v0.3.2

Releases here are curated snapshots of a working tree, not the development history — see CONTRIBUTING.md for what that means. The full entry for this version is in the CHANGELOG.

The one thing to read before upgrading

delete_component can now take an app's data with it, and that is permanent. This channel did not exist in 0.3.1 — deleting an app never touched a collection before. It is opt-in (data: "cascade") and deliberately two steps: the first call returns a plan naming every collection that would go and the evidence for each, and only a second call carrying that plan's token performs it. A collection another app also uses is never deleted, and neither is one whose ownership cannot be established. archive_component remains the keep-everything half of the pair.

If you would rather not have that door open at all, stay on 0.3.1.

Also in this release

• Preview documents report their own height. composePreviewDoc broadcasts the same omaRunHeight message the sandboxed runner has always sent, so an embedder no longer has to guess a window and silently clip a tall app.
• Version numbers a person reads are now checkpoints, counted per app from 1, instead of positions on the store's global write axis. restore_component takes checkpoint instead of version.
• Caching hints on every cacheable result (resources/list, resources/read, resources/templates/list), per SEP-2549.
• Widget resources declare their security posture — _meta.ui.csp with empty connectDomains/resourceDomains, which is the honest declaration for a self-contained document and the strictest one available.
• A widget no longer announces a tools capability it does not implement.
• An app named app no longer stops the server from starting. It claimed the universal loader's resource URI, the loader's own registration then failed, and a server that will not start cannot be asked to delete the row that stops it. Such an app now yields its per-app resource and keeps everything else.

Plus fixes to the refresh path, cascade idempotency, and the preview machinery. Full list in the CHANGELOG.

Heads-up: 0.4.0 is a rename

Within about a day, component becomes app throughout — 12 tool names change, along with schema keys and the oma runtime surface. It is a breaking release and will be marked as one.

It also upgrades the store schema, and that upgrade is one-way. Once an engine at 0.4.0 has opened a store, an engine at 0.3.x will refuse to open it. If you keep a rollback path, keep a copy of the store file with it.

Compatibility

Requires Node 22+ (engines.node: ">=22"). Depends on @modelcontextprotocol/ext-apps ^1.7.4 and @modelcontextprotocol/sdk ^1.30.0; the committed lockfile resolves them to 1.7.4 and 1.30.0.

The open-mcp-apps package on the npm registry is not this project — that name is held by an unrelated package. Install from this repository.