Changes from 0.2.2 to 0.3.1

[ochafik]

Hi all! We've just released @modelcontextprotocol/ext-apps 0.3.0 & 0.3.1 in rapid succession, here's what's changed since 0.2.2.

Warning

Breaking changes:

• viewport has been replaced with containerDimensions — the new type distinguishes between fixed dimensions (height/width) and maximum constraints (maxHeight/maxWidth)
• PostMessageTransport now requires an explicit eventSource parameter to avoid accidentally omitting origin validation
• registerAppTool signature now aligns with server.registerTool from the MCP TypeScript SDK

Highlights

• Framework examples — Added basic server examples for Vue, Svelte, Preact, and Solid alongside the existing React/VanillaJS examples #141
• Example servers on npm — All 15 example servers are now published to npm under @modelcontextprotocol scope. Run directly via npx @modelcontextprotocol/server-basic-react
  #184
• Video resource server — New example demonstrating video resources with proper mimeType declarations #175
• Sheet music server — Interactive sheet music notation example #196
• Standalone bundle — New app-with-deps build target enables loading the SDK directly from CDN in HTML apps #221

API Changes

• containerDimensions — Replaces viewport with clearer semantics for fixed vs. maximum dimensions #153
• eventSource required — PostMessageTransport constructor now requires explicit event source to avoid accidentally omitting origin validation #208
• registerAppTool aligned — Signature now matches server.registerTool from the MCP TypeScript SDK #219
• ui.resourceUri optional — Tools that need visibility but don't require a UI resource can now omit this #210
• toolInfo.id optional — Aligned with spec; hosts can pass just the tool definition #216
• Method names as constants — MCP method names exported as typed constants for easier external integration #192

Platform & DX

• safeAreaInsets support — Host context now includes safe area insets for proper handling of device notches and system UI #202
• npm start alias — Shorthand for npm run examples:start #183
• Build order fix — Library now always builds before examples with proper version consistency checks #185
• Examples cleanup — Improved consistency across all example servers #182

Security

• Sandbox origin verification — The basic-host example sandbox proxy now validates message origins #207
• Security E2E tests — Added 14 comprehensive tests for origin validation and cross-app message injection protection #208

Bug Fixes

• Host resilience — Server connections now use Promise.allSettled; one server failure no longer crashes the entire UI #206
• Prettier to dev dependency — Fixed incorrect dependency classification #179
• Build errors fixed — Resolved build issues across example servers #180
• Missing examples in publish — Added 6 missing examples to the npm-publish workflow #224

Full Changelog: v0.2.2...v0.3.1