mcp-native 0.9.0 → 0.9.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MCP Native contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -2,7 +2,7 @@
 
 # mcp-native
 
-### One entry point for the MCP Native experimental runtime
+### One entry point for the MCP Native React Native host runtime
 
 [![npm](https://img.shields.io/npm/v/mcp-native)](https://www.npmjs.com/package/mcp-native)
 [![downloads](https://img.shields.io/npm/dm/mcp-native)](https://www.npmjs.com/package/mcp-native)
@@ -13,15 +13,15 @@
 
 </div>
 
-> **Experimental:** MCP Native is a proof of concept, not a production-ready MCP or React Native runtime. APIs may change before `1.0.0`.
+`mcp-native` is the convenient way to use the runtime, A2UI, React Native, mixed-surface, and WebView
+APIs from one package. It re-exports the focused `@mcp-native/*` layers while leaving transport
+adapters as a separate installation choice.
 
-> **Compatibility:** the initial tool/resource boundary preserves MCP `2026-07-28` fields, but complete MCP conformance is still in progress. The package exposes the feature-scoped A2UI v1.0 Candidate profile and retains custom `0.1` APIs only as deprecated migration support; this is not an unqualified A2UI renderer claim. It also re-exports the documented stable MCP Apps `2026-01-26` native host-adapter profile. See the [A2UI profile](https://github.com/pablospaniard/mcp-native/blob/main/docs/a2ui-v1-conformance.md), [MCP Apps profile](https://github.com/pablospaniard/mcp-native/blob/main/docs/mcp-apps-compatibility.md), and [standards matrix](https://github.com/pablospaniard/mcp-native/blob/main/docs/standards-compatibility.md).
+The current 0.9 line contains the React Native feature set planned for 1.0 and is ready to try in an
+integration. New work should use A2UI v1 Candidate or the stable MCP Apps `2026-01-26` host flow;
+the custom A2UI 0.1 APIs live under `/legacy` for migration.
 
-`mcp-native` is the convenience package for the runtime and UI APIs. It re-exports the runtime contracts, A2UI v1 lifecycle/capability/renderer-message APIs, trusted native renderer and hooks, host-owned mixed-surface coordinator, deprecated custom surface migration APIs, and policy-gated WebView compatibility primitives from focused `@mcp-native/*` packages. Transport adapters are installed separately.
-
-Read the human-oriented [product guide](https://github.com/pablospaniard/mcp-native/blob/main/docs/product-guide.md)
-and [mixed-surface guide](https://github.com/pablospaniard/mcp-native/blob/main/docs/mixed-surfaces.md)
-before the API examples.
+For the big picture, start with the [product guide](https://github.com/pablospaniard/mcp-native/blob/main/docs/product-guide.md).
 
 ## Install
 
@@ -41,20 +41,18 @@ official action envelopes to a host callback; it never selects a return transpor
 [complete v1 host-flow example](https://github.com/pablospaniard/mcp-native#a2ui-v1-candidate-host-flow)
 and the [`@mcp-native/react-native` adapter documentation](https://github.com/pablospaniard/mcp-native/tree/main/packages/react-native#a2ui-v1-render-plan-adapter).
 
-## Deprecated `0.1` proof-model preview
+## Legacy custom `0.1` migration
 
 For `0.9.x`, migrate these imports to `mcp-native/legacy`. Root aliases are removed at `1.0.0`;
 the explicit legacy subpath stays frozen for migration and security fixes.
 
 ```tsx
+import { McpNativeRuntime, createAllowlistActionPolicy, type McpClient } from "mcp-native";
 import {
   McpNativeSurface,
-  McpNativeRuntime,
-  createAllowlistActionPolicy,
   parseA2uiSurface,
   useMcpNativeActionDispatcher,
-  type McpClient,
-} from "mcp-native";
+} from "mcp-native/legacy";
 import { Button, Text, TextInput, View } from "react-native";
 
 const components = { Button, Text, TextInput, View };
@@ -119,10 +117,10 @@ Install an individual package instead when you only need one layer.
 
 Use the separately installable [`@mcp-native/mcp`](https://github.com/pablospaniard/mcp-native/tree/main/packages/mcp) package to connect these APIs to the official MCP TypeScript SDK without forcing that SDK dependency on every `mcp-native` consumer.
 
-## What works today
+## Included in the current 0.9 line
 
 - transport-independent MCP runtime contracts;
-- strict validation for container, text, button, and text-input nodes;
+- isolated migration support for the deprecated custom `0.1` surface;
 - declared tool-action dispatch;
 - strict A2UI resource-link resolution from tool results;
 - schema-validated A2UI v1 JSONL lifecycle state and explicit host policies;
@@ -147,24 +145,16 @@ Use the separately installable [`@mcp-native/mcp`](https://github.com/pablospani
 - pinned current-protocol integration coverage through the SDK HTTP handler/fetch path;
 - ESM exports, TypeScript declarations, automated tests, and signed npm provenance.
 
-Release `0.9.0` adds host-owned mixed native/MCP Apps composition, a production-shaped reference
-host, and the frozen `1.0.0` release-candidate API. Release `0.8.0` added policy-gated `Video` and
-`AudioPlayer`, completed the pinned A2UI basic catalog, and added exact namespaced manifests and
-local registration for compiled host extensions. Release `0.7.0` added the
-non-media catalog, typed renderer-local bindings, bounded formatting and validation, host-callback
-actions, required image grants, policy-gated HTTP(S) `openUrl`, and exact installed-subset
-discovery. Release `0.6.0` added bounded consent, expiring/revocable host-owned grants, interactive
-OAuth, scope history, lifecycle coordination, actionable states, and redacted operations. Complete
-MCP and A2UI conformance, full streaming host integration, transport placement for A2UI capability
-objects, and separate non-blocking Expo Go integration PoCs remain future work. Follow the
-[roadmap](https://github.com/pablospaniard/mcp-native/blob/main/docs/roadmap.md) for exact claim
-boundaries.
+For the release-by-release history, see the
+[changelog](https://github.com/pablospaniard/mcp-native/blob/main/CHANGELOG.md). The runnable
+[Expo Go todo app](../../examples/expo-go-todolist/README.md) shows the main A2UI and React Native
+pieces working together.
 
 ## Security model
 
 Remote servers may provide declarative UI and actions, but the host owns component resolution, tool execution, permissions, and every sensitive capability. Unknown data fails closed at validation and policy boundaries.
 
-Read the full [architecture](https://github.com/pablospaniard/mcp-native/blob/main/docs/RFC-0001-architecture.md) and [security policy](https://github.com/pablospaniard/mcp-native/blob/main/SECURITY.md) before using or extending the proof of concept.
+Read the full [architecture](https://github.com/pablospaniard/mcp-native/blob/main/docs/RFC-0001-architecture.md) and [security policy](https://github.com/pablospaniard/mcp-native/blob/main/SECURITY.md) before integrating or extending the runtime.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-native",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Convenience package for the MCP Native runtime.",
   "keywords": [
     "a2ui",
@@ -21,6 +21,7 @@
   },
   "files": [
     "dist",
+    "LICENSE",
     "README.md"
   ],
   "type": "module",
@@ -30,25 +31,27 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     },
     "./legacy": {
       "types": "./dist/legacy.d.ts",
-      "import": "./dist/legacy.js"
+      "import": "./dist/legacy.js",
+      "default": "./dist/legacy.js"
     }
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@mcp-native/a2ui": "^0.9.0",
-    "@mcp-native/core": "^0.9.0",
-    "@mcp-native/react-native": "^0.9.0",
-    "@mcp-native/webview": "^0.9.0"
+    "@mcp-native/a2ui": "^0.9.2",
+    "@mcp-native/core": "^0.9.2",
+    "@mcp-native/react-native": "^0.9.2",
+    "@mcp-native/webview": "^0.9.2"
   },
   "peerDependencies": {
     "react": ">=18.3.1 <20",
-    "react-native": ">=0.87.0 <1"
+    "react-native": ">=0.86.0 <1"
   },
   "peerDependenciesMeta": {
     "react-native": {