@mcp-native/webview 0.9.1 → 0.9.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MCP Native contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -12,17 +12,13 @@
 
 </div>
 
-> **Pre-1.0 host adapter:** this package implements the documented stable MCP Apps `2026-01-26`
-> native host-adapter profile. Its public API remains release-candidate until the `1.0.0` review
-> gates complete. A shipping host must map the closed descriptor into its audited platform WebView
-> and lifecycle; native isolation is not equivalent to a browser's cross-origin iframe.
-
-`@mcp-native/webview` handles the compatibility path for MCP resources that contain HTML. The stable
-path negotiates `io.modelcontextprotocol/ui`, discovers strict `_meta.ui` tool metadata, reads one
-exact `ui://` resource with `text/html;profile=mcp-app`, preserves closed CSP and permission
-metadata, builds a CSP-first native sandbox, and runs the bounded Apps JSON-RPC lifecycle. The
-legacy generic helpers still recognize older HTML MIME types and reject both inline and remote
-documents unless the host explicitly grants them through policy.
+`@mcp-native/webview` hosts HTML MCP Apps inside a native WebView without mixing them into the native
+A2UI renderer. It implements the stable MCP Apps `2026-01-26` native host-adapter profile, including
+discovery, `ui://` resources, CSP and permission metadata, a native sandbox descriptor, and the Apps
+JSON-RPC lifecycle.
+
+Older generic HTML helpers remain available for compatibility. They require an explicit host policy
+before loading either inline or remote documents.
 
 The exact protocol pin, message set, bounds, exclusions, native/browser differences, and official
 schema coverage is documented in the [MCP Apps compatibility
@@ -186,8 +182,8 @@ cloning a resource—even with the same URI and content—does not create a vali
 
 ## Host responsibilities
 
-Returning a `WebViewDocument` or sandbox descriptor is not permission to weaken platform controls.
-A production host must still verify:
+The descriptor is designed to map onto a locally bundled WebView with the following production
+controls:
 
 - allowed origins and navigation rules;
 - ephemeral website data and cookie/process-pool isolation on each supported OS version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-native/webview",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Policy-gated WebView fallback primitives for MCP Native.",
   "keywords": [
     "mcp",
@@ -21,6 +21,7 @@
   },
   "files": [
     "dist",
+    "LICENSE",
     "README.md"
   ],
   "type": "module",
@@ -30,13 +31,14 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     }
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@mcp-native/core": "^0.9.1"
+    "@mcp-native/core": "^0.9.3"
   }
 }