From 781adf16e0dbd8e59b2a04466185773f53967629 Mon Sep 17 00:00:00 2001
From: Anton Pidkuiko <105124934+antonpk1@users.noreply.github.com>
Date: Wed, 3 Dec 2025 17:21:42 +0000
Subject: [PATCH 1/2] feat: add UI resource metadata types for CSP and
 rendering config (#65)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add types for parsing `_meta.ui` field from resources/read responses:

- McpUiResourceCspSchema: CSP domain declarations (connectDomains for
  fetch/XHR/WebSocket, resourceDomains for scripts/images/fonts)
- McpUiResourceMetaSchema: Full metadata including CSP, dedicated domain
  for widget sandbox, and border preference

Hosts need these to construct CSP headers and configure iframe sandboxing.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>
---
 src/types.ts | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/src/types.ts b/src/types.ts
index d0153c0..05a936d 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -823,3 +823,38 @@ type _VerifyInitializedNotification = VerifySchemaMatches<
   typeof McpUiInitializedNotificationSchema,
   McpUiInitializedNotification
 >;
+
+// =============================================================================
+// UI Resource Metadata Types
+// =============================================================================
+
+/**
+ * Content Security Policy configuration for UI resources.
+ *
+ * Servers declare which external origins their UI needs to access.
+ * Hosts use this to enforce appropriate CSP headers.
+ */
+export const McpUiResourceCspSchema = z.object({
+  /** Origins for network requests (fetch/XHR/WebSocket). Maps to CSP connect-src */
+  connectDomains: z.array(z.string()).optional(),
+  /** Origins for static resources (images, scripts, stylesheets, fonts). Maps to CSP img-src, script-src, style-src, font-src */
+  resourceDomains: z.array(z.string()).optional(),
+});
+export type McpUiResourceCsp = z.infer<typeof McpUiResourceCspSchema>;
+
+/**
+ * UI Resource metadata for security and rendering configuration.
+ *
+ * Included in the `_meta.ui` field of UI resource content returned via `resources/read`.
+ *
+ * @see {@link McpUiResourceCspSchema} for CSP configuration
+ */
+export const McpUiResourceMetaSchema = z.object({
+  /** Content Security Policy configuration */
+  csp: McpUiResourceCspSchema.optional(),
+  /** Dedicated origin for widget sandbox */
+  domain: z.string().optional(),
+  /** Visual boundary preference - true if UI prefers a visible border */
+  prefersBorder: z.boolean().optional(),
+});
+export type McpUiResourceMeta = z.infer<typeof McpUiResourceMetaSchema>;

From 8428c6877babbb430af260c17aef883b461022e9 Mon Sep 17 00:00:00 2001
From: Jonathan Hefner <jonathan@hefner.pro>
Date: Wed, 3 Dec 2025 11:22:05 -0600
Subject: [PATCH 2/2] Sync package-lock.json with package.json (#67)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add @types/bun which was missing from the lockfile.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>
---
 package-lock.json | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/package-lock.json b/package-lock.json
index f17d86e..ec8290a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18,6 +18,7 @@
         "zod": "^3.25"
       },
       "devDependencies": {
+        "@types/bun": "^1.3.2",
         "@types/react": "^19.2.2",
         "@types/react-dom": "^19.2.2",
         "concurrently": "^9.2.1",
@@ -590,6 +591,16 @@
         "@types/node": "*"
       }
     },
+    "node_modules/@types/bun": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@types/bun/-/bun-1.3.3.tgz",
+      "integrity": "sha512-ogrKbJ2X5N0kWLLFKeytG0eHDleBYtngtlbu9cyBKFtNL3cnpDZkNdQj8flVf6WTZUX5ulI9AY1oa7ljhSrp+g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "bun-types": "1.3.3"
+      }
+    },
     "node_modules/@types/chai": {
       "version": "5.2.3",
       "dev": true,
@@ -1034,6 +1045,16 @@
         "@oven/bun-windows-x64-baseline": "1.3.3"
       }
     },
+    "node_modules/bun-types": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/bun-types/-/bun-types-1.3.3.tgz",
+      "integrity": "sha512-z3Xwlg7j2l9JY27x5Qn3Wlyos8YAp0kKRlrePAOjgjMGS5IG6E7Jnlx736vH9UVI4wUICwwhC9anYL++XeOgTQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
     "node_modules/bytes": {
       "version": "3.1.2",
       "license": "MIT",