Merge remote-tracking branch 'origin/v2/main' into v2/fix/2071-oauth-resource-metadata

Signed-off-by: cliffhall <cliff@futurescale.com>

# Conflicts:
#	core/mcp/node/transport.ts

test-servers/src/preset-registry.ts

@@ -253,7 +253,7 @@ function resolveResourcePreset(
     case "numbered_resources":
       return createNumberedResources(Number(get("count")) || 3);
     case "mcp_app_demo_widget":
-      return createMcpAppDemoResource();
+      return createMcpAppDemoResource(get("domain") as string | undefined);
     case "choose_option_app":
       return createAppElicitationResource();
     case "rfc6570_base":

test-servers/src/test-server-fixtures.ts

@@ -1617,8 +1617,15 @@ export function createMcpAppDemoTool(): ToolDefinition {
  * `_meta.ui.csp` (no external connect/resource domains) and a sample
  * `permissions` block so `--app-info` and the host's CSP enforcement both have
  * something to read.
+ *
+ * `domain` is the spec field by which a server asks its host for a stable,
+ * dedicated origin (#2056). Omitted by default so the default opaque-origin
+ * render stays the thing this fixture exercises; pass one to drive the
+ * dedicated-origin path instead. Its *value* is not an address the Inspector
+ * serves — the spec makes the format host-dependent, and the Inspector reads
+ * any non-empty string as "give me a real origin".
  */
-export function createMcpAppDemoResource(): ResourceDefinition {
+export function createMcpAppDemoResource(domain?: string): ResourceDefinition {
   return {
     name: "mcp_app_demo_widget",
     uri: MCP_APP_DEMO_URI,
@@ -1630,6 +1637,7 @@ export function createMcpAppDemoResource(): ResourceDefinition {
         csp: { connectDomains: [], resourceDomains: [] },
         permissions: { clipboard: false },
         prefersBorder: true,
+        ...(domain ? { domain } : {}),
       },
     },
   };

test-servers/src/test-server-http.ts

@@ -83,7 +83,18 @@ export interface RecordedRequest {
   method: string;
   params?: Record<string, unknown>;
   headers?: Record<string, string>;
-  metadata?: Record<string, string>;
+  /**
+   * The request's `_meta`, recorded verbatim. Values are arbitrary JSON —
+   * objects, arrays, numbers, booleans, `null` — not just strings (#1910), so
+   * a test asserting on a structured value gets a contract that matches what
+   * the recorder actually holds.
+   *
+   * Typed as `unknown` values rather than `@inspector/core`'s
+   * `RequestMetadata`: this package compiles standalone (`tsc -p test-servers`,
+   * NodeNext, no `paths`), so it has no `@inspector/core` alias to import
+   * through.
+   */
+  metadata?: Record<string, unknown>;
   response: unknown;
   timestamp: number;
 }