refactor: drop the ext-apps SDK-v1 shims now that 2.0.0 peers on SDK v2

Every site tagged `ext-apps#702` carried a workaround for ext-apps
peering on the v1 SDK while the Inspector runs v2. With 2.0.0 the
package's `AppBridge` extends the v2 `Protocol`, takes the v2 `Client`
and `Implementation` directly, and registers its list-changed forwarding
on that client with `setNotificationHandler("notifications/…", handler)`,
so:

- core/mcp/apps.ts: `getToolUiResourceUri(tool)` takes the v2 `Tool`
  without a cast; `UiMetaShape` is replaced by ext-apps' own
  `McpUiToolMeta` / `McpUiResourceMeta`, which resolve under NodeNext
  since ext-apps#705. `AppInfo.csp` / `.permissions` / `.visibility`
  take the named types too.
- core/mcp/inspectorClient.ts: `getAppRendererClient()` returns the SDK
  client itself; the Proxy that translated the 1.x schema-first
  `setNotificationHandler(Schema, handler)` into the method-string form,
  its `notificationMethodFromSchema` helper and its cached field are
  gone. `AppRendererClient` is now `Client` rather than `unknown`.
- createAppBridgeFactory.ts: `new AppBridge(client, HOST_INFO, …)` with
  no `as unknown as`; `resolveSourceUri` passes the tool straight through.
- AppRenderer.tsx: `sendToolResult(result)` — its params ARE the v2
  `CallToolResult` now.
- requestAppElicitation.ts: the double cast on the `elicitation/create`
  send goes too — v2 `Protocol.request` takes the standard `Request`
  shape, which `ElicitRequest` is. The helper itself stays: ext-apps#733
  is not in 2.0.0.
- core/mcp/extensions.ts: `MCP_APP_MIME_TYPE` re-exports ext-apps'
  `RESOURCE_MIME_TYPE` from `/app-bridge`; `UI_EXTENSION_KEY` stays
  hardcoded because `EXTENSION_ID` is still `/server`-only in 2.0.0.

Tests: the Proxy-translation test is removed with the Proxy; the
`getAppRendererClient` tests assert the real `Client` instance and that
disconnect withdraws it; the `useInspectorClient` sentinel is a real
(unconnected) `Client`. Comments that cited ext-apps 1.7.5 now cite 2.0.0
where the fact still holds (#733 still unreleased).

Closes #1745
Refs #2309

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PsmUAZ6aLUAFqenjJKSSRp
Signed-off-by: cliffhall <cliff@futurescale.com>

core/mcp/apps.ts

@@ -1,4 +1,11 @@
 import { getToolUiResourceUri } from "@modelcontextprotocol/ext-apps/app-bridge";
+import type {
+  McpUiResourceCsp,
+  McpUiResourceMeta,
+  McpUiResourcePermissions,
+  McpUiToolMeta,
+  McpUiToolVisibility,
+} from "@modelcontextprotocol/ext-apps/app-bridge";
 import type { ReadResourceResult, Tool } from "@modelcontextprotocol/client";
 
 /**
@@ -19,13 +26,7 @@ import type { ReadResourceResult, Tool } from "@modelcontextprotocol/client";
  * `@inspector/core`.
  */
 export function getAppResourceUri(tool: Tool): string | undefined {
-  // `@modelcontextprotocol/ext-apps` still peers on SDK v1, so its
-  // `getToolUiResourceUri` param is typed as the v1 `Tool`. The runtime shape
-  // this reads (`_meta.ui.resourceUri`) is identical under v2, so cast at this
-  // single boundary. TODO: drop the cast when ext-apps#702 ships a v2 peer.
-  return getToolUiResourceUri(
-    tool as Parameters<typeof getToolUiResourceUri>[0],
-  );
+  return getToolUiResourceUri(tool);
 }
 
 /**
@@ -53,10 +54,10 @@ export interface AppInfo {
   hasApp: boolean;
   toolName: string;
   resourceUri?: string;
-  visibility?: readonly string[];
+  visibility?: readonly McpUiToolVisibility[];
   /** From the UI resource's `_meta.ui` (per spec, csp/permissions/domain live on the resource, not the tool). Absent when the resource was not read. */
-  csp?: Readonly<Record<string, unknown>>;
-  permissions?: Readonly<Record<string, unknown>>;
+  csp?: Readonly<McpUiResourceCsp>;
+  permissions?: Readonly<McpUiResourcePermissions>;
   domain?: string;
   prefersBorder?: boolean;
   resourceMimeType?: string;
@@ -65,37 +66,26 @@ export interface AppInfo {
 type WithUiMeta = { _meta?: { ui?: unknown } };
 
 /**
- * Structural shape for `_meta.ui` carriers — the ext-apps package's named
- * types (`McpUiToolMeta`, `McpUiResourceMeta`) are not importable under
- * NodeNext module resolution because of an extensionless re-export in the
- * package's `.d.ts`, so we read the fields structurally instead. The values
- * pass through verbatim into {@link AppInfo}; callers can narrow them against
- * the published Zod schemas if they need strict typing.
+ * Reads a carrier's `_meta.ui` as one of ext-apps' named `_meta.ui` shapes —
+ * `McpUiToolMeta` for a tool, `McpUiResourceMeta` for a UI resource — narrowing
+ * from `unknown` so call sites don't need their own casts. Returns `undefined`
+ * unless both the carrier and its `_meta.ui` are non-null objects.
  *
- * TODO: switch to the named `McpUiToolMeta` / `McpUiResourceMeta` types once
- * upstream fixes the extensionless re-export so they resolve under NodeNext.
+ * The narrowing is structural, not validated: the fields pass through verbatim
+ * into {@link AppInfo}, and a caller that needs strict typing can parse them
+ * against the published Zod schemas (`McpUiToolMetaSchema` /
+ * `McpUiResourceMetaSchema`). Typed with the package's own names since ext-apps
+ * 2.0.0, whose declarations resolve under NodeNext (ext-apps#705) — the
+ * structural stand-in that preceded it is gone (#1745).
  */
-interface UiMetaShape {
-  visibility?: readonly string[];
-  csp?: Record<string, unknown>;
-  permissions?: Record<string, unknown>;
-  domain?: string;
-  prefersBorder?: boolean;
-}
-
-/**
- * Reads a carrier's `_meta.ui` structurally, narrowing from `unknown` so call
- * sites don't need their own casts. Returns `undefined` unless both the carrier
- * and its `_meta.ui` are non-null objects.
- */
-function readUiMeta(carrier: unknown): UiMetaShape | undefined {
+function readUiMeta<T extends McpUiToolMeta | McpUiResourceMeta>(
+  carrier: unknown,
+): T | undefined {
   const ui =
     carrier !== null && typeof carrier === "object"
       ? (carrier as WithUiMeta)._meta?.ui
       : undefined;
-  return ui !== null && typeof ui === "object"
-    ? (ui as UiMetaShape)
-    : undefined;
+  return ui !== null && typeof ui === "object" ? (ui as T) : undefined;
 }
 
 /**
@@ -149,14 +139,16 @@ export function extractAppInfo(
   if (resourceUri === undefined) {
     return { hasApp: false, toolName: tool.name };
   }
-  const toolUi = readUiMeta(tool);
+  const toolUi = readUiMeta<McpUiToolMeta>(tool);
   const content = resource && findResourceContent(resource, resourceUri);
   // Precedence is intentional: prefer the matched content block's `_meta.ui`,
   // falling back to the result-level `_meta.ui`. Per the current spec the
   // security posture (csp/permissions/domain) lives on the content block, so we
   // don't shallow-merge the two carriers — a content block that declares any
   // `ui` is treated as authoritative for all of its fields.
-  const resourceUi = readUiMeta(content) ?? readUiMeta(resource);
+  const resourceUi =
+    readUiMeta<McpUiResourceMeta>(content) ??
+    readUiMeta<McpUiResourceMeta>(resource);
   return {
     hasApp: true,
     toolName: tool.name,