@guuey/mcp-apps-host 0.10.0 → 0.12.0

package/dist/card-mount.d.ts

@@ -41,6 +41,7 @@
  * from the response and never from mount material a producer inlined.
  */
 import { type McpUiResourcePayload } from "./block-ui.js";
+import type { McpUiResourceCsp } from "@modelcontextprotocol/ext-apps";
 import type { AgBlock, JsonValue } from "@silverprotocol/core";
 /**
  * Which sandbox-trust channel a mount rides. See this module's header.
@@ -77,6 +78,16 @@ export interface ResolvedViewMount {
     channel: "inline" | "ggui";
     /** The payload an mcp-ui host mounts, identical in shape for both channels. */
     resource: McpUiResourcePayload;
+    /**
+     * The server's per-resource CSP declaration (`_meta.ui.csp` on the
+     * `resources/read` result — MCP Apps SEP-1865; guuey#312), when the read
+     * path saw one. Spec-schema-validated at the reader
+     * (`declaredResourceCsp`) — never fabricated, absent = undeclared. This
+     * is the generic successor to the uri-prefix channel heuristic: hosts
+     * derive per-card sandbox CSP / tripwire filters from it
+     * (`<GuueyView>` defaults its `cspOrigins` from here).
+     */
+    csp?: McpUiResourceCsp;
 }
 /** The durable-identity arm: no mount material, only the uri to re-fetch. */
 export interface LocatorViewMount {

package/dist/card-mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"card-mount.d.ts","sourceRoot":"","sources":["../src/card-mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAA+D,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACvH,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,SAAS,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,oBAAoB,CAAC;CAChC;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,SAAS,CAAC;IACnB,4GAA4G;IAC5G,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;AAEvF;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC,GAC/C,SAAS,GAAG,SAAS,CAKvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAUhF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAKxC"}
+{"version":3,"file":"card-mount.d.ts","sourceRoot":"","sources":["../src/card-mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAA+D,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACvH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,SAAS,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,oBAAoB,CAAC;IAC/B;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAC;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,SAAS,CAAC;IACnB,4GAA4G;IAC5G,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;AAEvF;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC,GAC/C,SAAS,GAAG,SAAS,CAKvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAUhF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAKxC"}

package/dist/index.d.ts

@@ -5,7 +5,8 @@
  */
 export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultLocator, toolResultUiResource, uiLocator, type McpUiResourcePayload, } from "./block-ui.js";
 export { resolveViewMount, snapshotViewMount, toolResultViewMount, type LocatorViewMount, type ResolvedViewMount, type UiResourceReader, type ViewMount, type ViewMountChannel, } from "./card-mount.js";
-export { createMcpUiResourceReader, uiResourceChannel, type CreateMcpUiResourceReaderDeps, type McpResourceReadResult, } from "./reader.js";
+export { createMcpUiResourceReader, declaredResourceCsp, uiResourceChannel, type CreateMcpUiResourceReaderDeps, type McpResourceReadResult, } from "./reader.js";
+export type { McpUiResourceCsp } from "@modelcontextprotocol/ext-apps";
 export { asToolCallResult, createMcpUiActionRelay, unavailableToolCallResult, UI_ACTION_TOOLS, UI_ACTION_UNAVAILABLE_TEXT, UI_SEMANTIC_ACTION_TOOLS, type CreateMcpUiActionRelayDeps, type McpToolCallContent, type McpToolCallResult, type McpToolStructuredContent, type UiActionRequest, } from "./action.js";
 export { initializeResult, initialViewHostState, resourceReadResponse, RESOURCES_READ_METHOD, teardownMessage, toolCallResponse, TOOLS_CALL_METHOD, viewHostElapsed, viewHostReceive, diagnoseCspViolation, type CspViolationLike, type ViewCspDiagnosis, type ViewCspOrigins, type ViewHostBehavior, type ViewHostEffect, type ViewHostOutbound, type ViewHostPhase, type ViewHostInfo, type ViewHostState, type ViewHostTransition, type ViewRequestId, } from "./view-host-protocol.js";
 export { attachViewHost, viewDocumentHtml, type AttachViewHostConfig, type ViewCspEvents, type ViewFrameLike, type ViewHostEvents, } from "./view-host.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,0BAA0B,EAC1B,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AAIrB,YAAY,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,0BAA0B,EAC1B,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -5,7 +5,7 @@
  */
 export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultLocator, toolResultUiResource, uiLocator, } from "./block-ui.js";
 export { resolveViewMount, snapshotViewMount, toolResultViewMount, } from "./card-mount.js";
-export { createMcpUiResourceReader, uiResourceChannel, } from "./reader.js";
+export { createMcpUiResourceReader, declaredResourceCsp, uiResourceChannel, } from "./reader.js";
 export { asToolCallResult, createMcpUiActionRelay, unavailableToolCallResult, UI_ACTION_TOOLS, UI_ACTION_UNAVAILABLE_TEXT, UI_SEMANTIC_ACTION_TOOLS, } from "./action.js";
 export { initializeResult, initialViewHostState, resourceReadResponse, RESOURCES_READ_METHOD, teardownMessage, toolCallResponse, TOOLS_CALL_METHOD, viewHostElapsed, viewHostReceive, diagnoseCspViolation, } from "./view-host-protocol.js";
 export { attachViewHost, viewDocumentHtml, } from "./view-host.js";

package/dist/react.d.ts

@@ -41,7 +41,7 @@ export type { AttachViewHostConfig, ViewCspEvents, ViewFrameLike, ViewHostEvents
 export { attachSandboxPageDelivery, isSandboxProxyReady, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, type SandboxPageDeliveryConfig, } from "./sandbox-page.js";
 export type { ViewCspDiagnosis, ViewCspOrigins, ViewHostPhase } from "./view-host-protocol.js";
 export type { ResolvedViewMount, ViewMount, ViewMountChannel } from "./card-mount.js";
-export interface GuueyViewProps extends Pick<AttachViewHostConfig, "hostCapabilities" | "hostInfo" | "hostContext" | "onCallTool" | "onReadResource" | "onSizeChanged" | "negotiationTimeoutMs" | "cspOrigins" | "onCspDiagnosis"> {
+export interface GuueyViewProps extends Pick<AttachViewHostConfig, "hostCapabilities" | "hostInfo" | "hostContext" | "onCallTool" | "onUpdateModelContext" | "onReadResource" | "onSizeChanged" | "negotiationTimeoutMs" | "cspOrigins" | "onCspDiagnosis"> {
     /** The resolved card to mount (see `toolResultViewMount`/`resolveViewMount`). */
     mount: ResolvedViewMount;
     /**

package/dist/react.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAwC,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACjG,OAAO,EAAoC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzG,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC/F,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAKtF,MAAM,WAAW,cACf,SAAQ,IAAI,CACV,oBAAoB,EAClB,kBAAkB,GAClB,UAAU,GACV,aAAa,GACb,YAAY,GACZ,gBAAgB,GAChB,eAAe,GACf,sBAAsB,GACtB,YAAY,GACZ,gBAAgB,CACnB;IACD,iFAAiF;IACjF,KAAK,EAAE,iBAAiB,CAAC;IACzB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,gBAAgB,KAAK,SAAS,CAAC;CAClF;AA8CD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,CAmK1D"}
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAwC,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACjG,OAAO,EAAoC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzG,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC/F,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAKtF,MAAM,WAAW,cACf,SAAQ,IAAI,CACV,oBAAoB,EAClB,kBAAkB,GAClB,UAAU,GACV,aAAa,GACb,YAAY,GACZ,sBAAsB,GACtB,gBAAgB,GAChB,eAAe,GACf,sBAAsB,GACtB,YAAY,GACZ,gBAAgB,CACnB;IACD,iFAAiF;IACjF,KAAK,EAAE,iBAAiB,CAAC;IACzB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,gBAAgB,KAAK,SAAS,CAAC;CAClF;AA8CD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,CA0K1D"}

package/dist/react.js

@@ -124,8 +124,15 @@ export function GuueyView(props) {
         if (sandboxPageUrl !== undefined && page === undefined)
             return; // refused config — nothing mounts
         const resourceUri = mount.resource.uri;
+        // guuey#312: the resolved mount's DECLARED per-resource CSP
+        // (`_meta.ui.csp`, spec-schema-validated at the reader) is the CSP
+        // tripwire's default filter — the declaration finally doing host-side
+        // work. An explicit `cspOrigins` prop always wins; both absent keeps
+        // the tripwire inert exactly as before.
+        const cspOrigins = latest.current.hostConfig.cspOrigins ?? mount.csp;
         const detachHost = attachViewHost(frame, {
             ...latest.current.hostConfig,
+            ...(cspOrigins !== undefined ? { cspOrigins } : {}),
             resourceUri,
             onPhaseChange: (next) => {
                 setPhase(next);

package/dist/reader.d.ts

@@ -1,10 +1,40 @@
+/**
+ * The generic SEP-1865 locator reader (guuey#127): resolve a persisted
+ * `ui://` locator ({@link LocatorViewMount}) into a mountable
+ * {@link ResolvedViewMount} by ONE fresh `resources/read` over a transport
+ * the HOST supplies.
+ *
+ * The transport is a structural callable — deliberately no
+ * `@modelcontextprotocol/sdk` dependency — because hosts hold wildly
+ * different connections: a raw MCP client (ggui's `with-guuey-web` sample
+ * keeps one for guest `tools/call` relay), an authenticated platform proxy
+ * (`@guuey/agent-client`'s `createUiResourceReader` is exactly this assembly
+ * over guuey's `GET /v1/threads/:threadId/ui-resource` route), or anything
+ * else that can perform one read. The host adapts whatever client it holds.
+ *
+ * Trust rules, identical to the platform reader and now in ONE place:
+ *
+ *  - a transport deny, a miss, and a thrown transport error are all
+ *    `undefined` → the host renders its placeholder, never an error surface
+ *    (deny == miss — no oracle for which locators resolve);
+ *  - enforcement (user-ownership, tenancy, credential handling) belongs
+ *    INSIDE the transport, before any bytes come back — this assembly never
+ *    sees a credential;
+ *  - the sandbox-trust channel derives from the REQUESTED locator uri, never
+ *    from the response — a server answering with a foreign `ui://ggui/…` uri
+ *    must not steer its HTML into the ggui-CSP host page.
+ */
+import { type McpUiResourceCsp } from "@modelcontextprotocol/ext-apps";
 import type { ResolvedViewMount, ViewMountChannel } from "./card-mount.js";
 /**
  * One `resources/read` `contents[]` entry, structurally (SEP-1865). Kept a
  * separate type from {@link McpUiResourcePayload} even though the shapes
  * coincide today: this is the UNVALIDATED wire-side entry a transport hands
- * over (phase 2 grows `_meta` here — per-resource declared CSP, conformance
- * map step 3), while the payload is the narrowed thing a host mounts.
+ * over, while the payload is the narrowed thing a host mounts. `_meta` is
+ * phase 2's growth (guuey#312, conformance map step 3): the per-resource
+ * declarations (`_meta.ui.csp` — MCP Apps SEP-1865) ride here when the
+ * transport forwards them; {@link declaredResourceCsp} is the ONLY door
+ * from this open extension map into typed material.
  */
 export interface McpResourceReadResult {
     uri: string;
@@ -12,14 +42,32 @@ export interface McpResourceReadResult {
     text?: string;
     /** Base64 payload arm — hosts decode via {@link resourceHtml}. */
     blob?: string;
+    /**
+     * The entry's `_meta` as the transport saw it — an open extension map,
+     * so genuinely unknown-shaped at this boundary; never read it directly,
+     * narrow through {@link declaredResourceCsp}.
+     */
+    _meta?: unknown;
 }
+/**
+ * The server's per-resource CSP declaration from a read result's
+ * `_meta.ui.csp` (guuey#312 — the phase-2 channel `uiResourceChannel`'s
+ * docs promised). Validated against the SPEC's own schema
+ * (`McpUiResourceCspSchema` from `@modelcontextprotocol/ext-apps`), never
+ * a hand-rolled mirror. Malformed or absent → `undefined` — an undeclared
+ * resource is the secure default (consumers only ever use a declaration to
+ * build allowances; absence widens nothing).
+ */
+export declare function declaredResourceCsp(entry: McpResourceReadResult): McpUiResourceCsp | undefined;
 /**
  * Phase-1 sandbox-trust channel resolution (conformance map, retirement
  * step 3): a `ui://ggui/…` locator mounts through the ggui-CSP host page
  * (`"ggui"` — the shell boots ggui's runtime bundle and opens its WSS),
  * anything else through the self-only page (`"inline"` — arbitrary tenant
- * HTML). Retired when servers declare runtime/ws origins per resource
- * (`_meta.ui.csp` on the read result); until then the uri prefix is the only
+ * HTML). The declaration itself ships (guuey#312 — `ResolvedViewMount.csp`
+ * via {@link declaredResourceCsp}); this heuristic retires when hosts route
+ * SANDBOX TRUST from that declaration too (per-card CSP construction, the
+ * conformance map's step-3 second half). Until then the uri prefix is the only
  * signal a host has BEFORE fetching mount material.
  */
 export declare function uiResourceChannel(resourceUri: string): Exclude<ViewMountChannel, "locator">;

package/dist/reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reader.d.ts","sourceRoot":"","sources":["../src/reader.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAE3F;AAED,oFAAoF;AACpF,MAAM,WAAW,6BAA6B;IAC5C;;;;OAIG;IACH,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;CAC3E;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,6BAA6B,GAClC,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAsBjE"}
+{"version":3,"file":"reader.d.ts","sourceRoot":"","sources":["../src/reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAE/F,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE3E;;;;;;;;;GASG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,GAAG,gBAAgB,GAAG,SAAS,CAW9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAE3F;AAED,oFAAoF;AACpF,MAAM,WAAW,6BAA6B;IAC5C;;;;OAIG;IACH,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;CAC3E;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,6BAA6B,GAClC,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CA+BjE"}

package/dist/reader.js

@@ -1,10 +1,60 @@
+/**
+ * The generic SEP-1865 locator reader (guuey#127): resolve a persisted
+ * `ui://` locator ({@link LocatorViewMount}) into a mountable
+ * {@link ResolvedViewMount} by ONE fresh `resources/read` over a transport
+ * the HOST supplies.
+ *
+ * The transport is a structural callable — deliberately no
+ * `@modelcontextprotocol/sdk` dependency — because hosts hold wildly
+ * different connections: a raw MCP client (ggui's `with-guuey-web` sample
+ * keeps one for guest `tools/call` relay), an authenticated platform proxy
+ * (`@guuey/agent-client`'s `createUiResourceReader` is exactly this assembly
+ * over guuey's `GET /v1/threads/:threadId/ui-resource` route), or anything
+ * else that can perform one read. The host adapts whatever client it holds.
+ *
+ * Trust rules, identical to the platform reader and now in ONE place:
+ *
+ *  - a transport deny, a miss, and a thrown transport error are all
+ *    `undefined` → the host renders its placeholder, never an error surface
+ *    (deny == miss — no oracle for which locators resolve);
+ *  - enforcement (user-ownership, tenancy, credential handling) belongs
+ *    INSIDE the transport, before any bytes come back — this assembly never
+ *    sees a credential;
+ *  - the sandbox-trust channel derives from the REQUESTED locator uri, never
+ *    from the response — a server answering with a foreign `ui://ggui/…` uri
+ *    must not steer its HTML into the ggui-CSP host page.
+ */
+import { McpUiResourceCspSchema } from "@modelcontextprotocol/ext-apps";
+/**
+ * The server's per-resource CSP declaration from a read result's
+ * `_meta.ui.csp` (guuey#312 — the phase-2 channel `uiResourceChannel`'s
+ * docs promised). Validated against the SPEC's own schema
+ * (`McpUiResourceCspSchema` from `@modelcontextprotocol/ext-apps`), never
+ * a hand-rolled mirror. Malformed or absent → `undefined` — an undeclared
+ * resource is the secure default (consumers only ever use a declaration to
+ * build allowances; absence widens nothing).
+ */
+export function declaredResourceCsp(entry) {
+    const meta = entry._meta;
+    if (typeof meta !== "object" || meta === null || Array.isArray(meta) || !("ui" in meta)) {
+        return undefined;
+    }
+    const ui = meta.ui;
+    if (typeof ui !== "object" || ui === null || Array.isArray(ui) || !("csp" in ui)) {
+        return undefined;
+    }
+    const parsed = McpUiResourceCspSchema.safeParse(ui.csp);
+    return parsed.success ? parsed.data : undefined;
+}
 /**
  * Phase-1 sandbox-trust channel resolution (conformance map, retirement
  * step 3): a `ui://ggui/…` locator mounts through the ggui-CSP host page
  * (`"ggui"` — the shell boots ggui's runtime bundle and opens its WSS),
  * anything else through the self-only page (`"inline"` — arbitrary tenant
- * HTML). Retired when servers declare runtime/ws origins per resource
- * (`_meta.ui.csp` on the read result); until then the uri prefix is the only
+ * HTML). The declaration itself ships (guuey#312 — `ResolvedViewMount.csp`
+ * via {@link declaredResourceCsp}); this heuristic retires when hosts route
+ * SANDBOX TRUST from that declaration too (per-card CSP construction, the
+ * conformance map's step-3 second half). Until then the uri prefix is the only
  * signal a host has BEFORE fetching mount material.
  */
 export function uiResourceChannel(resourceUri) {
@@ -40,6 +90,15 @@ export function createMcpUiResourceReader(deps) {
             ...(typeof entry.text === "string" ? { text: entry.text } : {}),
             ...(typeof entry.blob === "string" ? { blob: entry.blob } : {}),
         };
-        return { channel: uiResourceChannel(resourceUri), resource };
+        // guuey#312: the per-resource CSP declaration rides the resolved mount
+        // when the wire carried one — hosts build per-card allowances from the
+        // DECLARATION, never from the uri prefix. Absent = undeclared (secure
+        // default); never fabricated.
+        const csp = declaredResourceCsp(entry);
+        return {
+            channel: uiResourceChannel(resourceUri),
+            resource,
+            ...(csp !== undefined ? { csp } : {}),
+        };
     };
 }

package/dist/view-host-protocol.d.ts

@@ -45,6 +45,15 @@ export interface ViewHostInfo {
 }
 /** The standard MCP method a view uses to reach host-proxied tools. */
 export declare const TOOLS_CALL_METHOD = "tools/call";
+/**
+ * The spec method a view uses to push a model-context snapshot at its host
+ * (`McpUiUpdateModelContextRequest`). A local constant — the ext-apps root
+ * exports the TYPE but no method constant for it (guuey#335). Producers
+ * (ggui context-observer) fire it on slot changes as a COMPLEMENT to the
+ * action path; the choice itself always rides tools/call or the live
+ * channel ("Actions drive turns; context observes state").
+ */
+export declare const UPDATE_MODEL_CONTEXT_METHOD = "ui/update-model-context";
 /**
  * The standard MCP method a view uses to read host-proxied resources —
  * `ReadResourceRequest` in the spec's App→Host request union
@@ -128,6 +137,19 @@ export type ViewHostEffect = {
     kind: "relay-resource-read";
     id: ViewRequestId;
     uri: string;
+} | {
+    /**
+     * A `ui/update-model-context` snapshot to hand the embedder
+     * (guuey#335). The machine already ANSWERED the view (success — the
+     * spec result is empty), so this effect is pure delivery: a throwing
+     * sink can never leave the view hanging. Only emitted when
+     * {@link ViewHostBehavior.modelContextSink} is true — unwired, the
+     * machine refuses in-band like every other unsupported request.
+     */
+    kind: "model-context-update";
+    params: {
+        [key: string]: unknown;
+    };
 } | {
     /**
      * The view reported its content size (`ui/notifications/size-changed`
@@ -161,6 +183,8 @@ export interface ViewHostBehavior {
     hostContext: McpUiHostContext;
     /** Whether a `tools/call` relay hook is wired (see `view-host.ts`). */
     toolRelay: boolean;
+    /** Whether a model-context sink is wired (see `view-host.ts`, guuey#335). */
+    modelContextSink: boolean;
     /** Whether a `resources/read` relay hook is wired (see `view-host.ts`). */
     resourceRelay: boolean;
 }

package/dist/view-host-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"view-host-protocol.d.ts","sourceRoot":"","sources":["../src/view-host-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAStD,2CAA2C;AAC3C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;AAEzE,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAEpD;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GAC9C;IACE;;;;;;OAMG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,EAAE,EAAE,aAAa,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GACD;IACE;;;;;;;OAOG;IACH,IAAI,EAAE,qBAAqB,CAAC;IAC5B,EAAE,EAAE,aAAa,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE;;;;;;;;OAQG;IACH,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,+DAA+D;IAC/D,WAAW,EAAE,gBAAgB,CAAC;IAC9B,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAiCD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,wBAAwB,EAAE,OAAO,GAChC,qBAAqB,CAcvB;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACjC,gBAAgB,CAElB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,aAAa,EACjB,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,gBAAgB,CASlB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAElD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,OAAO,GACZ,kBAAkB,CAuFpB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAEnE;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0FAA0F;IAC1F,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAyBD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,cAAc,GAAG,SAAS,GAClC,gBAAgB,GAAG,SAAS,CAqB9B"}
+{"version":3,"file":"view-host-protocol.d.ts","sourceRoot":"","sources":["../src/view-host-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAStD,2CAA2C;AAC3C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;AAEzE,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAEpD;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GAC9C;IACE;;;;;;OAMG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,EAAE,EAAE,aAAa,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GACD;IACE;;;;;;;OAOG;IACH,IAAI,EAAE,qBAAqB,CAAC;IAC5B,EAAE,EAAE,aAAa,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE;;;;;;;OAOG;IACH,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;CACpC,GACD;IACE;;;;;;;;OAQG;IACH,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,+DAA+D;IAC/D,WAAW,EAAE,gBAAgB,CAAC;IAC9B,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;IACnB,6EAA6E;IAC7E,gBAAgB,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAiCD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,wBAAwB,EAAE,OAAO,GAChC,qBAAqB,CAcvB;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACjC,gBAAgB,CAElB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,aAAa,EACjB,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,gBAAgB,CASlB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAElD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,OAAO,GACZ,kBAAkB,CAuGpB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAEnE;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0FAA0F;IAC1F,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAyBD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,cAAc,GAAG,SAAS,GAClC,gBAAgB,GAAG,SAAS,CAqB9B"}

package/dist/view-host-protocol.js

@@ -36,6 +36,15 @@ import { INITIALIZE_METHOD, LATEST_PROTOCOL_VERSION, RESOURCE_TEARDOWN_METHOD, S
 const METHOD_NOT_SUPPORTED = -32601;
 /** The standard MCP method a view uses to reach host-proxied tools. */
 export const TOOLS_CALL_METHOD = "tools/call";
+/**
+ * The spec method a view uses to push a model-context snapshot at its host
+ * (`McpUiUpdateModelContextRequest`). A local constant — the ext-apps root
+ * exports the TYPE but no method constant for it (guuey#335). Producers
+ * (ggui context-observer) fire it on slot changes as a COMPLEMENT to the
+ * action path; the choice itself always rides tools/call or the live
+ * channel ("Actions drive turns; context observes state").
+ */
+export const UPDATE_MODEL_CONTEXT_METHOD = "ui/update-model-context";
 /**
  * The standard MCP method a view uses to read host-proxied resources —
  * `ReadResourceRequest` in the spec's App→Host request union
@@ -192,6 +201,20 @@ export function viewHostReceive(state, behavior, data) {
         }
         // fall through: a nameless tools/call is not a call we can relay.
     }
+    if (req.method === UPDATE_MODEL_CONTEXT_METHOD && behavior.modelContextSink) {
+        // Answer success FIRST-class (the spec result is empty) and hand the
+        // params to the sink as an effect. Producers fire-and-forget this
+        // method (ggui swallows failures), but answering honestly keeps any
+        // strict producer green — and the sink gets the snapshot either way.
+        const params = isPlainObject(req.params) ? req.params : {};
+        return {
+            state,
+            effects: [
+                { kind: "respond", message: { jsonrpc: "2.0", id: req.id, result: {} } },
+                { kind: "model-context-update", params },
+            ],
+        };
+    }
     if (req.method === RESOURCES_READ_METHOD && behavior.resourceRelay) {
         const uri = req.params?.["uri"];
         if (typeof uri === "string") {
@@ -203,6 +226,7 @@ export function viewHostReceive(state, behavior, data) {
         INITIALIZE_METHOD,
         ...(behavior.toolRelay ? [TOOLS_CALL_METHOD] : []),
         ...(behavior.resourceRelay ? [RESOURCES_READ_METHOD] : []),
+        ...(behavior.modelContextSink ? [UPDATE_MODEL_CONTEXT_METHOD] : []),
     ];
     return {
         state,

package/dist/view-host.d.ts

@@ -95,6 +95,20 @@ export interface AttachViewHostConfig {
      * owns allowlisting and validation (`createMcpUiActionRelay` does both).
      */
     onCallTool?: (request: UiActionRequest) => Promise<McpToolCallResult>;
+    /**
+     * Sink for `ui/update-model-context` snapshots (guuey#335): the view
+     * pushes its context state (e.g. ggui slot values) for the model's
+     * FUTURE turns. Wiring it makes the host ANSWER the method (empty
+     * result, per spec) instead of `method_not_supported`, and advertises
+     * `updateModelContext` (an explicit `hostCapabilities` entry still
+     * wins). The machine answers BEFORE delivery — a throwing sink never
+     * leaves the view hanging. Producers treat this channel as a COMPLEMENT
+     * to the action path (the choice itself rides tools/call / the live
+     * channel), so a sink that only records is honest.
+     */
+    onUpdateModelContext?: (params: {
+        [key: string]: unknown;
+    }) => void;
     /**
      * The mounted resource's `ui://` locator — the scope stamped on every
      * relayed {@link UiActionRequest}. Required for the relay to fire;

package/dist/view-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"view-host.d.ts","sourceRoot":"","sources":["../src/view-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EAGnB,KAAK,aAAa,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAC9F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE;QAAE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CACd,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAC5D,IAAI,CAAC;IACR,mBAAmB,CACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAC5D,IAAI,CAAC;CACT;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,gBAAgB,CAAC,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI,CAAC;IACrG,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI,CAAC;CACzG;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtE;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,6DAA6D;IAC7D,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACvD,6EAA6E;IAC7E,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAoDD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,GAAE,oBAAyB,GAAG,MAAM,IAAI,CA8GlG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CAcnF"}
+{"version":3,"file":"view-host.d.ts","sourceRoot":"","sources":["../src/view-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EAGnB,KAAK,aAAa,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAC9F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE;QAAE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CACd,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAC5D,IAAI,CAAC;IACR,mBAAmB,CACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAC5D,IAAI,CAAC;CACT;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,gBAAgB,CAAC,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI,CAAC;IACrG,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI,CAAC;CACzG;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtE;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,6DAA6D;IAC7D,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACvD,6EAA6E;IAC7E,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAuDD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,GAAE,oBAAyB,GAAG,MAAM,IAAI,CAwHlG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CAcnF"}

package/dist/view-host.js

@@ -44,6 +44,7 @@ function hostContextFor(frame, config) {
 function behaviorFor(frame, config) {
     const relayWired = config.onCallTool !== undefined && config.resourceUri !== undefined;
     const readWired = config.onReadResource !== undefined;
+    const contextSinkWired = config.onUpdateModelContext !== undefined;
     return {
         hostInfo: config.hostInfo ?? DEFAULT_HOST_INFO,
         hostCapabilities: {
@@ -51,11 +52,13 @@ function behaviorFor(frame, config) {
             // hostCapabilities entry still wins (the serverTools precedent).
             ...(relayWired ? { serverTools: {} } : {}),
             ...(readWired ? { serverResources: {} } : {}),
+            ...(contextSinkWired ? { updateModelContext: { text: {} } } : {}),
             ...config.hostCapabilities,
         },
         hostContext: hostContextFor(frame, config),
         toolRelay: relayWired,
         resourceRelay: readWired,
+        modelContextSink: contextSinkWired,
     };
 }
 /**
@@ -129,6 +132,17 @@ export function attachViewHost(frame, config = {}) {
                 relay(effect.id, effect.name, effect.arguments);
             else if (effect.kind === "relay-resource-read")
                 relayRead(effect.id, effect.uri);
+            else if (effect.kind === "model-context-update") {
+                // Delivery only — the machine already answered the view. Contained:
+                // a throwing embedder sink must not unwind the message pump.
+                try {
+                    config.onUpdateModelContext?.(effect.params);
+                }
+                catch {
+                    // Observer failure is the embedder's bug to notice in its own
+                    // logs; the view's contract is already satisfied.
+                }
+            }
             else {
                 config.onSizeChanged?.({
                     ...(effect.width !== undefined ? { width: effect.width } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guuey/mcp-apps-host",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "The MCP Apps (SEP-1865) Host role for guuey's chat surfaces — view-mount narrowing across UI channels, ui:// locator rehydration by resources/read, and the sandbox-trust channel contract. Vendor-neutral: any spec-following MCP App mounts through it.",
   "license": "MIT",
   "type": "module",
@@ -33,7 +33,7 @@
     }
   },
   "dependencies": {
-    "@ggui-ai/protocol": "0.9.0",
+    "@ggui-ai/protocol": "0.10.0",
     "@modelcontextprotocol/ext-apps": "^1.7.5",
     "@silverprotocol/core": "0.5.0"
   },

package/src/card-mount.ts

@@ -41,6 +41,7 @@
  * from the response and never from mount material a producer inlined.
  */
 import { snapshotUiResource, toolResultLocator, toolResultUiResource, type McpUiResourcePayload } from "./block-ui.js";
+import type { McpUiResourceCsp } from "@modelcontextprotocol/ext-apps";
 import type { AgBlock, JsonValue } from "@silverprotocol/core";
 
 /**
@@ -80,6 +81,16 @@ export interface ResolvedViewMount {
   channel: "inline" | "ggui";
   /** The payload an mcp-ui host mounts, identical in shape for both channels. */
   resource: McpUiResourcePayload;
+  /**
+   * The server's per-resource CSP declaration (`_meta.ui.csp` on the
+   * `resources/read` result — MCP Apps SEP-1865; guuey#312), when the read
+   * path saw one. Spec-schema-validated at the reader
+   * (`declaredResourceCsp`) — never fabricated, absent = undeclared. This
+   * is the generic successor to the uri-prefix channel heuristic: hosts
+   * derive per-card sandbox CSP / tripwire filters from it
+   * (`<GuueyView>` defaults its `cspOrigins` from here).
+   */
+  csp?: McpUiResourceCsp;
 }
 
 /** The durable-identity arm: no mount material, only the uri to re-fetch. */

package/src/index.ts

@@ -28,10 +28,15 @@ export {
 } from "./card-mount.js";
 export {
   createMcpUiResourceReader,
+  declaredResourceCsp,
   uiResourceChannel,
   type CreateMcpUiResourceReaderDeps,
   type McpResourceReadResult,
 } from "./reader.js";
+// The spec's own per-resource CSP type (SEP-1865 `_meta.ui.csp`) — the
+// shape of `ResolvedViewMount.csp` (guuey#312); identical to
+// `ViewCspOrigins`, re-exported under its spec name for mount consumers.
+export type { McpUiResourceCsp } from "@modelcontextprotocol/ext-apps";
 export {
   asToolCallResult,
   createMcpUiActionRelay,

package/src/react.tsx

@@ -60,6 +60,7 @@ export interface GuueyViewProps
     | "hostInfo"
     | "hostContext"
     | "onCallTool"
+    | "onUpdateModelContext"
     | "onReadResource"
     | "onSizeChanged"
     | "negotiationTimeoutMs"
@@ -236,8 +237,15 @@ export function GuueyView(props: GuueyViewProps): ReactNode {
     if (frame === null || html === undefined) return;
     if (sandboxPageUrl !== undefined && page === undefined) return; // refused config — nothing mounts
     const resourceUri = mount.resource.uri;
+    // guuey#312: the resolved mount's DECLARED per-resource CSP
+    // (`_meta.ui.csp`, spec-schema-validated at the reader) is the CSP
+    // tripwire's default filter — the declaration finally doing host-side
+    // work. An explicit `cspOrigins` prop always wins; both absent keeps
+    // the tripwire inert exactly as before.
+    const cspOrigins = latest.current.hostConfig.cspOrigins ?? mount.csp;
     const detachHost = attachViewHost(frame, {
       ...latest.current.hostConfig,
+      ...(cspOrigins !== undefined ? { cspOrigins } : {}),
       resourceUri,
       onPhaseChange: (next) => {
         setPhase(next);

package/src/reader.ts

@@ -24,6 +24,7 @@
  *    from the response — a server answering with a foreign `ui://ggui/…` uri
  *    must not steer its HTML into the ggui-CSP host page.
  */
+import { McpUiResourceCspSchema, type McpUiResourceCsp } from "@modelcontextprotocol/ext-apps";
 import type { McpUiResourcePayload } from "./block-ui.js";
 import type { ResolvedViewMount, ViewMountChannel } from "./card-mount.js";
 
@@ -31,8 +32,11 @@ import type { ResolvedViewMount, ViewMountChannel } from "./card-mount.js";
  * One `resources/read` `contents[]` entry, structurally (SEP-1865). Kept a
  * separate type from {@link McpUiResourcePayload} even though the shapes
  * coincide today: this is the UNVALIDATED wire-side entry a transport hands
- * over (phase 2 grows `_meta` here — per-resource declared CSP, conformance
- * map step 3), while the payload is the narrowed thing a host mounts.
+ * over, while the payload is the narrowed thing a host mounts. `_meta` is
+ * phase 2's growth (guuey#312, conformance map step 3): the per-resource
+ * declarations (`_meta.ui.csp` — MCP Apps SEP-1865) ride here when the
+ * transport forwards them; {@link declaredResourceCsp} is the ONLY door
+ * from this open extension map into typed material.
  */
 export interface McpResourceReadResult {
   uri: string;
@@ -40,6 +44,34 @@ export interface McpResourceReadResult {
   text?: string;
   /** Base64 payload arm — hosts decode via {@link resourceHtml}. */
   blob?: string;
+  /**
+   * The entry's `_meta` as the transport saw it — an open extension map,
+   * so genuinely unknown-shaped at this boundary; never read it directly,
+   * narrow through {@link declaredResourceCsp}.
+   */
+  _meta?: unknown;
+}
+
+/**
+ * The server's per-resource CSP declaration from a read result's
+ * `_meta.ui.csp` (guuey#312 — the phase-2 channel `uiResourceChannel`'s
+ * docs promised). Validated against the SPEC's own schema
+ * (`McpUiResourceCspSchema` from `@modelcontextprotocol/ext-apps`), never
+ * a hand-rolled mirror. Malformed or absent → `undefined` — an undeclared
+ * resource is the secure default (consumers only ever use a declaration to
+ * build allowances; absence widens nothing).
+ */
+export function declaredResourceCsp(entry: McpResourceReadResult): McpUiResourceCsp | undefined {
+  const meta = entry._meta;
+  if (typeof meta !== "object" || meta === null || Array.isArray(meta) || !("ui" in meta)) {
+    return undefined;
+  }
+  const ui: unknown = meta.ui;
+  if (typeof ui !== "object" || ui === null || Array.isArray(ui) || !("csp" in ui)) {
+    return undefined;
+  }
+  const parsed = McpUiResourceCspSchema.safeParse(ui.csp);
+  return parsed.success ? parsed.data : undefined;
 }
 
 /**
@@ -47,8 +79,10 @@ export interface McpResourceReadResult {
  * step 3): a `ui://ggui/…` locator mounts through the ggui-CSP host page
  * (`"ggui"` — the shell boots ggui's runtime bundle and opens its WSS),
  * anything else through the self-only page (`"inline"` — arbitrary tenant
- * HTML). Retired when servers declare runtime/ws origins per resource
- * (`_meta.ui.csp` on the read result); until then the uri prefix is the only
+ * HTML). The declaration itself ships (guuey#312 — `ResolvedViewMount.csp`
+ * via {@link declaredResourceCsp}); this heuristic retires when hosts route
+ * SANDBOX TRUST from that declaration too (per-card CSP construction, the
+ * conformance map's step-3 second half). Until then the uri prefix is the only
  * signal a host has BEFORE fetching mount material.
  */
 export function uiResourceChannel(resourceUri: string): Exclude<ViewMountChannel, "locator"> {
@@ -93,6 +127,15 @@ export function createMcpUiResourceReader(
       ...(typeof entry.text === "string" ? { text: entry.text } : {}),
       ...(typeof entry.blob === "string" ? { blob: entry.blob } : {}),
     };
-    return { channel: uiResourceChannel(resourceUri), resource };
+    // guuey#312: the per-resource CSP declaration rides the resolved mount
+    // when the wire carried one — hosts build per-card allowances from the
+    // DECLARATION, never from the uri prefix. Absent = undeclared (secure
+    // default); never fabricated.
+    const csp = declaredResourceCsp(entry);
+    return {
+      channel: uiResourceChannel(resourceUri),
+      resource,
+      ...(csp !== undefined ? { csp } : {}),
+    };
   };
 }

package/src/view-host-protocol.ts

@@ -60,6 +60,16 @@ const METHOD_NOT_SUPPORTED = -32601;
 /** The standard MCP method a view uses to reach host-proxied tools. */
 export const TOOLS_CALL_METHOD = "tools/call";
 
+/**
+ * The spec method a view uses to push a model-context snapshot at its host
+ * (`McpUiUpdateModelContextRequest`). A local constant — the ext-apps root
+ * exports the TYPE but no method constant for it (guuey#335). Producers
+ * (ggui context-observer) fire it on slot changes as a COMPLEMENT to the
+ * action path; the choice itself always rides tools/call or the live
+ * channel ("Actions drive turns; context observes state").
+ */
+export const UPDATE_MODEL_CONTEXT_METHOD = "ui/update-model-context";
+
 /**
  * The standard MCP method a view uses to read host-proxied resources —
  * `ReadResourceRequest` in the spec's App→Host request union
@@ -152,6 +162,18 @@ export type ViewHostEffect =
       id: ViewRequestId;
       uri: string;
     }
+  | {
+      /**
+       * A `ui/update-model-context` snapshot to hand the embedder
+       * (guuey#335). The machine already ANSWERED the view (success — the
+       * spec result is empty), so this effect is pure delivery: a throwing
+       * sink can never leave the view hanging. Only emitted when
+       * {@link ViewHostBehavior.modelContextSink} is true — unwired, the
+       * machine refuses in-band like every other unsupported request.
+       */
+      kind: "model-context-update";
+      params: { [key: string]: unknown };
+    }
   | {
       /**
        * The view reported its content size (`ui/notifications/size-changed`
@@ -186,6 +208,8 @@ export interface ViewHostBehavior {
   hostContext: McpUiHostContext;
   /** Whether a `tools/call` relay hook is wired (see `view-host.ts`). */
   toolRelay: boolean;
+  /** Whether a model-context sink is wired (see `view-host.ts`, guuey#335). */
+  modelContextSink: boolean;
   /** Whether a `resources/read` relay hook is wired (see `view-host.ts`). */
   resourceRelay: boolean;
 }
@@ -360,6 +384,21 @@ export function viewHostReceive(
     // fall through: a nameless tools/call is not a call we can relay.
   }
 
+  if (req.method === UPDATE_MODEL_CONTEXT_METHOD && behavior.modelContextSink) {
+    // Answer success FIRST-class (the spec result is empty) and hand the
+    // params to the sink as an effect. Producers fire-and-forget this
+    // method (ggui swallows failures), but answering honestly keeps any
+    // strict producer green — and the sink gets the snapshot either way.
+    const params = isPlainObject(req.params) ? req.params : {};
+    return {
+      state,
+      effects: [
+        { kind: "respond", message: { jsonrpc: "2.0", id: req.id, result: {} } },
+        { kind: "model-context-update", params },
+      ],
+    };
+  }
+
   if (req.method === RESOURCES_READ_METHOD && behavior.resourceRelay) {
     const uri = req.params?.["uri"];
     if (typeof uri === "string") {
@@ -372,6 +411,7 @@ export function viewHostReceive(
     INITIALIZE_METHOD,
     ...(behavior.toolRelay ? [TOOLS_CALL_METHOD] : []),
     ...(behavior.resourceRelay ? [RESOURCES_READ_METHOD] : []),
+    ...(behavior.modelContextSink ? [UPDATE_MODEL_CONTEXT_METHOD] : []),
   ];
   return {
     state,

package/src/view-host.ts

@@ -117,6 +117,18 @@ export interface AttachViewHostConfig {
    * owns allowlisting and validation (`createMcpUiActionRelay` does both).
    */
   onCallTool?: (request: UiActionRequest) => Promise<McpToolCallResult>;
+  /**
+   * Sink for `ui/update-model-context` snapshots (guuey#335): the view
+   * pushes its context state (e.g. ggui slot values) for the model's
+   * FUTURE turns. Wiring it makes the host ANSWER the method (empty
+   * result, per spec) instead of `method_not_supported`, and advertises
+   * `updateModelContext` (an explicit `hostCapabilities` entry still
+   * wins). The machine answers BEFORE delivery — a throwing sink never
+   * leaves the view hanging. Producers treat this channel as a COMPLEMENT
+   * to the action path (the choice itself rides tools/call / the live
+   * channel), so a sink that only records is honest.
+   */
+  onUpdateModelContext?: (params: { [key: string]: unknown }) => void;
   /**
    * The mounted resource's `ui://` locator — the scope stamped on every
    * relayed {@link UiActionRequest}. Required for the relay to fire;
@@ -207,6 +219,7 @@ function hostContextFor(frame: ViewFrameLike, config: AttachViewHostConfig): Mcp
 function behaviorFor(frame: ViewFrameLike, config: AttachViewHostConfig): ViewHostBehavior {
   const relayWired = config.onCallTool !== undefined && config.resourceUri !== undefined;
   const readWired = config.onReadResource !== undefined;
+  const contextSinkWired = config.onUpdateModelContext !== undefined;
   return {
     hostInfo: config.hostInfo ?? DEFAULT_HOST_INFO,
     hostCapabilities: {
@@ -214,11 +227,13 @@ function behaviorFor(frame: ViewFrameLike, config: AttachViewHostConfig): ViewHo
       // hostCapabilities entry still wins (the serverTools precedent).
       ...(relayWired ? { serverTools: {} } : {}),
       ...(readWired ? { serverResources: {} } : {}),
+      ...(contextSinkWired ? { updateModelContext: { text: {} } } : {}),
       ...config.hostCapabilities,
     },
     hostContext: hostContextFor(frame, config),
     toolRelay: relayWired,
     resourceRelay: readWired,
+    modelContextSink: contextSinkWired,
   };
 }
 
@@ -295,6 +310,16 @@ export function attachViewHost(frame: ViewFrameLike, config: AttachViewHostConfi
       if (effect.kind === "respond") post(effect.message);
       else if (effect.kind === "relay-tool-call") relay(effect.id, effect.name, effect.arguments);
       else if (effect.kind === "relay-resource-read") relayRead(effect.id, effect.uri);
+      else if (effect.kind === "model-context-update") {
+        // Delivery only — the machine already answered the view. Contained:
+        // a throwing embedder sink must not unwind the message pump.
+        try {
+          config.onUpdateModelContext?.(effect.params);
+        } catch {
+          // Observer failure is the embedder's bug to notice in its own
+          // logs; the view's contract is already satisfied.
+        }
+      }
       else {
         config.onSizeChanged?.({
           ...(effect.width !== undefined ? { width: effect.width } : {}),