npm / @a2ui/web_core
@a2ui/web_core
What changed in @a2ui/web_core 0.10 to 0.14, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
33 breaking2 security5 deprecations30 new APIs and options1 performance13 behavior and defaults16 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@a2ui/web_core 0.1435 changes
Breaking changes 13
Basic catalog elements now use a2ui-prefixed classes, preventing application rules such as .error, .active, and .container from matching element internals.
No longer strips a leading @ before checking UAX 31 syntax.
Rejects @-prefixed catalog function names and validates function parameter names.
External implementations must now provide toJson() and validationSchema.
The catalog property and constructor argument are required; models are not created without a resolved catalog.
Throws A2uiCatalogError on a surface without a default catalog instead of returning undefined.
Removed; use DataContext.atLeastV10, which is true for v1.0 and later versions.
No longer strips a leading @ before checking UAX 31 syntax.
On v1.0, validates each function call against its resolved catalog and throws A2uiCatalogError when resolution fails, even without validationConfig.
Checks nested function calls under id and component property keys, including catalog selection according to protocol version.
Takes a Catalog again, not undefined, and resolves components against their own catalog without falling back to the surface default.
May be undefined; v1.0 components and function calls without catalogId resolve to it and fail if no default catalog exists.
Function schemas now describe wire function calls rather than bare argument schemas; loaded and basic-catalog schemas are built from definitions.
Deprecations 4
Deprecated in favor of Catalog.validationSchema.
Deprecated in favor of Catalog.fromJson.
Deprecated in favor of generateValidationSchema.
The deprecated getter may return undefined, like defaultCatalog.
New APIs and options 14
Loads a catalog document into a model, with optional protocol version and catalog ID overrides.
Assembles the unbundled catalog document from its model, computing the anyComponent and anyFunction unions.
Provides a bundled, self-contained schema computed from the catalog model.
Derives a catalog with different entries and drops $defs referenced only by removed entries.
Returns a new catalog linked to the specified peers without changing the receiver.
Sets how references to common types are written.
Adds model definitions to $defs when generating catalog entries from annotated schemas.
Controls whether the theme is written under $defs.theme or under styles.
Inlines local and peer references in a schema.
Returns catalog copies linked to each other and to any extra peers.
Annotates a Zod schema with catalog-document details that Zod does not express; annotations do not change validation.
Annotates a Zod schema with catalog-document details, including the $defs name of a model.
Adds a surface protocol version, including a constructor argument for surfaces without a default catalog; stores it as vMAJOR.MINOR.
Resolves a catalogId for MessageProcessor and DataContext so validation and execution report the same catalog errors.
Behavior and default changes 3
Below v1.0, ignores catalogId on function calls and runs them in the surface catalog.
Allows the reserved @index system function on v1.0+ surfaces while validating user-defined function names against UAX 31.
Reserved @-prefixed system functions validate and run without a default catalog, bypass catalog resolution, and reject calls that name a catalogId.
Fixes and other changes 1
Reports unresolved function-call catalogs on the surface error channel as CATALOG_ERROR instead of EXPRESSION_ERROR.
@a2ui/web_core 0.1339 changes
Breaking changes 7
Component trees now name a component under component rather than type, and write id, component, and metadata after component properties; read the component type from tree.component.
The v1.0 basic catalog evaluates ValidationResult operands through their valid member; the truthy option is accepted to configure this behavior.
Rejects number literals outside the double range with Number literal is out of range instead of returning Infinity.
Returns an empty string for nonexistent dates instead of rolling them into the next month.
Functions requiring user activation are enforced: openUrl throws A2uiExpressionError(USER_ACTIVATION_REQUIRED) when evaluated passively or without a user activation gesture.
Adds a pattern complexity checker to mitigate ReDoS, instantly rejecting unsafe nested repetitions and enforcing pattern and input length limits.
v1.0 validation now checks path syntax in @path and function-call nesting depth in @call expressions.
Security 1
Avoids a direct window.open property check to prevent errors in security-restricted environments.
New APIs and options 9
Adds v1.0 basic catalog custom elements at this package export path.
Universal elements accept an optional node; A2uiLitElement derives context from it and passes each child its own node, while context remains supported for incremental migration.
Adds a name for a schema-only Catalog<ComponentApi, FunctionApi>; Catalog.fromSchema now returns it.
Exposes the context the resolver bound the node with; it is undefined on placeholders.
Adds a document-unique string stable for the node's lifetime, suitable as a rendering key or base for DOM ids and accessibility references.
The v1.0 basic catalog evaluates ValidationResult operands through their valid member; the truthy option is accepted to configure this behavior.
The v1.0 basic catalog evaluates ValidationResult operands through their valid member; the truthy option is accepted to configure this behavior.
Now accepts a ComponentNode.
Adds universal runtime exports for v1.0 at this package export path.
Performance 1
Avoids recreating A2uiController when an incoming ComponentContext binds the same component and data path.
Behavior and default changes 9
Universal host elements apply aria-label, aria-description, aria-live, and aria-hidden; basic catalog input components render validation errors.
The v1.0 basic catalog evaluates ValidationResult operands through their valid member; executeAnd accepts a truthy argument.
The v1.0 basic catalog evaluates ValidationResult operands through their valid member; executeNot accepts a truthy argument.
The v1.0 basic catalog evaluates ValidationResult operands through their valid member; executeOr accepts a truthy argument.
Accepts number literals with a leading decimal point, including as function-call arguments, while .foo and ./x remain paths.
Falls back to the catalog's protocolVersion when no protocolVersion option is given; versions at or above 1.0 without their own definitions use v1.0 definitions.
Action closures now return Promise<void> and await async functionCall actions so callers can detect when action handling settles.
v1.0 dynamic resolution supports reserved @path and @call keys, doubled-prefix unescaping, and validation of unknown single-@ keys while retaining v0.8 and v0.9 support.
Supports non-ASCII Unicode characters in template expressions and data model keys.
Fixes and other changes 12
Disposal now detaches componentsModel.onCreated and binder subscriptions to fix a memory leak in universal elements.
Styles now survive Closure-optimized builds.
Fills $defs with standard definitions for the catalog's protocol version rather than using v0.9 definitions for every catalog.
No longer drops properties mixed in through an external allOf reference, allowing Checkable components in basic catalogs to accept checks.
In v1.0, resolves common_types.json#/$defs/Child so single-child properties such as Card.child are recognized as child references.
Includes FunctionCall and @call expressions in dynamic setter typing following the @ prefix protocol migration.
Setter parameters for properties declared as bindings with no literal branch now fall back to unknown instead of never, making the setter callable.
Includes FunctionCall and @call expressions in dynamic setter typing following the @ prefix protocol migration.
Returns null when the written date and time fields do not survive parsing.
Re-rendering a parent preserves existing child elements, preventing stateful children from reloading when a sibling is added; the function now returns a Lit directive result.
Props declared as Record<string, unknown> resolve to their data type rather than action thunks.
Reads the updated component tree, so properties named component or id no longer replace the model's own values when child references are found.
@a2ui/web_core 0.1225 changes
Breaking changes 13
The v0.9 basic catalog no longer includes non-spec math and comparison functions; applications needing them must register them in a custom catalog.
Universal Web Component symbols moved from the v0.9 root export to this subpath; update import paths.
Deleting an array index past the end is now a no-op instead of extending the array's length.
v1.0 catalog loading validates component property names, function names, and function argument names against UAX #31.
The constructor now requires protocolVersion as its second parameter.
Assigns dataModel at the root so keys containing / or ~ are treated as literal property names rather than nested paths or escape sequences.
In v1.0, a currency code rejected by Intl is placed according to the locale's currency pattern rather than always prefixed.
In v1.0, formatNumber, formatCurrency, and pluralize default to en-US instead of the host locale.
Function arguments are typed unknown instead of any, requiring explicit validation or schema parsing.
In v1.0, evaluating @index outside a collection template raises A2uiValidationError instead of returning 0.
v0.9 basic catalog components no longer define custom elements when imported; registerUniversalElement is needed when code relies on import-time registration.
The constructor takes availableCatalogs as its third positional argument and theme as its fourth; an invalid third argument throws a TypeError.
Now requires an element field holding the custom element constructor.
Deprecations 1
SurfaceModel.catalog is deprecated in favor of SurfaceModel.defaultCatalog; the old property remains as a compatibility getter.
New APIs and options 7
The root export now provides shared core APIs across protocol versions; v0.8 protocol API consumers should import from @a2ui/web_core/v0_8.
Re-exports DataBindingType, FunctionCallType, and MAX_FUNCTION_CALL_ARGS.
Exports isWebComponentImplementation and registerUniversalElement for universal web component integrations.
Adds A2uiRpcError and RpcErrorCode for structured RPC error responses at @a2ui/web_core/rpc.
Adds the DOM contract for an A2UI custom element: an HTMLElement that accepts a context property.
Adds single-catalog component and function schema validation at @a2ui/web_core/validation.
Adds setMarkdownRenderer and getMarkdownRenderer for setting and getting the default MarkdownRenderer for basic catalog text components.
Behavior and default changes 1
In v1.0, an unusable locale tag falls back to en-US instead of throwing or using the host's ambient locale.
Fixes and other changes 3
The v1.0 basic catalog now exports function bodies through BASIC_FUNCTIONS and createBasicCatalogFunctions, matching the v0.9 shape.
In v1.0, TR35 tokens are expanded in the timestamp's written offset, so output does not vary by machine.
Resolves event.userMessage before dispatch, so DynamicString paths and calls are not forwarded to the agent unresolved.
@a2ui/web_core 0.101 changes
Security 1
@a2ui/web_core:
openUrlpermitsjavascript:URI execution via agent-supplied button actions