@ai-gui/plugin-ui 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.d.cts CHANGED
@@ -27,9 +27,21 @@ interface ASTNode {
27
27
  /** Patch event produced by diffing. */
28
28
 
29
29
  /** Framework-neutral render descriptor returned by plugin node renderers. */
30
- type RenderOutput = {
30
+ type RenderOutput =
31
+ /**
32
+ * `trusted` marks markup the plugin built itself rather than markup taken from the model.
33
+ *
34
+ * A plugin that renders a diagram returns SVG, and sanitizing SVG escapes it — the reader gets
35
+ * the source text instead of the picture. Hosts worked around that by matching the plugin's
36
+ * internal id prefix with a regular expression, which breaks the moment the plugin renames its
37
+ * ids and lets any model output wearing that prefix through unsanitized. A plugin is code the
38
+ * host chose to install, so it can say so itself; a host that disagrees sets
39
+ * `sanitize: { trustPlugins: false }`.
40
+ */
41
+ {
31
42
  kind: "html";
32
43
  html: string;
44
+ trusted?: boolean;
33
45
  } | {
34
46
  kind: "element";
35
47
  tag: string;
package/dist/index.d.ts CHANGED
@@ -27,9 +27,21 @@ interface ASTNode {
27
27
  /** Patch event produced by diffing. */
28
28
 
29
29
  /** Framework-neutral render descriptor returned by plugin node renderers. */
30
- type RenderOutput = {
30
+ type RenderOutput =
31
+ /**
32
+ * `trusted` marks markup the plugin built itself rather than markup taken from the model.
33
+ *
34
+ * A plugin that renders a diagram returns SVG, and sanitizing SVG escapes it — the reader gets
35
+ * the source text instead of the picture. Hosts worked around that by matching the plugin's
36
+ * internal id prefix with a regular expression, which breaks the moment the plugin renames its
37
+ * ids and lets any model output wearing that prefix through unsanitized. A plugin is code the
38
+ * host chose to install, so it can say so itself; a host that disagrees sets
39
+ * `sanitize: { trustPlugins: false }`.
40
+ */
41
+ {
31
42
  kind: "html";
32
43
  html: string;
44
+ trusted?: boolean;
33
45
  } | {
34
46
  kind: "element";
35
47
  tag: string;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@ai-gui/plugin-ui",
3
- "version": "0.5.0",
3
+ "version": "0.6.0",
4
4
  "description": "Bounded declarative AI-generated interfaces for AIGUI.",
5
5
  "keywords": [
6
6
  "llm",
@@ -49,7 +49,7 @@
49
49
  "access": "public"
50
50
  },
51
51
  "dependencies": {
52
- "@ai-gui/core": "0.5.0"
52
+ "@ai-gui/core": "0.6.0"
53
53
  },
54
54
  "scripts": {
55
55
  "build": "tsdown",