mcp-native 0.7.0 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +16 -3
  2. package/package.json +6 -6
package/README.md CHANGED
@@ -127,16 +127,29 @@ Use the separately installable [`@mcp-native/mcp`](https://github.com/pablospani
127
127
  - host-localized A2UI v1 plural selection and pure boolean functions;
128
128
  - bounded A2UI v1 validation functions and renderer-side field and button checks;
129
129
  - press-time, host-policy-gated A2UI v1 HTTP(S) `openUrl` actions;
130
- - trusted render plans for every non-media basic-catalog component, with closed host-owned variants;
130
+ - trusted render plans for every basic-catalog component, with closed host-owned variants and
131
+ deny-by-default image/media grants;
131
132
  - mounting through host-provided components with action and typed-binding event translation;
132
- - typed adapters from trusted non-media semantics into locally bundled design-system components;
133
+ - typed adapters from trusted semantics into locally bundled design-system components;
134
+ - exact namespaced host-extension manifests, negotiation, opaque registries, local Fabric
135
+ registration, policy grants, and schema-valid events with inline catalogs disabled;
133
136
  - memoized render-plan and safely observed asynchronous action-dispatch hooks;
134
137
  - policy-gated inline and remote HTML document descriptions;
135
138
  - MCP `2026-07-28` tool/resource field preservation through the official SDK adapter;
136
139
  - pinned current-protocol integration coverage through the SDK HTTP handler/fetch path;
137
140
  - ESM exports, TypeScript declarations, automated tests, and signed npm provenance.
138
141
 
139
- Release `0.7.0` adds every non-media A2UI basic-catalog component, typed renderer-local absolute and dynamic-list-relative bindings, bounded formatting, validation functions and checks, pure boolean functions, template-instance action resolution, `@index` with offsets, host-callback action envelopes, required image grants, policy-gated HTTP(S) `openUrl`, exact installed-subset discovery, and closed catalog-capability metadata with inline catalogs disabled. `Video` and `AudioPlayer` remain planned for `0.8.0`. Release `0.6.0` added bounded consent over explicit host-authored risk, capability, sensitive-data, and external-sharing descriptors, plus expiring and revocable host-owned grants. Direct `callTool()` operations can use a separate trusted-tool policy; MCP Apps callbacks and A2UI v1 delivery use their own explicit host gates. The separately installed `@mcp-native/mcp` adapter provides issuer-bound interactive OAuth for protected HTTP, durable scope-upgrade history, bounded lifecycle coordination, actionable states, redacted operational events, and dependency-neutral platform reference adapters. It passes every scored pinned `2026-07-28` authorization client scenario. Complete MCP and A2UI conformance remain explicitly out of scope; full streaming host integration, transport placement for A2UI capability objects, and the separate non-blocking Expo Go integration PoCs remain future work. Follow the [roadmap](https://github.com/pablospaniard/mcp-native/blob/main/docs/roadmap.md) for exact claim boundaries.
142
+ Release `0.8.0` adds policy-gated `Video` and `AudioPlayer`, completes the pinned A2UI basic catalog,
143
+ and adds exact namespaced manifests and local registration for compiled host extensions. Release
144
+ `0.7.0` added the
145
+ non-media catalog, typed renderer-local bindings, bounded formatting and validation, host-callback
146
+ actions, required image grants, policy-gated HTTP(S) `openUrl`, and exact installed-subset
147
+ discovery. Release `0.6.0` added bounded consent, expiring/revocable host-owned grants, interactive
148
+ OAuth, scope history, lifecycle coordination, actionable states, and redacted operations. Complete
149
+ MCP and A2UI conformance, full streaming host integration, transport placement for A2UI capability
150
+ objects, and separate non-blocking Expo Go integration PoCs remain future work. Follow the
151
+ [roadmap](https://github.com/pablospaniard/mcp-native/blob/main/docs/roadmap.md) for exact claim
152
+ boundaries.
140
153
 
141
154
  ## Security model
142
155
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "mcp-native",
3
- "version": "0.7.0",
3
+ "version": "0.8.0",
4
4
  "description": "Convenience package for the MCP Native runtime.",
5
5
  "keywords": [
6
6
  "a2ui",
@@ -37,14 +37,14 @@
37
37
  "access": "public"
38
38
  },
39
39
  "dependencies": {
40
- "@mcp-native/a2ui": "^0.7.0",
41
- "@mcp-native/core": "^0.7.0",
42
- "@mcp-native/react-native": "^0.7.0",
43
- "@mcp-native/webview": "^0.7.0"
40
+ "@mcp-native/a2ui": "^0.8.0",
41
+ "@mcp-native/core": "^0.8.0",
42
+ "@mcp-native/react-native": "^0.8.0",
43
+ "@mcp-native/webview": "^0.8.0"
44
44
  },
45
45
  "peerDependencies": {
46
46
  "react": ">=18.3.1 <20",
47
- "react-native": ">=0.76.0 <1"
47
+ "react-native": ">=0.86.0 <1"
48
48
  },
49
49
  "peerDependenciesMeta": {
50
50
  "react-native": {