   * Helper to create a JSON error response
+   */
+  private createJsonErrorResponse;
+  /**
+   * Validates request headers for DNS rebinding protection.
+   * @returns Error response if validation fails, `undefined` if validation passes.
+   */
+  private validateRequestHeaders;
+  /**
+   * Handles an incoming HTTP request, whether `GET`, `POST`, or `DELETE`
+   * Returns a `Response` object (Web Standard)
+   */
+  handleRequest(req: Request, options?: HandleRequestOptions): Promise<Response>;
+  /**
+   * Returns true if the client's protocol version supports empty SSE data in
+   * priming events (the fix shipped with protocol version `2025-11-25`).
+   *
+   * The version is checked for membership in this transport instance's
+   * supported protocol versions rather than with an open-ended
+   * `>= '2025-11-25'` comparison: the value may come from an `initialize`
+   * request body, which (unlike the `MCP-Protocol-Version` header) is not
+   * validated against `supportedProtocolVersions` before reaching this
+   * check. An unknown future version string must not silently enable
+   * behavior reserved for versions this transport actually supports.
+   */
+  private supportsEmptySSEData;
+  /**
+   * Writes a priming event to establish resumption capability.
+   * Only sends if `eventStore` is configured (opt-in for resumability) and
+   * the client's protocol version supports empty SSE data (a supported
+   * version that is >= `2025-11-25`).
+   */
+  private writePrimingEvent;
+  /**
+   * Handles `GET` requests for SSE stream
+   */
+  private handleGetRequest;
+  /**
+   * Replays events that would have been sent after the specified event ID
+   * Only used when resumability is enabled
+   */
+  private replayEvents;
+  /**
+   * Writes an event to an SSE stream via controller with proper formatting
+   */
+  private writeSSEEvent;
+  /**
+   * Handles unsupported requests (`PUT`, `PATCH`, etc.)
+   */
+  private handleUnsupportedRequest;
+  /**
+   * Handles `POST` requests containing JSON-RPC messages
+   */
+  private handlePostRequest;
+  /**
+   * Handles `DELETE` requests to terminate sessions
+   */
+  private handleDeleteRequest;
+  /**
+   * Validates session ID for non-initialization requests.
+   * Returns `Response` error if invalid, `undefined` otherwise
+   */
+  private validateSession;
+  /**
+   * Validates the `MCP-Protocol-Version` header on incoming requests.
+   *
+   * For initialization: Version negotiation handles unknown versions gracefully
+   * (server responds with its supported version).
+   *
+   * For subsequent requests with `MCP-Protocol-Version` header:
+   * - Accept if in supported list
+   * - 400 if unsupported
+   *
+   * For HTTP requests without the `MCP-Protocol-Version` header:
+   * - Accept and default to the version negotiated at initialization
+   */
+  private validateProtocolVersion;
+  close(): Promise<void>;
+  /**
+   * Close an SSE stream for a specific request, triggering client reconnection.
+   * Use this to implement polling behavior during long-running operations -
+   * client will reconnect after the retry interval specified in the priming event.
+   */
+  closeSSEStream(requestId: RequestId): void;
+  /**
+   * Close the standalone `GET` SSE stream, triggering client reconnection.
+   * Use this to implement polling behavior for server-initiated notifications.
+   */
+  closeStandaloneSSEStream(): void;
+  send(message: JSONRPCMessage, options?: {
+    relatedRequestId?: RequestId;
+  }): Promise<void>;
+}
+//#endregion
+//#region src/fromJsonSchema.d.ts
+declare function fromJsonSchema<T = unknown>(schema: JsonSchemaType, validator?: jsonSchemaValidator): StandardSchemaWithJSON<T, T>;
+//#endregion
+export { AjvJsonSchemaValidator, Annotations, type AnyToolHandler, AudioContent, AuthInfo, AuthorizationServerMetadata, BAGGAGE_META_KEY, BaseContext, BaseMetadata, type BaseToolCallback, BlobResourceContents, BooleanSchema, CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, type CacheHint, type CacheScope, CallToolRequest, CallToolRequestParams, CallToolResult, CancelTaskRequest, CancelTaskResult, CancelledNotification, CancelledNotificationParams, CfWorkerJsonSchemaValidator, CfWorkerSchemaDraft, ClientCapabilities, ClientContext, ClientNotification, ClientRequest, ClientResult, CompatibilityCallToolResult, type CompletableSchema, type CompleteCallback, CompleteRequest, CompleteRequestParams, CompleteRequestPrompt, CompleteRequestResourceTemplate, type CompleteResourceTemplateCallback, CompleteResult, ContentBlock, type CreateMcpHandlerOptions, CreateMessageRequest, CreateMessageRequestParams, CreateMessageRequestParamsBase, CreateMessageRequestParamsWithTools, CreateMessageResult, CreateMessageResultWithTools, CreateTaskResult, Cursor, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, DEFAULT_REQUEST_TIMEOUT_MSEC, DiscoverRequest, DiscoverResult, ElicitRequest, ElicitRequestFormParams, ElicitRequestParams, ElicitRequestURLParams, ElicitResult, ElicitationCompleteNotification, ElicitationCompleteNotificationParams, EmbeddedResource, EmptyResult, EnumSchema, type EventId, type EventStore, FetchLike, GetPromptRequest, GetPromptRequestParams, GetPromptResult, GetTaskPayloadRequest, GetTaskPayloadResult, GetTaskRequest, GetTaskResult, type HandleRequestOptions, HandlerResultTypeMap, type HostHeaderValidationResult, INTERNAL_ERROR, INVALID_PARAMS, INVALID_REQUEST, Icon, Icons, IdJagTokenExchangeResponse, ImageContent, Implementation, InMemoryServerEventBus, InMemoryTransport, type InboundClassificationOutcome, type InboundHttpRequest, type InboundLadderRejection, type InboundLegacyRoute, type InboundLegacyRouteReason, type InboundModernRoute, type InboundValidationRung, InitializeRequest, InitializeRequestParams, InitializeResult, InitializedNotification, InputRequest, InputRequests, InputRequiredResult, type InputRequiredSpec, InputResponse, type InputResponseView, InputResponses, InternalError, InvalidParamsError, InvalidRequestError, JSONArray, JSONObject, JSONRPCErrorResponse, JSONRPCMessage, JSONRPCNotification, JSONRPCRequest, JSONRPCResponse, JSONRPCResultResponse, JSONRPC_VERSION, JSONValue, JsonSchemaType, JsonSchemaValidator, JsonSchemaValidatorResult, LATEST_PROTOCOL_VERSION, LOG_LEVEL_META_KEY, type LegacyHttpHandler, LegacyTitledEnumSchema, ListChangedCallback, ListChangedHandlers, ListChangedOptions, ListPromptsRequest, ListPromptsResult, ListResourceTemplatesRequest, ListResourceTemplatesResult, type ListResourcesCallback, ListResourcesRequest, ListResourcesResult, ListRootsRequest, ListRootsResult, ListTasksRequest, ListTasksResult, ListToolsRequest, ListToolsResult, LoggingLevel, LoggingMessageNotification, LoggingMessageNotificationParams, METHOD_NOT_FOUND, type McpHandlerRequestOptions, type McpHttpHandler, type McpRequestContext, McpServer, type McpServerFactory, MessageClassification, MessageExtraInfo, MetaObject, MethodNotFoundError, MissingRequiredClientCapabilityError, MissingRequiredClientCapabilityErrorData, ModelHint, ModelPreferences, MultiSelectEnumSchema, Notification, NotificationMethod, NotificationOptions, NotificationParams, NotificationTypeMap, NumberSchema, OAuthClientInformation, OAuthClientInformationFull, OAuthClientInformationMixed, OAuthClientMetadata, OAuthClientRegistrationError, OAuthError, OAuthErrorCode, OAuthErrorResponse, OAuthMetadata, OAuthProtectedResourceMetadata, OAuthTokenRevocationRequest, OAuthTokens, OpenIdProviderDiscoveryMetadata, OpenIdProviderMetadata, type OriginValidationResult, PARSE_ERROR, PROTOCOL_VERSION_META_KEY, PaginatedRequest, PaginatedRequestParams, PaginatedResult, ParseError, PerRequestHTTPServerTransport, type PerRequestHTTPServerTransportOptions, type PerRequestMessageExtra, type PerRequestResponseMode, PingRequest, PrimitiveSchemaDefinition, Progress, ProgressCallback, ProgressNotification, ProgressNotificationParams, ProgressToken, Prompt, PromptArgument, type PromptCallback, PromptListChangedNotification, PromptMessage, PromptReference, ProtocolEra, ProtocolError, ProtocolErrorCode, ProtocolOptions, RELATED_TASK_META_KEY, ReadBuffer, type ReadResourceCallback, ReadResourceRequest, ReadResourceRequestParams, ReadResourceResult, type ReadResourceTemplateCallback, type RegisteredPrompt, type RegisteredResource, type RegisteredResourceTemplate, type RegisteredTool, RelatedTaskMetadata, Request$1 as Request, RequestHandlerSchemas, RequestId, RequestMeta, RequestMetaEnvelope, RequestMetaObject, RequestMethod, RequestOptions, RequestParams, RequestStateAccessor, type RequestStateCodec, type RequestStateCodecOptions, RequestTypeMap, Resource, ResourceContents, ResourceLink, ResourceListChangedNotification, type ResourceMetadata, ResourceNotFoundError, ResourceRequestParams, ResourceTemplate, ResourceTemplateReference, ResourceTemplateType, ResourceUpdatedNotification, ResourceUpdatedNotificationParams, Result, ResultTypeMap, Role, Root, RootsListChangedNotification, STDIO_DEFAULT_MAX_BUFFER_SIZE, SUBSCRIPTION_ID_META_KEY, SUPPORTED_PROTOCOL_VERSIONS, SamplingContent, SamplingMessage, SamplingMessageContentBlock, SdkError, SdkErrorCode, SdkHttpError, SdkHttpErrorData, Server, ServerCapabilities, ServerContext, type ServerEvent, type ServerEventBus, ServerNotification, type ServerNotifier, type ServerOptions, ServerRequest, ServerResult, SetLevelRequest, SetLevelRequestParams, SingleSelectEnumSchema, SpecTypeName, SpecTypes, StandardSchemaV1, StandardSchemaV1Sync, StandardSchemaWithJSON, StoredOAuthClientInformation, StoredOAuthTokens, type StreamId, StringSchema, SubscribeRequest, SubscribeRequestParams, SubscriptionFilter, SubscriptionsAcknowledgedNotification, SubscriptionsAcknowledgedNotificationParams, SubscriptionsListenRequest, SubscriptionsListenRequestParams, SubscriptionsListenResult, SubscriptionsListenResultMeta, TRACEPARENT_META_KEY, TRACESTATE_META_KEY, Task, TaskAugmentedRequestParams, TaskCreationParams, TaskMetadata, TaskStatus, TaskStatusNotification, TaskStatusNotificationParams, TextContent, TextResourceContents, TitledMultiSelectEnumSchema, TitledSingleSelectEnumSchema, Tool, ToolAnnotations, type ToolCallback, ToolChoice, ToolExecution, ToolListChangedNotification, ToolResultContent, ToolUseContent, Transport, TransportSendOptions, UnsubscribeRequest, UnsubscribeRequestParams, UnsupportedProtocolVersionError, UnsupportedProtocolVersionErrorData, UntitledMultiSelectEnumSchema, UntitledSingleSelectEnumSchema, UriTemplate, UrlElicitationRequiredError, Variables, WebStandardStreamableHTTPServerTransport, type WebStandardStreamableHTTPServerTransportOptions, acceptedContent, assertCompleteRequestPrompt, assertCompleteRequestResourceTemplate, checkResourceAllowed, classifyInboundRequest, completable, createFetchWithInit, createMcpHandler, createRequestStateCodec, deserializeMessage, fromJsonSchema, getDisplayName, hostHeaderValidationResponse, inputRequired, inputResponse, isCallToolResult, isCompletable, isInitializeRequest, isInitializedNotification, isInputRequiredResult, isJSONRPCErrorResponse, isJSONRPCNotification, isJSONRPCRequest, isJSONRPCResponse, isJSONRPCResultResponse, isLegacyRequest, isSpecType, isTaskAugmentedRequestParams, jsonSchemaValidator, legacyStatelessFallback, localhostAllowedHostnames, localhostAllowedOrigins, originValidationResponse, parseJSONRPCMessage, resourceUrlFromServerUrl, serializeMessage, specTypeSchemas, validateHostHeader, validateOriginHeader };
+//# sourceMappingURL=index.d.cts.map