From 781adf16e0dbd8e59b2a04466185773f53967629 Mon Sep 17 00:00:00 2001
From: Anton Pidkuiko <105124934+antonpk1@users.noreply.github.com>
Date: Wed, 3 Dec 2025 17:21:42 +0000
Subject: [PATCH] feat: add UI resource metadata types for CSP and rendering
 config (#65)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add types for parsing `_meta.ui` field from resources/read responses:

- McpUiResourceCspSchema: CSP domain declarations (connectDomains for
  fetch/XHR/WebSocket, resourceDomains for scripts/images/fonts)
- McpUiResourceMetaSchema: Full metadata including CSP, dedicated domain
  for widget sandbox, and border preference

Hosts need these to construct CSP headers and configure iframe sandboxing.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>
---
 src/types.ts | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/src/types.ts b/src/types.ts
index d0153c0..05a936d 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -823,3 +823,38 @@ type _VerifyInitializedNotification = VerifySchemaMatches<
   typeof McpUiInitializedNotificationSchema,
   McpUiInitializedNotification
 >;
+
+// =============================================================================
+// UI Resource Metadata Types
+// =============================================================================
+
+/**
+ * Content Security Policy configuration for UI resources.
+ *
+ * Servers declare which external origins their UI needs to access.
+ * Hosts use this to enforce appropriate CSP headers.
+ */
+export const McpUiResourceCspSchema = z.object({
+  /** Origins for network requests (fetch/XHR/WebSocket). Maps to CSP connect-src */
+  connectDomains: z.array(z.string()).optional(),
+  /** Origins for static resources (images, scripts, stylesheets, fonts). Maps to CSP img-src, script-src, style-src, font-src */
+  resourceDomains: z.array(z.string()).optional(),
+});
+export type McpUiResourceCsp = z.infer<typeof McpUiResourceCspSchema>;
+
+/**
+ * UI Resource metadata for security and rendering configuration.
+ *
+ * Included in the `_meta.ui` field of UI resource content returned via `resources/read`.
+ *
+ * @see {@link McpUiResourceCspSchema} for CSP configuration
+ */
+export const McpUiResourceMetaSchema = z.object({
+  /** Content Security Policy configuration */
+  csp: McpUiResourceCspSchema.optional(),
+  /** Dedicated origin for widget sandbox */
+  domain: z.string().optional(),
+  /** Visual boundary preference - true if UI prefers a visible border */
+  prefersBorder: z.boolean().optional(),
+});
+export type McpUiResourceMeta = z.infer<typeof McpUiResourceMetaSchema>;