chore(spec): align 2025 anchor provenance with release pin

.changeset/x-mcp-header-reject-number.md

@@ -0,0 +1,7 @@
+---
+'@modelcontextprotocol/core-internal': patch
+'@modelcontextprotocol/client': patch
+'@modelcontextprotocol/server': patch
+---
+
+`x-mcp-header` on a `number`-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type `number` are not permitted"; clients MUST exclude such tools from `tools/list`). Previously `number` was accepted only to satisfy an older conformance fixture that has since been corrected. `integer`, `string` and `boolean` are unaffected.

.github/CODEOWNERS

@@ -2,10 +2,3 @@
 
 # Default owners for everything in the repo
 * @modelcontextprotocol/typescript-sdk
-
-# Auth team owns all auth-related code
-/src/server/auth/ @modelcontextprotocol/typescript-sdk-auth
-/src/client/auth* @modelcontextprotocol/typescript-sdk-auth
-/src/shared/auth* @modelcontextprotocol/typescript-sdk-auth
-/src/examples/client/simpleOAuthClient.ts @modelcontextprotocol/typescript-sdk-auth
-/src/examples/server/demoInMemoryOAuthProvider.ts @modelcontextprotocol/typescript-sdk-auth

.github/workflows/release.yml

@@ -16,6 +16,7 @@ jobs:
             pull-requests: write
         outputs:
             hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
+            allPublished: ${{ steps.registry.outputs.allPublished }}
         steps:
             - uses: actions/checkout@v7
 
@@ -34,6 +35,11 @@ jobs:
             - name: Install dependencies
               run: pnpm install
 
+            - name: Check npm for unpublished versions
+              id: registry
+              continue-on-error: true
+              run: node scripts/check-unpublished.mjs
+
             - name: Create or update Version Packages PR
               id: changesets
               uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1
@@ -43,7 +49,8 @@ jobs:
     publish:
         name: Publish
         needs: version
-        if: needs.version.outputs.hasChangesets == 'false'
+        # Runs unless changesets are pending or the check proved every version is already on npm; a crashed check proves nothing.
+        if: needs.version.outputs.hasChangesets == 'false' && needs.version.outputs.allPublished != 'true'
         runs-on: ubuntu-latest
         environment: release
         permissions: