mcp-native 0.4.0 → 0.6.0

package/README.md

@@ -15,7 +15,7 @@
 
 > **Experimental:** MCP Native is a proof of concept, not a production-ready MCP or React Native runtime. APIs may change before `1.0.0`.
 
-> **Compatibility:** the initial tool/resource boundary preserves MCP `2026-07-28` fields, but complete MCP conformance is still in progress. The package exposes the feature-scoped A2UI v1.0 Candidate profile and retains custom `0.1` APIs only as deprecated migration support; this is not an unqualified A2UI renderer claim. The WebView primitives are not a complete MCP Apps host. See the [A2UI profile](https://github.com/pablospaniard/mcp-native/blob/main/docs/a2ui-v1-conformance.md) and [standards matrix](https://github.com/pablospaniard/mcp-native/blob/main/docs/standards-compatibility.md).
+> **Compatibility:** the initial tool/resource boundary preserves MCP `2026-07-28` fields, but complete MCP conformance is still in progress. The package exposes the feature-scoped A2UI v1.0 Candidate profile and retains custom `0.1` APIs only as deprecated migration support; this is not an unqualified A2UI renderer claim. It also re-exports the documented stable MCP Apps `2026-01-26` native host-adapter profile. See the [A2UI profile](https://github.com/pablospaniard/mcp-native/blob/main/docs/a2ui-v1-conformance.md), [MCP Apps profile](https://github.com/pablospaniard/mcp-native/blob/main/docs/mcp-apps-compatibility.md), and [standards matrix](https://github.com/pablospaniard/mcp-native/blob/main/docs/standards-compatibility.md).
 
 `mcp-native` is the convenience package for the runtime and UI APIs. It re-exports the runtime contracts, A2UI v1 lifecycle/capability/renderer-message APIs, trusted native renderer and hooks, deprecated custom surface migration APIs, and policy-gated WebView compatibility primitives from focused `@mcp-native/*` packages. Transport adapters are installed separately.
 
@@ -106,7 +106,7 @@ The host supplies the locally bundled native components and explicitly allows th
 | [`@mcp-native/core`](https://www.npmjs.com/package/@mcp-native/core)                 | MCP client contracts, runtime delegation, JSON types, and declared tool actions.  |
 | [`@mcp-native/a2ui`](https://www.npmjs.com/package/@mcp-native/a2ui)                 | Feature-scoped v1 Candidate adapter plus deprecated `0.1` migration APIs.         |
 | [`@mcp-native/react-native`](https://www.npmjs.com/package/@mcp-native/react-native) | Trusted plans, local v1 state/actions, hooks, and a host-owned component catalog. |
-| [`@mcp-native/webview`](https://www.npmjs.com/package/@mcp-native/webview)           | HTML policy primitives for the planned MCP Apps compatibility path.               |
+| [`@mcp-native/webview`](https://www.npmjs.com/package/@mcp-native/webview)           | Stable Apps discovery, sandbox, native adapter, and JSON-RPC bridge.              |
 
 Install an individual package instead when you only need one layer.
 
@@ -137,7 +137,7 @@ Use the separately installable [`@mcp-native/mcp`](https://github.com/pablospani
 - pinned current-protocol integration coverage through the SDK HTTP handler/fetch path;
 - ESM exports, TypeScript declarations, automated tests, and signed npm provenance.
 
-The supported A2UI v1 native subset now includes renderer-local absolute and dynamic-list-relative string bindings, bounded `formatString`, host-localized number, currency, date, and plural formatting, validation functions and supported renderer checks, pure boolean functions, template-instance action resolution, `@index` with offsets, host-callback action envelopes, policy-gated HTTP(S) `openUrl`, and closed catalog-capability metadata with inline catalogs disabled. Full streaming host integration, transport placement for A2UI capability objects, authentication helpers, and a runnable mobile demo remain incomplete. Follow the [roadmap](https://github.com/pablospaniard/mcp-native#roadmap) for progress.
+The supported A2UI v1 native subset now includes renderer-local absolute and dynamic-list-relative string bindings, bounded `formatString`, host-localized number, currency, date, and plural formatting, validation functions and supported renderer checks, pure boolean functions, template-instance action resolution, `@index` with offsets, host-callback action envelopes, policy-gated HTTP(S) `openUrl`, and closed catalog-capability metadata with inline catalogs disabled. Release `0.6.0` adds bounded consent over explicit host-authored risk, capability, sensitive-data, and external-sharing descriptors, plus expiring and revocable host-owned grants. Direct `callTool()` operations can use a separate trusted-tool policy; MCP Apps callbacks and A2UI v1 delivery use their own explicit host gates. The separately installed `@mcp-native/mcp` adapter provides issuer-bound interactive OAuth for protected HTTP, durable scope-upgrade history, bounded lifecycle coordination, actionable states, redacted operational events, and dependency-neutral platform reference adapters. It passes every scored pinned `2026-07-28` authorization client scenario. Complete MCP and A2UI conformance remain explicitly out of scope; full streaming host integration, transport placement for A2UI capability objects, and the separate non-blocking Expo Go integration PoCs remain future work. Follow the [roadmap](https://github.com/pablospaniard/mcp-native/blob/main/docs/roadmap.md) for exact claim boundaries.
 
 ## Security model
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-native",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Convenience package for the MCP Native runtime.",
   "keywords": [
     "a2ui",
@@ -37,10 +37,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@mcp-native/a2ui": "^0.4.0",
-    "@mcp-native/core": "^0.4.0",
-    "@mcp-native/react-native": "^0.4.0",
-    "@mcp-native/webview": "^0.4.0"
+    "@mcp-native/a2ui": "^0.6.0",
+    "@mcp-native/core": "^0.6.0",
+    "@mcp-native/react-native": "^0.6.0",
+    "@mcp-native/webview": "^0.6.0"
   },
   "peerDependencies": {
     "react": ">=18.3.1 <20",