@mcp-native/webview 0.0.2 → 0.1.0

package/README.md

@@ -1,3 +1,104 @@
+<div align="center">
+
 # @mcp-native/webview
 
-Policy-gated HTML MCP App compatibility primitives for MCP Native.
+### Deny-by-default HTML policy primitives for a future MCP Apps host
+
+[![npm](https://img.shields.io/npm/v/@mcp-native/webview)](https://www.npmjs.com/package/@mcp-native/webview)
+[![downloads](https://img.shields.io/npm/dm/@mcp-native/webview)](https://www.npmjs.com/package/@mcp-native/webview)
+[![license](https://img.shields.io/npm/l/@mcp-native/webview)](https://github.com/pablospaniard/mcp-native/blob/main/LICENSE)
+
+[GitHub](https://github.com/pablospaniard/mcp-native) · [Architecture](https://github.com/pablospaniard/mcp-native/blob/main/docs/RFC-0001-architecture.md) · [Standards status](https://github.com/pablospaniard/mcp-native/blob/main/docs/standards-compatibility.md) · [Security](https://github.com/pablospaniard/mcp-native/blob/main/SECURITY.md)
+
+</div>
+
+> **Experimental:** this package defines document validation and one policy decision. It does not mount or sandbox a platform WebView and is not a complete MCP Apps host.
+
+`@mcp-native/webview` handles the compatibility path for MCP resources that contain HTML. It recognizes supported MIME types and rejects both inline and remote documents unless the host explicitly grants them through policy. Inline base URLs are limited to non-network `ui:` / `mcp:` schemes. Remote loads require an exact origin allowlist, accept only credential-free `http:` / `https:` URIs, and use a dedicated `{ uri, mimeType }` input rather than an MCP blob/text body.
+
+Current support does not include tool `_meta.ui.resourceUri` discovery, `ui://` preloading, resource CSP or permission metadata, `ui/initialize`, AppBridge, the Apps JSON-RPC protocol, or a postMessage bridge. Those are required before this package can claim [MCP Apps](https://modelcontextprotocol.io/extensions/apps/overview) host compatibility.
+
+## Install
+
+```bash
+npm install @mcp-native/webview
+```
+
+`@mcp-native/core` is installed as a dependency. The package is ESM-only and includes TypeScript declarations.
+
+## Inline HTML (opt-in)
+
+```ts
+import { createWebViewDocument } from "@mcp-native/webview";
+
+const document = createWebViewDocument(
+  {
+    uri: "mcp://example/app",
+    mimeType: "text/html",
+    text: "<main>Hello from an MCP App</main>",
+  },
+  { allowInlineDocuments: true },
+);
+
+// { kind: "inline", html: "...", baseUrl: "mcp://example/app" }
+```
+
+Inline documents and remote documents are both denied by default. Inline base URLs must use a non-network allowlisted scheme (`ui:` or `mcp:`) so relative fetches cannot be steered at an arbitrary https origin. Embedded credentials are always rejected.
+
+## Remote documents require an origin allowlist
+
+```ts
+import { createWebViewDocument, WebViewPolicyError } from "@mcp-native/webview";
+
+const resource = {
+  uri: "https://example.com/app",
+  mimeType: "text/html",
+};
+
+try {
+  createWebViewDocument(resource);
+} catch (error) {
+  if (error instanceof WebViewPolicyError) {
+    console.error(error.message);
+  }
+}
+
+const allowed = createWebViewDocument(resource, {
+  allowRemoteDocuments: true,
+  allowedRemoteOrigins: ["https://example.com"],
+});
+```
+
+Remote inputs are `{ uri, mimeType }` references (not MCP text/blob resource bodies). Only credential-free `http:` / `https:` URIs are accepted, and the URI origin must appear exactly in `allowedRemoteOrigins`. Binary `blob` resources are rejected.
+
+## Public API
+
+| Export                  | Purpose                                                                                   |
+| ----------------------- | ----------------------------------------------------------------------------------------- |
+| `isHtmlResource`        | Returns whether a resource declares a supported HTML MIME type.                           |
+| `createWebViewDocument` | Validates a text or remote HTML input and returns a policy-approved document descriptor.  |
+| `WebViewDocumentInput`  | `McpTextResourceContents` or `{ uri, mimeType }` remote reference (never blob resources). |
+| `WebViewRemoteResource` | Remote HTML reference without a resource body.                                            |
+| `WebViewPolicy`         | Host policy for inline opt-in, remote opt-in, and remote origin allowlists.               |
+| `WebViewDocument`       | Discriminated union for inline and remote documents.                                      |
+| `WebViewPolicyError`    | Error thrown for unsupported MIME types, schemes, credentials, or denied documents.       |
+
+Supported MIME types are `text/html` and `text/html+skybridge`.
+
+## Host responsibilities
+
+Returning a `WebViewDocument` is not permission to render it without further controls. A production host must still define:
+
+- allowed origins and navigation rules;
+- bridge message schemas and directionality;
+- storage, cookie, download, and external-link policy;
+- camera, microphone, location, clipboard, and filesystem permissions;
+- process isolation and platform-specific WebView hardening.
+
+See the repository's [security policy](https://github.com/pablospaniard/mcp-native/blob/main/SECURITY.md) before expanding this boundary. Install [`mcp-native`](https://www.npmjs.com/package/mcp-native) for the combined runtime and UI APIs.
+
+The planned compatibility work and the differences between browser iframe isolation and native WebView isolation are tracked in [Standards and compatibility](https://github.com/pablospaniard/mcp-native/blob/main/docs/standards-compatibility.md).
+
+## License
+
+[MIT](https://github.com/pablospaniard/mcp-native/blob/main/LICENSE)

package/dist/index.d.ts

@@ -1,7 +1,28 @@
-import type { McpResource } from "@mcp-native/core";
+import type { McpTextResourceContents } from "@mcp-native/core";
 export interface WebViewPolicy {
+    /**
+     * Allows returning inline HTML from a text resource. Denied by default —
+     * hosts must opt in and still apply their own WebView sandbox.
+     */
+    readonly allowInlineDocuments?: boolean;
+    /**
+     * Allows remote documents. Requires a non-empty `allowedRemoteOrigins` list
+     * and only accepts credential-free `http:` / `https:` URIs.
+     */
     readonly allowRemoteDocuments?: boolean;
+    /** Exact origins such as `https://example.com` that may be loaded remotely. */
+    readonly allowedRemoteOrigins?: readonly string[];
 }
+/**
+ * A remote HTML document reference. Unlike `McpResource`, remote WebView inputs
+ * intentionally omit `text`/`blob` bodies — the host loads `uri` after policy checks.
+ */
+export interface WebViewRemoteResource {
+    readonly uri: string;
+    readonly mimeType: string;
+}
+/** Inputs accepted by `createWebViewDocument`. Binary MCP resources are not accepted. */
+export type WebViewDocumentInput = McpTextResourceContents | WebViewRemoteResource;
 export type WebViewDocument = {
     readonly kind: "inline";
     readonly html: string;
@@ -13,6 +34,8 @@ export type WebViewDocument = {
 export declare class WebViewPolicyError extends Error {
     constructor(message: string);
 }
-export declare function isHtmlResource(resource: McpResource): boolean;
-export declare function createWebViewDocument(resource: McpResource, policy?: WebViewPolicy): WebViewDocument;
+export declare function isHtmlResource(resource: {
+    readonly mimeType?: string;
+}): boolean;
+export declare function createWebViewDocument(resource: WebViewDocumentInput, policy?: WebViewPolicy): WebViewDocument;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAIpD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,MAAM,eAAe,GACvB;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAE7D;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,EACrB,MAAM,GAAE,aAAkB,GACzB,eAAe,CAgBjB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAMhE,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnD;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,GAAG,qBAAqB,CAAC;AAEnF,MAAM,MAAM,eAAe,GACvB;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAEhF;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,GAAE,aAAkB,GACzB,eAAe,CA2CjB"}

package/dist/index.js

@@ -1,4 +1,6 @@
 const HTML_MIME_TYPES = new Set(["text/html", "text/html+skybridge"]);
+/** Non-network schemes permitted for inline document base URLs. */
+const INLINE_BASE_URL_SCHEMES = new Set(["ui", "mcp"]);
 export class WebViewPolicyError extends Error {
     constructor(message) {
         super(message);
@@ -12,12 +14,92 @@ export function createWebViewDocument(resource, policy = {}) {
     if (!isHtmlResource(resource)) {
         throw new WebViewPolicyError(`Unsupported WebView MIME type: ${resource.mimeType ?? "unknown"}`);
     }
-    if (resource.text !== undefined) {
-        return { kind: "inline", html: resource.text, baseUrl: resource.uri };
+    const uri = expectDocumentUri(resource.uri, "resource.uri");
+    if (hasOwnDefined(resource, "blob")) {
+        throw new WebViewPolicyError("Binary WebView resources are not supported");
+    }
+    if (hasOwnDefined(resource, "text")) {
+        const text = resource.text;
+        if (typeof text !== "string") {
+            throw new WebViewPolicyError("Expected a string at resource.text");
+        }
+        if (policy.allowInlineDocuments !== true) {
+            throw new WebViewPolicyError("Inline WebView documents are disabled by policy");
+        }
+        assertInlineBaseUrl(uri);
+        return { kind: "inline", html: text, baseUrl: uri };
     }
     if (policy.allowRemoteDocuments !== true) {
         throw new WebViewPolicyError("Remote WebView documents are disabled by policy");
     }
-    return { kind: "remote", uri: resource.uri };
+    const allowedOrigins = policy.allowedRemoteOrigins;
+    if (allowedOrigins === undefined || allowedOrigins.length === 0) {
+        throw new WebViewPolicyError("Remote WebView documents require a non-empty allowedRemoteOrigins allowlist");
+    }
+    for (const [index, origin] of allowedOrigins.entries()) {
+        assertOriginAllowlistEntry(expectDocumentUri(origin, `allowedRemoteOrigins[${index}]`));
+    }
+    return {
+        kind: "remote",
+        uri: assertAllowedRemoteUri(uri, allowedOrigins),
+    };
+}
+function hasOwnDefined(value, key) {
+    return Object.hasOwn(value, key) && value[key] !== undefined;
+}
+function expectDocumentUri(value, path) {
+    if (typeof value !== "string") {
+        throw new WebViewPolicyError(`Expected a string at ${path}`);
+    }
+    return value;
+}
+function parseDocumentUrl(uri, path) {
+    const URLParser = globalThis.URL;
+    if (URLParser === undefined) {
+        throw new WebViewPolicyError("URL parsing is unavailable in this runtime");
+    }
+    let url;
+    try {
+        url = new URLParser(uri);
+    }
+    catch {
+        throw new WebViewPolicyError(`Invalid WebView document URI at ${path}`);
+    }
+    if (url.username.length > 0 || url.password.length > 0) {
+        throw new WebViewPolicyError("WebView document URIs must not include embedded credentials");
+    }
+    return url;
+}
+function assertInlineBaseUrl(uri) {
+    const url = parseDocumentUrl(uri, "resource.uri");
+    const scheme = url.protocol.replace(/:$/, "").toLowerCase();
+    if (!INLINE_BASE_URL_SCHEMES.has(scheme)) {
+        throw new WebViewPolicyError(`Inline WebView base URL scheme is not allowlisted: ${scheme}:`);
+    }
+}
+function assertOriginAllowlistEntry(origin) {
+    const url = parseDocumentUrl(origin, "allowedRemoteOrigins");
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new WebViewPolicyError(`allowedRemoteOrigins entries must use http: or https:, received ${url.protocol}`);
+    }
+    if (url.hostname.length === 0) {
+        throw new WebViewPolicyError("allowedRemoteOrigins entries require a hostname");
+    }
+    if (url.origin !== origin) {
+        throw new WebViewPolicyError(`allowedRemoteOrigins entries must be exact origins such as https://example.com, received ${origin}`);
+    }
+}
+function assertAllowedRemoteUri(uri, allowedOrigins) {
+    const url = parseDocumentUrl(uri, "resource.uri");
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new WebViewPolicyError(`Remote WebView documents require http: or https:, received ${url.protocol}`);
+    }
+    if (url.hostname.length === 0) {
+        throw new WebViewPolicyError("Remote WebView documents require a hostname");
+    }
+    if (!allowedOrigins.includes(url.origin)) {
+        throw new WebViewPolicyError(`Remote WebView origin is not allowlisted: ${url.origin}`);
+    }
+    return uri;
 }
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAiBtE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,QAAqB;IAClD,OAAO,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAqB,EACrB,MAAM,GAAkB,EAAE;IAE1B,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAC1B,kCAAkC,QAAQ,CAAC,QAAQ,IAAI,SAAS,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,kBAAkB,CAAC,iDAAiD,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACtE,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAwCvD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,QAAwC;IACrE,OAAO,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAA8B,EAC9B,MAAM,GAAkB,EAAE;IAE1B,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAC1B,kCAAkC,QAAQ,CAAC,QAAQ,IAAI,SAAS,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAE5D,IAAI,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC,4CAA4C,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAI,QAAoC,CAAC,IAAI,CAAC;QACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,kBAAkB,CAAC,oCAAoC,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAAC,iDAAiD,CAAC,CAAC;QAClF,CAAC;QACD,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,kBAAkB,CAAC,iDAAiD,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,oBAAoB,CAAC;IACnD,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAC1B,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,0BAA0B,CAAC,iBAAiB,CAAC,MAAM,EAAE,wBAAwB,KAAK,GAAG,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,sBAAsB,CAAC,GAAG,EAAE,cAAc,CAAC;KACjD,CAAC;AACJ,CAAC;AAUD,SAAS,aAAa,CAAC,KAAa,EAAE,GAAW;IAC/C,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAK,KAAiC,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;AAC5F,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,IAAY;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,IAAY;IACjD,MAAM,SAAS,GACb,UAGD,CAAC,GAAG,CAAC;IACN,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,4CAA4C,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,GAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,kBAAkB,CAAC,6DAA6D,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,kBAAkB,CAAC,sDAAsD,MAAM,GAAG,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc;IAChD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC7D,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,kBAAkB,CAC1B,mEAAmE,GAAG,CAAC,QAAQ,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,iDAAiD,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAC1B,4FAA4F,MAAM,EAAE,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW,EAAE,cAAiC;IAC5E,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,kBAAkB,CAC1B,8DAA8D,GAAG,CAAC,QAAQ,EAAE,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,kBAAkB,CAAC,6CAA6C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -1,11 +1,22 @@
 {
   "name": "@mcp-native/webview",
-  "version": "0.0.2",
+  "version": "0.1.0",
   "description": "Policy-gated WebView fallback primitives for MCP Native.",
+  "keywords": [
+    "mcp",
+    "mcp-apps",
+    "model-context-protocol",
+    "security",
+    "webview"
+  ],
+  "homepage": "https://github.com/pablospaniard/mcp-native#readme",
+  "bugs": {
+    "url": "https://github.com/pablospaniard/mcp-native/issues"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pablospaniard/mcp-native.git",
+    "url": "git+https://github.com/pablospaniard/mcp-native.git",
     "directory": "packages/webview"
   },
   "files": [
@@ -26,6 +37,6 @@
     "access": "public"
   },
   "dependencies": {
-    "@mcp-native/core": "^0.0.2"
+    "@mcp-native/core": "^0.1.0"
   }
 }