@nimblebrain/synapse 0.18.0 → 0.20.0

package/README.md

@@ -15,13 +15,13 @@ Synapse is an optional enhancement layer over `@modelcontextprotocol/ext-apps`.
 
 - **Zero-config handshake** — `await connect()` resolves when the host is ready. You never see `ui/initialize`.
 - **Typed tool calls** — call MCP tools with full TypeScript input/output types
-- **Reactive data sync** — subscribe to data change events from the agent
+- **Reactive data sync** — refresh when your server announces its data changed (`notifications/resources/list_changed`)
 - **Theme tracking** — automatic light/dark mode and custom design tokens
-- **State store** — Redux-like store with optional persistence and LLM visibility
+- **Agent context** — push what the user is looking at to the model with `useModelContext`
 - **Keyboard forwarding** — forward shortcuts from sandboxed iframes to the host
 - **Code generation** — generate TypeScript types from manifests, running servers, or JSON schemas
 
-In non-NimbleBrain hosts (Claude Desktop, VS Code, ChatGPT), NB-specific features degrade gracefully to no-ops while ext-apps baseline behavior is preserved.
+Every call checks what the host declared in `ui/initialize`. Where a capability is missing, the call does a documented thing: it sends nothing, it keeps its initial value, or it rejects with `HostCapabilityError` without sending. See [the portable-app contract](https://synapse.nimblebrain.ai/docs/concepts/degradation/).
 
 ## Why Synapse?
 
@@ -35,7 +35,7 @@ Synapse handles the plumbing so you can focus on the UI. See **[Why Synapse?](do
 npm install @nimblebrain/synapse
 ```
 
-**Peer dependency:** `@modelcontextprotocol/ext-apps@^1.3.1`
+**Peer dependencies:** `@modelcontextprotocol/ext-apps@^1.7.5`, `@modelcontextprotocol/sdk@^1.29.0`
 
 **Building a Python MCP server?** The server half — one self-contained `ui://`
 component rendered across ChatGPT, Claude, and NimbleBrain — ships as the
@@ -72,7 +72,7 @@ These are the durable decisions behind the library; they rarely change.
 - **That includes typography — the SDK ships no fonts.** Font fallbacks are
   web-safe system stacks, so an app renders correctly with no host, no network,
   and no font files. A host that wants its own typeface sends `@font-face`
-  descriptors on the theme; the library fetches nothing on its own. See
+  CSS in the host context (`styles.css.fonts`); the library fetches nothing on its own. See
   [Host fonts](#host-fonts).
 - **Theme via CSS, not React.** Components style with token-driven inline-style
   objects whose values are those `var()` refs, so theming — including light/dark —
@@ -98,32 +98,26 @@ These are the durable decisions behind the library; they rarely change.
 A CSS custom property can *name* a font family but cannot *load* one, and an app
 iframe is its own document — it inherits no `@font-face` from the host page. So a
 host that sends only tokens is naming a typeface the app has no way to render.
-`Theme.fontFaces` closes that gap: the host sends the faces alongside the
-tokens, and the SDK loads them into the app document.
+The MCP Apps spec closes that gap with `styles.css.fonts`: the host sends
+`@font-face` CSS in the host context, and the SDK loads it into the app document.
 
 ```ts
-// Host side — sent as the `synapse/fontFaces` host-context extension.
+// Host side — the hostContext of ui/initialize.
 {
-  mode: "dark",
-  tokens: { "--font-sans": "'Your Sans', system-ui, sans-serif" },
-  fontFaces: [
-    { family: "Your Sans", src: "url('/fonts/your-sans.woff2') format('woff2')", weight: "400 700" },
-  ],
+  theme: "dark",
+  styles: {
+    variables: { "--font-sans": "'Your Sans', system-ui, sans-serif" },
+    css: {
+      fonts: "@font-face { font-family: 'Your Sans'; src: url('/fonts/your-sans.woff2') format('woff2'); font-weight: 400 700; font-display: swap; }",
+    },
+  },
 }
 ```
 
-| Field | Notes |
-|---|---|
-| `family` | Must match the family named in the host's `--font-*` token value. |
-| `src` | Any CSS `src` descriptor — relative (`url('/fonts/x.woff2')`), absolute (`url('https://cdn.example/x.woff2')`), or `data:`. |
-| `weight` | Single weight (`400`) or a variable range (`400 700`). Optional. |
-| `style` | `normal`, `italic`, … Optional. |
-| `display` | Defaults to `swap`, so text paints in the fallback rather than blocking. Optional. |
-
 Three things worth knowing:
 
 - **Sending no fonts is a supported configuration, not a degraded one.** Omit
-  `fontFaces` and the app renders in the web-safe fallbacks (`system-ui` for
+  `styles.css.fonts` and the app renders in the web-safe fallbacks (`system-ui` for
   both body and headings, `ui-monospace` for code).
 - **Give every `--font-*` token value a web-safe tail.** A bare family name with
   no matching face falls through to the browser default, not to your intended
@@ -274,8 +268,9 @@ app.on("teardown", () => {
   saveState();
 });
 
-// NimbleBrain extensions work as passthrough event names
-app.on("synapse/data-changed", (params) => {
+// Any wire method works as a passthrough event name — here, your server
+// announcing that its data changed (which is what useDataSync listens for)
+app.on("notifications/resources/list_changed", (params) => {
   refreshData();
 });
 
@@ -291,8 +286,6 @@ unsub();
 | `"tool-cancelled"` | `ui/notifications/tool-cancelled` | — |
 | `"theme-changed"` | `ui/notifications/host-context-changed` | `Theme` — fires only when the theme actually moves |
 | `"host-context-changed"` | `ui/notifications/host-context-changed` | `McpUiHostContext` — every change, unfiltered |
-| `"data-changed"` | `synapse/data-changed` | `DataChangedEvent` |
-| `"action"` | `synapse/action` | `AgentAction` |
 | `"teardown"` | `ui/resource-teardown` | — |
 | Any custom string | Passed through as-is | `unknown` |
 
@@ -313,7 +306,6 @@ const app = await connect({ name: "my-app", version: "1.0.0" });
 | `name` | `string` | App name (must match registered bundle name) |
 | `version` | `string` | Semver version |
 | `autoResize` | `boolean?` | Observe `document.body` and auto-send `size-changed`. Default: `false` |
-| `internal` | `boolean?` | NimbleBrain internal app — `callTool` carries a `server` param for cross-server routing |
 | `forwardKeys` | `boolean \| KeyForwardConfig[]?` | Forward keyboard shortcuts to the host. Only a NimbleBrain host consumes them, so it stays off elsewhere. |
 | `on` | `Record<string, (data) => void>?` | Pre-register handlers before the handshake, so no early message is lost |
 
@@ -338,7 +330,7 @@ const app = await connect({ name: "my-app", version: "1.0.0" });
 | `resize(width?, height?)` | Send size to host. Auto-measures `document.body` if no args. |
 | `openLink(url)` | Open a URL (host-aware) |
 | `updateModelContext(state, summary?)` | Push LLM-visible state |
-| `callTool(name, args?, options?)` | Call an MCP tool and get typed result. `options.server` routes to a sibling server. |
+| `callTool(name, args?)` | Call a tool on this app's own MCP server and get a typed result |
 | `readServerResource({ uri })` | Read an MCP resource from the originating server |
 | `sendMessage(text, context?)` | Send a message into the agent conversation |
 | `destroy()` | Clean up all listeners, observers, and timers |
@@ -360,16 +352,22 @@ action(app, "navigate", { entity: "board", id: "b1" });
 | Function | Description |
 |----------|-------------|
 | `callToolAsTask(app, name, args?, opts?)` | Call a long-running tool task-augmented; returns a `Promise<TaskHandle>`. See [Long-running tools](#long-running-tools-tasks). |
-| `action(app, name, params?)` | Trigger a NimbleBrain host action. No-op off a NimbleBrain host. |
-| `pickFile(app, options?)` | Native file picker, single file. Throws off a NimbleBrain host. |
-| `pickFiles(app, options?)` | Native file picker, multiple files. Throws off a NimbleBrain host. |
-| `downloadFile(app, name, content, mime?)` | Hand the user a file to save. |
+| `action(app, name, params?)` | Trigger a NimbleBrain host action. No-op unless the host declares `ai.nimblebrain/action`. |
+| `pickFile(app, options?)` | Native file picker, single file. Rejects with `HostCapabilityError` unless the host declares `ai.nimblebrain/request-file`. |
+| `pickFiles(app, options?)` | Native file picker, multiple files. Rejects with `HostCapabilityError` unless the host declares `ai.nimblebrain/request-file`. |
+| `hostSupports(app, extension)` | Whether the host declared a NimbleBrain extension (`"action"`, `"requestFile"`, `"keydown"`). |
+| `downloadFile(app, name, content, mime?)` | Hand the user a file to save, over the spec's `ui/download-file`. Resolves with the host's result — `{ isError: true }` when the host declined or the user cancelled — and rejects, without sending, when the host did not advertise the `downloadFile` capability. |
 
 `app.supportsTasks` says whether the host negotiated the tasks utility for
 `tools/call`. `callToolAsTask` throws when it is false, so read it to decide
 whether to offer a long-running action at all rather than to discover the answer
 from an exception.
 
+A host advertises the capability in
+`hostCapabilities.experimental["io.modelcontextprotocol/tasks"]`, the MCP Tasks
+extension identifier, and nowhere else. A top-level `hostCapabilities.tasks` is
+not read, because a spec client's handshake parse strips it.
+
 ## React Hooks
 
 Wrap your tree in `<AppProvider>` — it takes the same options as `connect()` and
@@ -390,16 +388,13 @@ import { AppProvider, useApp, useCallTool, useTheme } from "@nimblebrain/synapse
 | `useResize()` | `(w?, h?) => void` | Resize helper — auto-measures body if no args |
 | `useCallTool(name)` | `{ call, data, isPending, error }` | Call a tool with loading/error state |
 | `useCallToolAsTask(name)` | `{ fire, task, result, error, isWorking, isTerminal, cancel }` | The full task lifecycle for a long-running tool. See below. |
-| `useDataSync(cb)` | — | Run `cb` when the agent changes data your app displays |
+| `useDataSync(cb)` | — | Run `cb` when your server announces its data changed (`notifications/resources/list_changed`); `cb` gets the notification's params |
 | `useModelContext()` | `(state, summary?) => void` | Push LLM-visible state, debounced 250ms |
 | `useModelContext(factory, deps)` | — | The same, pushed whenever `deps` change |
 | `useSendMessage()` | `(text, context?) => void` | Send a message into the agent conversation |
 | `useAction()` | `(name, params?) => void` | Trigger a NimbleBrain host action |
 | `useFileUpload()` | `{ pickFile, pickFiles, isPending }` | The host's native file picker (NB-only) |
 
-To *receive* the actions a tool emits, subscribe through the app:
-`useApp().on("action", cb)`.
-
 ## Long-running tools (tasks)
 
 For tools whose work exceeds the stock MCP request timeout (~60s) — research runs, batch imports, multi-stage analyses — use `callToolAsTask` (or `useCallToolAsTask` in React) instead of `callTool`. The host returns a `CreateTaskResult` immediately; the actual `CallToolResult` is fetched via `tasks/result` when the task reaches a terminal state.
@@ -433,7 +428,7 @@ async def start_research(query: str, ctx: Context) -> dict:
 
 `TasksExtension` is what serves the task methods; a task-enabled tool with no extension registered aborts the server at startup, before it binds. `mode="optional"` lets the same tool run inline (`callTool`) or as a task (`callToolAsTask`) — the client decides. `mode="required"` rejects a call from a client that has not negotiated the extension with JSON-RPC `-32021` (`MISSING_REQUIRED_CLIENT_CAPABILITY`), whose `data.requiredCapabilities` names the extension the client is missing.
 
-**Dual-channel pattern.** When a task creates a domain entity (a research run, an import job), the entity ID is delivered via `synapse/data-changed` / `useDataSync`, **not** the task result. The task channel signals "started / running / done / cancelled"; the entity channel carries the durable record. UIs that need to navigate to the new entity should listen on `useDataSync` rather than awaiting `result()`.
+**Dual-channel pattern.** When a task creates a domain entity (a research run, an import job), the UI learns the entity exists from the server, **not** from the task result: the server announces the write with `notifications/resources/list_changed`, and `useDataSync` re-reads the list the entity now appears in. The task channel signals "started / running / done / cancelled"; the server's data carries the durable record. UIs that need to navigate to the new entity should re-read on `useDataSync` rather than awaiting `result()`.
 
 **Capability detection.** Hosts that don't support tasks won't advertise the `tasks.requests.tools.call` capability. `callToolAsTask` throws on hosts without the capability — wrap in a try/catch and fall back to `callTool` if you want graceful degradation:
 

package/dist/check-JEM5PN64.cjs

@@ -0,0 +1,435 @@
+'use strict';
+
+var server = require('@modelcontextprotocol/ext-apps/server');
+var auth_js = require('@modelcontextprotocol/sdk/client/auth.js');
+var index_js = require('@modelcontextprotocol/sdk/client/index.js');
+var streamableHttp_js = require('@modelcontextprotocol/sdk/client/streamableHttp.js');
+var types_js = require('@modelcontextprotocol/sdk/types.js');
+
+// src/check/index.ts
+
+// src/check/profiles.ts
+var SPEC_MIME = "UI resources are served as text/html;profile=mcp-app.";
+var RESOLVES = "A tool's ui.resourceUri must name a ui:// resource the server serves.";
+var UI_META = "ui.visibility is a non-empty subset of model/app; csp and permissions belong on the resource, not the tool.";
+var EXTENSION = "A client uses MCP Apps only when both sides declare io.modelcontextprotocol/ui.";
+var CHALLENGE = "Sign-in starts from a 401 whose WWW-Authenticate carries resource_metadata.";
+var PRM_RESOURCE = "The protected-resource metadata's resource must equal the connector URL exactly.";
+var ISSUER = "The authorization server's metadata issuer must equal the advertised authorization server exactly (RFC 8414).";
+var PROFILES = {
+  nimblebrain: {
+    name: "nimblebrain",
+    description: "The NimbleBrain host.",
+    rules: {
+      "ui-resource-mime": { severity: "error", why: SPEC_MIME },
+      "tool-resource-uri": { severity: "error", why: RESOLVES },
+      "tool-ui-meta": { severity: "error", why: UI_META },
+      // The host resolves an app by its ui:// scheme and does not gate on the
+      // declaration, so a missing one is a portability risk, not a break.
+      "extension-declared": { severity: "warn", why: EXTENSION },
+      // Only reported when the server challenges at all.
+      "auth-challenge": { severity: "warn", why: CHALLENGE },
+      "auth-resource-metadata": { severity: "warn", why: PRM_RESOURCE },
+      "auth-issuer": { severity: "warn", why: ISSUER }
+    }
+  },
+  claude: {
+    name: "claude",
+    description: "claude.ai and Claude Desktop.",
+    rules: {
+      "ui-resource-mime": { severity: "error", why: SPEC_MIME },
+      "tool-resource-uri": { severity: "error", why: RESOLVES },
+      "tool-ui-meta": { severity: "error", why: UI_META },
+      "extension-declared": { severity: "error", why: EXTENSION },
+      "resource-csp": {
+        severity: "warn",
+        why: "Claude builds the frame's security policy from ui.csp; an undeclared origin is blocked."
+      },
+      "resource-data-fonts": {
+        severity: "error",
+        why: "Claude's default security policy blocks data: fonts unless the resource declares them."
+      },
+      "auth-challenge": { severity: "error", why: CHALLENGE },
+      "auth-resource-metadata": { severity: "error", why: PRM_RESOURCE },
+      // Claude has been observed to accept an issuer that differs by a trailing
+      // slash, so this is a correctness warning for Claude rather than a break.
+      "auth-issuer": { severity: "warn", why: ISSUER }
+    }
+  },
+  chatgpt: {
+    name: "chatgpt",
+    description: "ChatGPT apps.",
+    rules: {
+      "ui-resource-mime": { severity: "error", why: SPEC_MIME },
+      "tool-resource-uri": { severity: "error", why: RESOLVES },
+      "tool-ui-meta": { severity: "error", why: UI_META },
+      "extension-declared": { severity: "error", why: EXTENSION },
+      "resource-csp": {
+        severity: "error",
+        why: "ChatGPT reads the frame's security policy from ui.csp, and app submission requires it."
+      },
+      "resource-data-fonts": {
+        severity: "warn",
+        why: "A data: font is blocked by a security policy that does not declare it."
+      },
+      "auth-challenge": { severity: "error", why: CHALLENGE },
+      "auth-resource-metadata": { severity: "error", why: PRM_RESOURCE },
+      "auth-issuer": { severity: "error", why: ISSUER },
+      "tool-security-schemes": {
+        severity: "error",
+        why: "ChatGPT prompts for sign-in mid-conversation only for tools that declare securitySchemes."
+      }
+    }
+  }
+};
+function isTargetName(value) {
+  return Object.hasOwn(PROFILES, value);
+}
+
+// src/check/index.ts
+var UI_SCHEME = "ui://";
+var VISIBILITY = /* @__PURE__ */ new Set(["model", "app"]);
+async function runChecks(url, options = {}) {
+  const results = [];
+  const add = (id, status, detail) => results.push({ id, status, detail });
+  let challenge;
+  let session;
+  let connectError;
+  try {
+    session = await openSession(url, void 0, (res) => {
+      if (res.status === 401) challenge ??= res;
+    });
+  } catch (err) {
+    connectError = err;
+  }
+  const authRequired = challenge !== void 0;
+  if (authRequired && options.token) {
+    try {
+      session = await openSession(url, options.token);
+      connectError = void 0;
+    } catch (err) {
+      connectError = err;
+    }
+  }
+  if (!session && (!authRequired || options.token)) {
+    throw new Error(
+      `could not connect to ${url}${authRequired ? " with the given token" : ""}: ${message(connectError)}`
+    );
+  }
+  await checkAuth(url, challenge, add);
+  if (!session) {
+    for (const id of SESSION_CHECKS) {
+      add(id, "skip", "the server requires auth; pass --token to run it");
+    }
+    return results;
+  }
+  checkSession(session, authRequired, add);
+  return results;
+}
+function applyProfiles(results, targets) {
+  return targets.map((target) => {
+    const rules = PROFILES[target].rules;
+    const scored = results.flatMap((r) => {
+      const rule = rules[r.id];
+      return rule ? [{ ...r, severity: rule.severity, why: rule.why }] : [];
+    });
+    return {
+      target,
+      results: scored,
+      failed: scored.some((r) => r.status === "fail" && r.severity === "error")
+    };
+  });
+}
+function formatReport(url, reports) {
+  const width = Math.max(...reports.flatMap((r) => r.results.map((c) => c.id.length)), 0);
+  const lines = [`synapse check ${url}`];
+  for (const report of reports) {
+    lines.push("", `${report.target}: ${report.failed ? "FAIL" : "ok"}`);
+    for (const r of report.results) {
+      const label = r.status === "fail" ? r.severity === "error" ? "FAIL" : "WARN" : r.status.toUpperCase();
+      lines.push(`  ${label.padEnd(4)}  ${r.id.padEnd(width)}  ${r.detail}`);
+      if (r.status === "fail") lines.push(`        ${"".padEnd(width)}  ${r.why}`);
+    }
+  }
+  return lines.join("\n");
+}
+var SESSION_CHECKS = [
+  "extension-declared",
+  "ui-resource-mime",
+  "tool-resource-uri",
+  "tool-ui-meta",
+  "resource-csp",
+  "resource-data-fonts",
+  "tool-security-schemes"
+];
+async function openSession(url, token, onResponse) {
+  const ui = { mimeTypes: [server.RESOURCE_MIME_TYPE] };
+  const client = new index_js.Client(
+    { name: "synapse-check", version: "1" },
+    { capabilities: { extensions: { [server.EXTENSION_ID]: ui } } }
+  );
+  const transport = new streamableHttp_js.StreamableHTTPClientTransport(new URL(url), {
+    requestInit: token ? { headers: { Authorization: `Bearer ${token}` } } : void 0,
+    fetch: async (input, init) => {
+      const res = await fetch(input, init);
+      onResponse?.(res);
+      return res;
+    }
+  });
+  await client.connect(transport);
+  try {
+    const capabilities = client.getServerCapabilities();
+    const tools = [];
+    const resources = [];
+    let cursor;
+    if (capabilities?.tools) {
+      do {
+        const raw = await client.request(
+          { method: "tools/list", params: cursor ? { cursor } : {} },
+          types_js.ResultSchema
+        );
+        const page = types_js.ListToolsResultSchema.parse(raw);
+        const rawTools = raw.tools ?? [];
+        page.tools.forEach((tool, i) => {
+          const schemes = rawTools[i]?.securitySchemes;
+          if (schemes !== void 0) tool.securitySchemes = schemes;
+        });
+        tools.push(...page.tools);
+        cursor = page.nextCursor;
+      } while (cursor);
+    }
+    if (capabilities?.resources) {
+      do {
+        const page = await client.listResources({ cursor });
+        resources.push(...page.resources);
+        cursor = page.nextCursor;
+      } while (cursor);
+    }
+    const uris = new Set(resources.map((r) => r.uri).filter((u) => u.startsWith(UI_SCHEME)));
+    for (const tool of tools) {
+      const uri = toolUi(tool)?.resourceUri;
+      if (typeof uri === "string") uris.add(uri);
+    }
+    const reads = /* @__PURE__ */ new Map();
+    for (const uri of uris) {
+      try {
+        reads.set(uri, (await client.readResource({ uri })).contents);
+      } catch (err) {
+        reads.set(uri, err instanceof Error ? err : new Error(String(err)));
+      }
+    }
+    return { capabilities, tools, resources, reads };
+  } finally {
+    await client.close();
+  }
+}
+function checkSession(s, authRequired, add) {
+  const boundTools = s.tools.filter((t) => toolUi(t)?.resourceUri !== void 0);
+  const uiResources = s.resources.filter((r) => r.uri.startsWith(UI_SCHEME));
+  const hasUi = boundTools.length > 0 || uiResources.length > 0 || s.tools.some(legacyBinding);
+  if (!hasUi) {
+    for (const id of SESSION_CHECKS) {
+      if (id !== "tool-security-schemes") add(id, "skip", "the server exposes no UI");
+    }
+  } else {
+    const declared = s.capabilities?.extensions?.[server.EXTENSION_ID] !== void 0;
+    add(
+      "extension-declared",
+      declared ? "pass" : "fail",
+      declared ? `${server.EXTENSION_ID} is declared` : `the server does not declare ${server.EXTENSION_ID} in capabilities.extensions`
+    );
+    const wrongMime = [];
+    for (const r of uiResources) {
+      if (r.mimeType !== void 0 && r.mimeType !== server.RESOURCE_MIME_TYPE) {
+        wrongMime.push(`${r.uri} is listed as ${r.mimeType}`);
+      }
+    }
+    for (const [uri, contents] of s.reads) {
+      if (contents instanceof Error) continue;
+      for (const c of contents) {
+        if (c.mimeType !== server.RESOURCE_MIME_TYPE) {
+          wrongMime.push(`${uri} is served as ${c.mimeType ?? "no MIME type"}`);
+        }
+      }
+    }
+    add(
+      "ui-resource-mime",
+      wrongMime.length ? "fail" : "pass",
+      wrongMime.length ? `${wrongMime.join("; ")}; expected ${server.RESOURCE_MIME_TYPE}` : `every ui:// resource is ${server.RESOURCE_MIME_TYPE}`
+    );
+    const unresolved = [];
+    for (const tool of s.tools) {
+      const uri = toolUi(tool)?.resourceUri;
+      if (uri === void 0) {
+        if (legacyBinding(tool)) {
+          unresolved.push(`${tool.name} binds its UI only through the deprecated flat key`);
+        }
+        continue;
+      }
+      if (typeof uri !== "string" || !uri.startsWith(UI_SCHEME)) {
+        unresolved.push(`${tool.name}: ui.resourceUri ${JSON.stringify(uri)} is not a ui:// URI`);
+        continue;
+      }
+      const read = s.reads.get(uri);
+      if (read instanceof Error || !read?.length) {
+        unresolved.push(
+          `${tool.name}: ${uri} cannot be read${read instanceof Error ? ` (${read.message})` : ""}`
+        );
+      }
+    }
+    if (boundTools.length === 0 && unresolved.length === 0) {
+      unresolved.push("no tool binds a UI through ui.resourceUri");
+    }
+    add(
+      "tool-resource-uri",
+      unresolved.length ? "fail" : "pass",
+      unresolved.length ? unresolved.join("; ") : `${boundTools.length} tool(s) bind a UI that resolves`
+    );
+    const badMeta = [];
+    for (const tool of s.tools) {
+      const ui = toolUi(tool);
+      if (!ui) continue;
+      const vis = ui.visibility;
+      if (vis !== void 0 && (!Array.isArray(vis) || vis.length === 0 || !vis.every((v) => VISIBILITY.has(v)))) {
+        badMeta.push(`${tool.name}: ui.visibility ${JSON.stringify(vis)}`);
+      }
+      for (const key of ["csp", "permissions"]) {
+        if (ui[key] !== void 0) {
+          badMeta.push(`${tool.name}: ui.${key} is on the tool, where hosts ignore it`);
+        }
+      }
+    }
+    add(
+      "tool-ui-meta",
+      badMeta.length ? "fail" : "pass",
+      badMeta.length ? badMeta.join("; ") : "tool ui metadata is well-formed"
+    );
+    const noCsp = [];
+    const dataFonts = [];
+    for (const [uri, contents] of s.reads) {
+      if (contents instanceof Error) continue;
+      for (const c of contents) {
+        const listed = s.resources.find((r) => r.uri === uri);
+        const ui = resourceUi(c) ?? resourceUi(listed);
+        const csp = ui?.csp;
+        if (csp === void 0) {
+          noCsp.push(`${uri} declares no ui.csp`);
+        } else if (!isCsp(csp)) {
+          noCsp.push(`${uri}: ui.csp is not a map of origin lists`);
+        }
+        const html = "text" in c ? c.text : Buffer.from(c.blob, "base64").toString("utf-8");
+        const declaresData = isCsp(csp) && (csp.resourceDomains ?? []).includes("data:");
+        if (hasDataFont(html) && !declaresData) {
+          dataFonts.push(`${uri} loads a data: font, and ui.csp.resourceDomains omits data:`);
+        }
+      }
+    }
+    add(
+      "resource-csp",
+      noCsp.length ? "fail" : "pass",
+      noCsp.length ? noCsp.join("; ") : "every UI resource declares ui.csp"
+    );
+    add(
+      "resource-data-fonts",
+      dataFonts.length ? "fail" : "pass",
+      dataFonts.length ? dataFonts.join("; ") : "no undeclared data: fonts"
+    );
+  }
+  if (!authRequired) {
+    add("tool-security-schemes", "skip", "the server does not require auth");
+  } else {
+    const missing = s.tools.filter((t) => !hasSecuritySchemes(t)).map((t) => t.name);
+    add(
+      "tool-security-schemes",
+      missing.length ? "fail" : "pass",
+      missing.length ? `no securitySchemes on: ${missing.join(", ")}` : "every tool declares securitySchemes"
+    );
+  }
+}
+async function checkAuth(url, challenge, add) {
+  if (!challenge) {
+    const reason = "the server answered without a 401 challenge";
+    add("auth-challenge", "skip", reason);
+    add("auth-resource-metadata", "skip", reason);
+    add("auth-issuer", "skip", reason);
+    return;
+  }
+  const { resourceMetadataUrl } = auth_js.extractWWWAuthenticateParams(challenge);
+  add(
+    "auth-challenge",
+    resourceMetadataUrl ? "pass" : "fail",
+    resourceMetadataUrl ? `401 names resource_metadata ${resourceMetadataUrl.href}` : `401 WWW-Authenticate carries no resource_metadata (${JSON.stringify(challenge.headers.get("www-authenticate"))})`
+  );
+  let prm;
+  try {
+    prm = await auth_js.discoverOAuthProtectedResourceMetadata(url, { resourceMetadataUrl });
+  } catch (err) {
+    add(
+      "auth-resource-metadata",
+      "fail",
+      `protected-resource metadata unreadable: ${message(err)}`
+    );
+    add("auth-issuer", "skip", "no protected-resource metadata");
+    return;
+  }
+  add(
+    "auth-resource-metadata",
+    prm.resource === url ? "pass" : "fail",
+    prm.resource === url ? `resource equals ${url}` : `resource is ${JSON.stringify(prm.resource)}, not ${JSON.stringify(url)}`
+  );
+  const advertised = prm.authorization_servers?.[0];
+  if (!advertised) {
+    add("auth-issuer", "fail", "protected-resource metadata lists no authorization_servers");
+    return;
+  }
+  try {
+    const metadata = await auth_js.discoverAuthorizationServerMetadata(advertised);
+    if (!metadata) {
+      add("auth-issuer", "fail", `no authorization server metadata found for ${advertised}`);
+    } else if (metadata.issuer !== advertised) {
+      add(
+        "auth-issuer",
+        "fail",
+        `issuer is ${JSON.stringify(metadata.issuer)}, advertised as ${JSON.stringify(advertised)}`
+      );
+    } else {
+      add("auth-issuer", "pass", `issuer equals ${advertised}`);
+    }
+  } catch (err) {
+    add("auth-issuer", "fail", `authorization server metadata unreadable: ${message(err)}`);
+  }
+}
+function toolUi(tool) {
+  const ui = tool._meta?.ui;
+  return ui && typeof ui === "object" ? ui : void 0;
+}
+function legacyBinding(tool) {
+  return tool._meta?.[server.RESOURCE_URI_META_KEY] !== void 0 && toolUi(tool)?.resourceUri === void 0;
+}
+function resourceUi(item) {
+  const ui = item?._meta?.ui;
+  return ui && typeof ui === "object" ? ui : void 0;
+}
+function isCsp(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((v) => Array.isArray(v) && v.every((o) => typeof o === "string"));
+}
+function hasSecuritySchemes(tool) {
+  const schemes = tool._meta?.securitySchemes ?? tool.securitySchemes;
+  return Array.isArray(schemes) && schemes.length > 0;
+}
+var DATA_FONT_MIME = /data:(?:font\/|application\/(?:x-)?font|application\/vnd\.ms-fontobject)/i;
+var FONT_FACE_DATA_URL = /@font-face\s*{[^}]*url\(\s*["']?data:/i;
+function hasDataFont(html) {
+  return DATA_FONT_MIME.test(html) || FONT_FACE_DATA_URL.test(html);
+}
+function message(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+exports.PROFILES = PROFILES;
+exports.applyProfiles = applyProfiles;
+exports.formatReport = formatReport;
+exports.isTargetName = isTargetName;
+exports.runChecks = runChecks;
+//# sourceMappingURL=check-JEM5PN64.cjs.map
+//# sourceMappingURL=check-JEM5PN64.cjs.map