fix(v1.x): preserve strict transport declaration compatibility

[patschmittdev]

Summary

Target: modelcontextprotocol/typescript-sdk:v1.x, from patschmittdev/typescript-sdk:patschmittdev-ship-mcp-sdk-fix.

This is a type-only maintenance fix based on v1.x at 12b425678a76cd54b0452a2ccf1e5dc7740f73ef. It preserves the existing body-size, batch-request, and resource-URI fixes, package metadata, and 1.30.0 source version.

• Explicitly allow undefined for Transport.onclose, onerror, onmessage, and sessionId, matching the Node Streamable HTTP accessors and allowing Server.connect(transport) under exactOptionalPropertyTypes. Preserve the generic onmessage signature.
• Replace the DOM-only HeadersInit alias in normalizeHeaders with the domain-identical Headers | [string, string][] | Record<string, string> | undefined union. This does not broaden accepted values to the array-valued records or loose tuple arrays allowed by Node's RequestInit['headers'].
• Add SDK-only ESM and CommonJS public-import fixtures, declaration-only downstream consumers, exact negative diagnostic checks, focused runtime tests, and contributor instructions.

Only five production type lines change. No runtime implementation, dependencies, ambient shims, or compiler-check bypasses change.

Related work

Addresses the v1 declaration failures reported in #2083 and #2568. #1766 addressed related transport types on the v2 line. This partially overlaps the header fix in #2570; this approach additionally resolves the transport callback mismatch, preserves the original header input domain, and tests both concerns together with strict consumers.

Validation

Fresh validation against this maintenance base, not reused results from the published 1.30.0 baseline:

• Reproduced TS2304, TS2420, and TS2379 with the unpatched packed v1.x declarations.
• npm run build with the locked TypeScript 5.6.3 toolchain. All 174 emitted JavaScript files are byte-identical to a same-platform, same-toolchain build of unpatched v1.x.
• npm run check passed on an LF export of the exact staged tree. The Windows checkout has existing CRLF-only Prettier differences; unrelated files were not reformatted.
• 493 tests across 11 transport, protocol, and HTTP hosting test files passed on each of Node 22.23.2 and Node 24.15.0, using Vitest with --maxWorkers=1.
• 16 packed-package strict consumer cells passed: Node 22/24, TypeScript 6.0.3 compiler API/7.0.2 native compiler, ESM/CJS, and Node-only/DOM libraries. Each checks public imports, Server.connect, declaration emission, a second consumer without the first source, and 19 exact invalid callback/header diagnostics (304 rejections total). Node types: 22.20.2 and 24.13.4.
• All cells use strict, exactOptionalPropertyTypes, noUncheckedIndexedAccess, verbatimModuleSyntax, and skipLibCheck: false; DOM cells also assert exact equality with the original header domain.
• Packed ESM and CJS loopback HTTP initialization, ping, session deletion, and teardown passed on Node 22 and 24.

The reusable strict runner and its invocation are documented in CONTRIBUTING.md. No merge, release, or package publication is part of this PR.

[changeset-bot]

⚠️ No Changeset found

Latest commit: f5b65c7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@modelcontextprotocol/sdk@2799

commit: f5b65c7