@render-policy/a2ui 0.0.0-stage → 0.1.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 render-policy contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,85 @@
-# Temporary Holding Version
+# @render-policy/a2ui
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The render policy for [A2UI](https://a2ui.org) surfaces (specification v0.9 and v0.9.1). An A2UI
+agent sends no HTML: it describes components from a catalog, and your client renders them with its
+own widgets. Sanitization is no longer the question. Where the agent's data may flow still is.
+
+In the basic catalog these places matter:
+
+| Place | What happens without a policy |
+| --- | --- |
+| `Image.url`, `Video.url`, `AudioPlayer.url`, `theme.iconUrl` | the browser requests the URL as soon as it renders, without a click: whatever the agent put in the URL leaves |
+| `openUrl` (button actions) | navigation; the catalog requires http and https only and `noopener,noreferrer` |
+| `Text.text` | Markdown; the catalog says "without HTML, images, or links", but that is guidance to the agent, not a guarantee |
+
+Nearly every property is dynamic: a literal, a `{ "path": "/…" }` binding into the data model, or a
+function call such as `formatString` (`"https://cdn.example/${/user/token}.png"`). The value that
+matters exists only after binding and changes with every `updateDataModel`. Checking the message JSON
+is not enough: the check has to run on the resolved value, when the renderer uses it.
+
+```ts
+import { createA2uiGuard } from '@render-policy/a2ui';
+
+const guard = createA2uiGuard({
+  policy: { images: { hosts: ['cdn.example.com'] } },
+  onDecision: (d) => audit.push(d),
+});
+
+// In your Image component, after the binding resolved:
+const result = guard.url('image', resolvedUrl, { surfaceId, componentId });
+if (result.allowed) img.src = result.value; // use result.value: the query string may be stripped, a proxy applied
+else showPlaceholder(result.decision.reason);
+
+// The basic catalog's openUrl function:
+guard.openUrl(resolvedArgs.url); // opens with noopener,noreferrer only when allowed
+
+// Text: inert fragment, no HTML, images or links
+guard.renderText(element, resolvedText, { componentId });
+```
+
+What the guard does:
+
+- `url(kind, value)` for `image`, `video`, `audio`, `icon` and `openUrl` runs the URL policy of
+  [`@render-policy/core`](../core) on the resolved value: scheme allowlist, sink denylist,
+  `urls.decide`, and for everything fetched without a click the image policy (host allowlist, query
+  string handling, length and entropy heuristics, `images.rewriteUrl`). Video and audio players
+  request on their own, so they follow the image rules. A value that is not a non-empty string (an
+  unresolved binding, a number, an object) is refused with `a2ui-not-a-url`.
+- `openUrl(value)` allows only http and https (the catalog's requirement, on top of the policy),
+  resolves relative targets against the page and opens with `noopener,noreferrer`. Pass `open` to
+  route it through your own navigation.
+- `text(value)` / `renderText(target, value)` hold `Text` to the catalog contract: raw HTML is shown
+  as text (`a2ui-text-html`), an image becomes its alt text (`a2ui-text-image`), a link its text
+  (`a2ui-text-link`). Nothing the agent wrote disappears silently, and nothing is fetched or opened.
+  The result is sanitized and inserted with `replaceChildren()`. `text: 'policy'` renders `Text` as
+  ordinary Markdown under the policy instead, for a catalog of your own that allows more.
+- Every decision is a journal entry with the core's codes plus the A2UI place (`a2ui.kind`,
+  `surfaceId`, `componentId`). Application hooks that throw become entries; the guard never throws.
+
+## The A2UI renderers' Markdown plug-in
+
+The A2UI web renderers (React, Lit, Angular) take Markdown through a plug-in,
+`(markdown, options) => Promise<string>`, and insert the returned string themselves.
+`createA2uiMarkdownRenderer()` fits that contract with the strict `Text` mode, `tagClassMap` and
+`renderMode: 'inline'`:
+
+```ts
+import { createA2uiMarkdownRenderer } from '@render-policy/a2ui';
+
+const markdown = createA2uiMarkdownRenderer({ guard }); // share the guard with the rest of the surface
+// React: <MarkdownContext.Provider value={markdown}>; Angular: provideMarkdownRenderer(markdown)
+```
+
+This is the compatibility path, and it is weaker than a fragment: the HTML is serialized here and
+parsed again by the renderer. Where you render `Text` yourself, use `guard.renderText()`.
+
+## Proofs
+
+`test/` checks the guard in jsdom. `e2e/run.mjs` runs an A2UI v0.9 surface in Chromium: image,
+video and icon URLs arrive literally, through `updateDataModel` and through `formatString`; `Text`
+carries Markdown images, raw HTML and links; a button calls `openUrl('javascript:…')`. With the guard,
+no request reaches a host outside the allowlist, the token assembled by `formatString` never leaves,
+and nothing opens. The same messages without the guard are the control: they make those requests.
+
+Not covered yet: a static scan of A2UI messages for literal hazards (planned as `mcp-app-lint`
+rules), and A2UI cases in the evil-Markdown corpus. A2UI v1.0 follows when that version is stable.

package/dist/guard.d.ts

@@ -0,0 +1,89 @@
+import { type RenderDecision, type RenderMode, type RenderPolicyOverrides, type RenderTarget, type RenderWindow, type SinkDenylist } from '@render-policy/core';
+/**
+ * Where an A2UI value is used, by the catalog's names:
+ *
+ * - `image`: `Image.url`
+ * - `video`: `Video.url`
+ * - `audio`: `AudioPlayer.url`
+ * - `icon`: `theme.iconUrl` in `createSurface` (an image next to the surface)
+ * - `openUrl`: `args.url` of the `openUrl` function (navigation)
+ *
+ * The first four are fetched without a click and go through the image policy; video and audio
+ * players request metadata on their own, so they are held to the same rule as images.
+ */
+export type A2uiUrlKind = 'image' | 'video' | 'audio' | 'icon' | 'openUrl';
+/** Optional location of a value, copied into its journal entries. */
+export interface A2uiWhere {
+    readonly surfaceId?: string;
+    readonly componentId?: string;
+}
+/** A journal entry with the A2UI place it came from. */
+export interface A2uiDecision extends RenderDecision {
+    readonly a2ui: A2uiWhere & {
+        readonly kind: A2uiUrlKind | 'text';
+    };
+}
+export type A2uiUrlResult = {
+    readonly allowed: true;
+    readonly value: string;
+    readonly decisions: readonly A2uiDecision[];
+} | {
+    readonly allowed: false;
+    readonly decision: A2uiDecision;
+    readonly decisions: readonly A2uiDecision[];
+};
+export interface A2uiTextResult {
+    readonly fragment: DocumentFragment;
+    readonly decisions: readonly A2uiDecision[];
+}
+export interface A2uiTextOptions extends A2uiWhere {
+    /** Render without block wrappers (no `<p>`), for a label. Default false. */
+    readonly inline?: boolean;
+}
+export interface A2uiGuardOptions {
+    /** The window to render with and resolve relative URLs against. Defaults to the global window. */
+    readonly window?: RenderWindow;
+    /** Policy preset. Default 'balanced': no remote image host until you list it. */
+    readonly mode?: RenderMode;
+    /** Overrides applied on top of the preset, as in `createRenderer`. */
+    readonly policy?: RenderPolicyOverrides;
+    /** Replace the bundled sink denylist. */
+    readonly sinkDenylist?: SinkDenylist;
+    /**
+     * `strict` (default) holds `Text` to the basic catalog's contract: Markdown without HTML, images or
+     * links. `policy` renders `Text` like any other Markdown under the policy, for a catalog of your own
+     * that allows more.
+     */
+    readonly text?: 'strict' | 'policy';
+    /** Opens an allowed `openUrl` target. Default: `window.open(url, '_blank', 'noopener,noreferrer')`. */
+    readonly open?: (url: string) => void;
+    /** Receive every decision as it is made. */
+    readonly onDecision?: (decision: A2uiDecision) => void;
+}
+export interface A2uiGuard {
+    /**
+     * Check a resolved value right before the renderer uses it: after data binding and function calls
+     * (`{ "path": "/img" }`, `formatString`), on every data-model update. Use the returned `value`, not
+     * the one passed in: it may be rewritten (query string stripped, image proxy). Never throws.
+     */
+    url(kind: A2uiUrlKind, value: unknown, where?: A2uiWhere): A2uiUrlResult;
+    /**
+     * The basic catalog's `openUrl`: checks the target (http and https only, as the catalog requires,
+     * plus the policy) and opens it with `noopener,noreferrer` only when it is allowed.
+     */
+    openUrl(value: unknown, where?: A2uiWhere): A2uiUrlResult;
+    /** `Text.text` as an inert fragment. Non-string values are rendered as their string form. */
+    text(value: unknown, options?: A2uiTextOptions): A2uiTextResult;
+    /** `Text.text` inserted into `target` with `replaceChildren()`. */
+    renderText(target: RenderTarget, value: unknown, options?: A2uiTextOptions): {
+        readonly decisions: readonly A2uiDecision[];
+    };
+}
+/**
+ * The render policy for an A2UI surface. A2UI sends no HTML, so sanitization is no longer the
+ * question; where the agent's data may flow still is. Every URL a component property or function
+ * argument carries is checked on its resolved value, with the same policy, sink denylist and journal
+ * codes as `@render-policy/core`, and `Text` is held to the catalog's "no HTML, images or links".
+ */
+export declare function createA2uiGuard(options?: A2uiGuardOptions): A2uiGuard;
+//# sourceMappingURL=guard.d.ts.map

package/dist/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,YAAY,EAEjB,KAAK,YAAY,EAGlB,MAAM,qBAAqB,CAAC;AAG7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3E,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,wDAAwD;AACxD,MAAM,WAAW,YAAa,SAAQ,cAAc;IAClD,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAA;KAAE,CAAC;CACpE;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,GAC/F;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,CAAC;AAE9G,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,kGAAkG;IAClG,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IACxC,yCAAyC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACpC,uGAAuG;IACvG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;CACxD;AAED,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC;IACzE;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC;IAC1D,6FAA6F;IAC7F,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,cAAc,CAAC;IAChE,mEAAmE;IACnE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG;QAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,CAAA;KAAE,CAAC;CAC9H;AAuBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,SAAS,CAqFzE"}

package/dist/guard.js

@@ -0,0 +1,115 @@
+import { createRenderer, createUrlGuard, resolvePolicy, resolveWindow, } from '@render-policy/core';
+import { createStrictMarkdown } from './text.js';
+const REQUESTS = {
+    image: { subject: 'image', tag: 'img', attribute: 'src' },
+    icon: { subject: 'image', tag: 'img', attribute: 'src' },
+    video: { subject: 'image', tag: 'video', attribute: 'src' },
+    audio: { subject: 'image', tag: 'audio', attribute: 'src' },
+    openUrl: { subject: 'link', tag: 'a', attribute: 'href' },
+};
+/** The catalog: "Strictly validate that the resolved URL protocol/scheme is either https: or http:". */
+const OPEN_URL_SCHEMES = ['http', 'https'];
+/** No form controls, SVG, media, images or links in `Text`, whatever the policy allows elsewhere. */
+const strictContent = (content) => ({
+    ...content,
+    allowImages: false,
+    allowForms: false,
+    allowSvg: false,
+    allowMedia: false,
+    forbidTags: [...(content?.forbidTags ?? []), 'a', 'img'],
+});
+/**
+ * The render policy for an A2UI surface. A2UI sends no HTML, so sanitization is no longer the
+ * question; where the agent's data may flow still is. Every URL a component property or function
+ * argument carries is checked on its resolved value, with the same policy, sink denylist and journal
+ * codes as `@render-policy/core`, and `Text` is held to the catalog's "no HTML, images or links".
+ */
+export function createA2uiGuard(options = {}) {
+    const win = resolveWindow(options.window, '@render-policy/a2ui');
+    const { mode, policy = {}, sinkDenylist } = options;
+    const onDecision = options.onDecision;
+    const urlGuard = createUrlGuard({ window: win, mode, policy, sinkDenylist });
+    const openUrlSchemes = resolvePolicy(mode, policy).urls.allowedSchemes.filter((s) => OPEN_URL_SCHEMES.includes(s));
+    const openUrlGuard = createUrlGuard({ window: win, mode, policy: { ...policy, urls: { ...policy.urls, allowedSchemes: openUrlSchemes } }, sinkDenylist });
+    const open = options.open ??
+        ((url) => {
+            const opener = win.open;
+            opener?.call(win, url, '_blank', 'noopener,noreferrer');
+        });
+    const located = (decisions, kind, where) => decisions.map((d) => ({ ...d, a2ui: { ...where, kind } }));
+    const emit = (decisions) => {
+        if (onDecision)
+            for (const d of decisions)
+                onDecision(d);
+    };
+    const check = (guard, kind, value, where) => {
+        const request = REQUESTS[kind];
+        if (typeof value !== 'string' || value.trim() === '') {
+            // A binding that resolved to nothing usable: there is no URL to check, so there is none to use.
+            const [decision] = located([{ kind: 'blocked', subject: request.subject, code: 'a2ui-not-a-url', reason: `expected a non-empty string, got ${describe(value)}`, tag: request.tag, attribute: request.attribute }], kind, where);
+            emit([decision]);
+            return { allowed: false, decision, decisions: [] };
+        }
+        const result = guard(value, request);
+        const decisions = located(result.decisions, kind, where);
+        if (result.allowed) {
+            emit(decisions);
+            return { allowed: true, value: result.value, decisions };
+        }
+        const [decision] = located([result.decision], kind, where);
+        emit([...decisions, decision]);
+        return { allowed: false, decision, decisions };
+    };
+    // One renderer per text shape, created on first use.
+    const textRenderers = new Map();
+    const textRenderer = (inline) => {
+        let entry = textRenderers.get(inline);
+        if (!entry) {
+            if (options.text === 'policy') {
+                entry = { renderer: createRenderer({ window: win, mode, policy, sinkDenylist }), markdown: null };
+            }
+            else {
+                const markdown = createStrictMarkdown(inline);
+                const renderer = createRenderer({ window: win, mode, policy: { ...policy, content: strictContent(policy.content) }, sinkDenylist, markdown });
+                entry = { renderer, markdown };
+            }
+            textRenderers.set(inline, entry);
+        }
+        return entry;
+    };
+    const text = (value, textOptions = {}) => {
+        const { inline = false, ...where } = textOptions;
+        const source = typeof value === 'string' ? value : value === null || value === undefined ? '' : String(value);
+        const { renderer, markdown } = textRenderer(inline);
+        const { fragment, decisions: rendered } = renderer.markdownToFragment(source);
+        // Markdown-level decisions come first: they happened first.
+        const decisions = located([...(markdown?.decisions ?? []), ...rendered], 'text', where);
+        emit(decisions);
+        return { fragment, decisions };
+    };
+    return {
+        url: (kind, value, where) => check(kind === 'openUrl' ? openUrlGuard : urlGuard, kind, value, where),
+        openUrl(value, where) {
+            const result = check(openUrlGuard, 'openUrl', value, where);
+            if (result.allowed)
+                open(result.value);
+            return result;
+        },
+        text,
+        renderText(target, value, textOptions) {
+            const { fragment, decisions } = text(value, textOptions);
+            target.replaceChildren(fragment);
+            return { decisions };
+        },
+    };
+}
+function describe(value) {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value))
+        return 'an array';
+    if (typeof value === 'string')
+        return 'an empty string';
+    return typeof value === 'object' ? 'an object' : `a ${typeof value}`;
+}
+//# sourceMappingURL=guard.js.map

package/dist/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,cAAc,EACd,aAAa,EACb,aAAa,GAWd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAuB,MAAM,WAAW,CAAC;AAgFtE,MAAM,QAAQ,GAA8C;IAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE;IACzD,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE;IACxD,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;IAC3D,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;IAC3D,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE;CAC1D,CAAC;AAEF,wGAAwG;AACxG,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE3C,qGAAqG;AACrG,MAAM,aAAa,GAAG,CAAC,OAA2C,EAA0B,EAAE,CAAC,CAAC;IAC9F,GAAG,OAAO;IACV,WAAW,EAAE,KAAK;IAClB,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,KAAK;IACjB,UAAU,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC;CACzD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAO,GAAqB,EAAE;IAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACjE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,EAAE,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,MAAM,QAAQ,GAAa,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACvF,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnH,MAAM,YAAY,GAAa,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IACpK,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,CAAC,CAAC,GAAW,EAAE,EAAE;YACf,MAAM,MAAM,GAAI,GAA4F,CAAC,IAAI,CAAC;YAClH,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAAG,CAAC,SAAoC,EAAE,IAAkC,EAAE,KAA4B,EAAkB,EAAE,CACzI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,CAAC,SAAkC,EAAQ,EAAE;QACxD,IAAI,UAAU;YAAE,KAAK,MAAM,CAAC,IAAI,SAAS;gBAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,KAAe,EAAE,IAAiB,EAAE,KAAc,EAAE,KAA4B,EAAiB,EAAE;QAChH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,gGAAgG;YAChG,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,CACxB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,oCAAoC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,EACtL,IAAI,EACJ,KAAK,CACY,CAAC;YACpB,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACrD,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAmB,CAAC;QAC7E,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjD,CAAC,CAAC;IAEF,qDAAqD;IACrD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoE,CAAC;IAClG,MAAM,YAAY,GAAG,CAAC,MAAe,EAAE,EAAE;QACvC,IAAI,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpG,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;gBAC9C,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC9I,KAAK,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;YACjC,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,WAAW,GAAoB,EAAE,EAAkB,EAAE;QACjF,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,GAAG,WAAW,CAAC;QACjD,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9G,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC9E,4DAA4D;QAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,CAAC,SAAS,CAAC,CAAC;QAChB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;QACpG,OAAO,CAAC,KAAK,EAAE,KAAK;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,OAAO;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI;QACJ,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW;YACnC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YACzD,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC;IACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,EAAE,CAAC;AACvE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { createA2uiGuard } from './guard.js';
+export type { A2uiDecision, A2uiGuard, A2uiGuardOptions, A2uiTextOptions, A2uiTextResult, A2uiUrlKind, A2uiUrlResult, A2uiWhere } from './guard.js';
+export { createA2uiMarkdownRenderer } from './markdown-plugin.js';
+export type { A2uiMarkdownOptions, A2uiMarkdownRenderer, A2uiMarkdownRendererOptions } from './markdown-plugin.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEpJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { createA2uiGuard } from './guard.js';
+export { createA2uiMarkdownRenderer } from './markdown-plugin.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/markdown-plugin.d.ts

@@ -0,0 +1,25 @@
+import { type A2uiGuard, type A2uiGuardOptions } from './guard.js';
+/** The options the A2UI web renderers pass to a Markdown plug-in (`MarkdownRendererOptions` in their web core). */
+export interface A2uiMarkdownOptions {
+    /** Class names to put on rendered elements, by tag name. */
+    readonly tagClassMap?: Readonly<Record<string, readonly string[]>>;
+    /** `inline` renders without block wrappers. */
+    readonly renderMode?: 'inline' | 'block';
+}
+/** The A2UI renderers' Markdown plug-in contract: Markdown in, an HTML string out. */
+export type A2uiMarkdownRenderer = (markdown: string, options?: A2uiMarkdownOptions) => Promise<string>;
+export interface A2uiMarkdownRendererOptions extends A2uiGuardOptions {
+    /** Use this guard instead of creating one from the options above. */
+    readonly guard?: A2uiGuard;
+}
+/**
+ * A Markdown plug-in for the A2UI web renderers (React, Lit, Angular), which take
+ * `(markdown, options) => Promise<string>` and insert the string themselves. `Text` gets the strict
+ * text mode: no HTML, images or links, sanitized, with the journal through `onDecision`.
+ *
+ * This is the compatibility path and it is weaker than a fragment: the HTML is serialized here and
+ * parsed again by the renderer, so what reaches the page depends on how the renderer inserts the
+ * string. Where you render `Text` yourself, use `guard.renderText()`, which inserts a sanitized fragment.
+ */
+export declare function createA2uiMarkdownRenderer(options?: A2uiMarkdownRendererOptions): A2uiMarkdownRenderer;
+//# sourceMappingURL=markdown-plugin.d.ts.map

package/dist/markdown-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-plugin.d.ts","sourceRoot":"","sources":["../src/markdown-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEpF,mHAAmH;AACnH,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnE,+CAA+C;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC1C;AAED,sFAAsF;AACtF,MAAM,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAExG,MAAM,WAAW,2BAA4B,SAAQ,gBAAgB;IACnE,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,GAAE,2BAAgC,GAAG,oBAAoB,CAc1G"}

package/dist/markdown-plugin.js

@@ -0,0 +1,28 @@
+import { createA2uiGuard } from './guard.js';
+/**
+ * A Markdown plug-in for the A2UI web renderers (React, Lit, Angular), which take
+ * `(markdown, options) => Promise<string>` and insert the string themselves. `Text` gets the strict
+ * text mode: no HTML, images or links, sanitized, with the journal through `onDecision`.
+ *
+ * This is the compatibility path and it is weaker than a fragment: the HTML is serialized here and
+ * parsed again by the renderer, so what reaches the page depends on how the renderer inserts the
+ * string. Where you render `Text` yourself, use `guard.renderText()`, which inserts a sanitized fragment.
+ */
+export function createA2uiMarkdownRenderer(options = {}) {
+    const guard = options.guard ?? createA2uiGuard(options);
+    return async (markdown, renderOptions) => {
+        const { fragment } = guard.text(markdown, { inline: renderOptions?.renderMode === 'inline' });
+        // Classes come from the application's configuration and are added after sanitization.
+        for (const [tag, classes] of Object.entries(renderOptions?.tagClassMap ?? {})) {
+            if (!/^[a-z][a-z0-9]*$/i.test(tag) || classes.length === 0)
+                continue;
+            for (const element of fragment.querySelectorAll(tag))
+                element.classList.add(...classes);
+        }
+        // Serialize in the fragment's own document: the guard holds the window, the plug-in needs none.
+        const holder = fragment.ownerDocument.createElement('template');
+        holder.content.append(fragment);
+        return holder.innerHTML;
+    };
+}
+//# sourceMappingURL=markdown-plugin.js.map

package/dist/markdown-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-plugin.js","sourceRoot":"","sources":["../src/markdown-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAyC,MAAM,YAAY,CAAC;AAkBpF;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAO,GAAgC,EAAE;IAClF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE;QACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,KAAK,QAAQ,EAAE,CAAC,CAAC;QAC9F,sFAAsF;QACtF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9E,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QAC1F,CAAC;QACD,gGAAgG;QAChG,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/text.d.ts

@@ -0,0 +1,16 @@
+import type { RenderDecision } from '@render-policy/core';
+/** Markdown to HTML that also reports what it took out. */
+export interface StrictMarkdown {
+    (markdown: string): string;
+    /** Decisions made by the last call; reset on every call. */
+    readonly decisions: readonly RenderDecision[];
+}
+/**
+ * Markdown for the basic catalog's `Text`: "simple Markdown formatting ... without HTML, images, or
+ * links". The catalog states this as guidance to the agent; here it is enforced. Raw HTML is shown as
+ * text, an image becomes its alt text and a link its text, so nothing is fetched or navigated to and
+ * nothing the agent wrote disappears silently. Each change is a journal entry. The output still goes
+ * through the sanitizer, which forbids `a` and `img` on top.
+ */
+export declare function createStrictMarkdown(inline: boolean): StrictMarkdown;
+//# sourceMappingURL=text.d.ts.map

package/dist/text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../src/text.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;CAC/C;AAKD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,cAAc,CA2BpE"}

package/dist/text.js

@@ -0,0 +1,38 @@
+import { Marked } from 'marked';
+const escapeHtml = (text) => text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+/**
+ * Markdown for the basic catalog's `Text`: "simple Markdown formatting ... without HTML, images, or
+ * links". The catalog states this as guidance to the agent; here it is enforced. Raw HTML is shown as
+ * text, an image becomes its alt text and a link its text, so nothing is fetched or navigated to and
+ * nothing the agent wrote disappears silently. Each change is a journal entry. The output still goes
+ * through the sanitizer, which forbids `a` and `img` on top.
+ */
+export function createStrictMarkdown(inline) {
+    let decisions = [];
+    const marked = new Marked({
+        gfm: true,
+        breaks: false,
+        async: false,
+        renderer: {
+            html(token) {
+                decisions.push({ kind: 'rewritten', subject: 'markdown', code: 'a2ui-text-html', reason: 'raw HTML in Text shown as text: the catalog allows no HTML', value: token.text });
+                return escapeHtml(token.text);
+            },
+            image(token) {
+                decisions.push({ kind: 'blocked', subject: 'image', code: 'a2ui-text-image', reason: 'image in Text replaced by its alt text: the catalog allows no images', tag: 'img', attribute: 'src', value: token.href });
+                return escapeHtml(token.text);
+            },
+            link(token) {
+                decisions.push({ kind: 'blocked', subject: 'link', code: 'a2ui-text-link', reason: 'link in Text replaced by its text: the catalog allows no links', tag: 'a', attribute: 'href', value: token.href });
+                return this.parser.parseInline(token.tokens);
+            },
+        },
+    });
+    const render = (markdown) => {
+        decisions = [];
+        return inline ? marked.parseInline(markdown, { async: false }) : marked.parse(markdown, { async: false });
+    };
+    Object.defineProperty(render, 'decisions', { get: () => decisions });
+    return render;
+}
+//# sourceMappingURL=text.js.map

package/dist/text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.js","sourceRoot":"","sources":["../src/text.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAUhC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAElG;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,IAAI,SAAS,GAAqB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE;YACR,IAAI,CAAC,KAAK;gBACR,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,4DAA4D,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5K,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YACD,KAAK,CAAC,KAAK;gBACT,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,sEAAsE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAChN,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,KAAK;gBACR,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,gEAAgE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvM,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/C,CAAC;SACF;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAU,EAAE;QAC1C,SAAS,GAAG,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,CAAC,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IACrE,OAAO,MAAwB,CAAC;AAClC,CAAC"}

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@render-policy/a2ui",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.5",
+  "description": "Render-policy checks for A2UI (v0.9) surfaces: image, media, icon and openUrl values checked after data binding, and the catalog's Text contract (no HTML, images or links) enforced.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "marked": "^18.0.14"
+  },
+  "peerDependencies": {
+    "@render-policy/core": "^0.1.5"
+  },
+  "devDependencies": {
+    "@render-policy/core": "^0.1.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "a2ui",
+    "agent",
+    "ui",
+    "sanitize",
+    "xss",
+    "exfiltration",
+    "markdown",
+    "llm",
+    "security"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/shteynu/render-policy.git",
+    "directory": "packages/a2ui"
+  }
+}