Summary

Bumps @modelcontextprotocol/ext-apps and all example workspaces from 1.6.0 → 1.7.0.

Changes since 1.6.0

Features

• App.registerTool() / sendToolListChanged() — Views can expose tools for the Host to call (WebMCP-style) (spec: Add tool registration for Apps, to be called by Host (WebMCP-style!) #72)
• App.createSamplingMessage() — sampling support via stock SDK types (feat: MCP app sampling support via stock SDK types (alt to #477) #530)
• Handshake-ordering guards (console.warn, or throw with AppOptions.strict): App host-bound methods warn when called before connect() completes; one-shot event handlers (ontoolinput/ontoolresult/etc.) warn when first registered after connect(); AppBridge warns when it receives requests before ui/notifications/initialized (feat(app,app-bridge): guard requests sent before handshake completes #623, feat(app): warn when one-shot handlers are registered after connect() #629, chore: drop GitHub issue URLs from pre-handshake guard log messages #625, refactor(app): unify pre-handshake guard to console.warn #630, fix(react): StrictMode cleanup + relax late-handler guard for re-reg #631)
• AppOptions.allowUnsafeEval (default false) — App constructor sets z.config({ jitless: true }) so Views run under strict CSP without unsafe-eval; opt out for the faster JIT path (feat(app): default Zod to jitless; add allowUnsafeEval opt-out #618)
• useApp() forwards autoResize and strict to the underlying App (feat(react): forward autoResize from useApp to App #622)

Fixes

• useApp effect cleanup now closes the App, so React StrictMode's dev double-invoke doesn't leave a zombie PostMessageTransport listener receiving every host message alongside the live instance (fix(react): StrictMode cleanup + relax late-handler guard for re-reg #631)
• csp / permissions typed ?: never on McpUiToolMeta so misplaced declarations fail at compile time (fix(types): forbid csp/permissions on McpUiToolMeta via never #624)
• Drop stale resourceUri JSDoc that referenced the deprecated flat _meta["ui/resourceUri"] key (docs(types): drop stale resourceUri JSDoc referencing deprecated flat key #626)

Chore

• npm run bump script for version bumps across root + workspaces; npm-publish jobs now approve in a single click; prereleases publish under --tag beta (build: add npm run bump; parallel npm-publish approval #568)
• Pre-commit hook: skip link-self when target is a symlink; --diff-filter=d so re-stage doesn't fail on deletions (build: fix pre-commit hook for symlinked self-dep and staged deletions #621)
• Bump vite / hono / @hono/node-server to patched versions (chore: npm audit fix (vite, hono, @hono/node-server) #616)
• Examples policy added to CONTRIBUTING.md (Add examples policy to CONTRIBUTING.md #550)

Test Plan

• Pre-commit hook ran npm run build:all successfully