• Breaking: Requires a2ui_core ^0.7.0 (a2ui_cli exposes a2ui_core
  types in its public API).

• Added a2ui lint (LintCommand, lintCatalog, CatalogLintFinding, and LintSeverity) to validate catalog JSON schemas against deterministic protocol rules with JSON Pointer locations, including v1.0 Unicode UAX 31 identifiers, component and function discriminators, the reserved Surface component name, v1.0 requiresUserActivation caller constraints, and redundant ComponentCommon or FunctionCommon wrapping (#3831).

• BREAKING CHANGE: (v1_0) Component validation
  (PayloadValidator.validate_component, and MessageProcessor for calls into
  another catalog) rejects a call to a function whose allowedCallers is
  agentOnly in a property binding, a check or an action, since only an
  agent's callRendererFunction may call one. The error matches the one
  DataContext reports when such a call is evaluated. v0.9 catalogs are not
  affected. PayloadValidator.validate_function checks only the envelope of a
  call nested in an argument, as component validation does, since the call
  runs in the catalog it names. Recommended migration: bind only
  rendererOnly or rendererOrAgent functions in components.
  InternalCallRendererFunctionOp is exported from a2ui.core.processing, and
  validate_reserved_directives from a2ui.core.resolution
  (#3534,
  #4008).
• BREAKING CHANGE: Basic catalog regex function (v0_9 and v1_0) now validates patterns against the A2UI portable regex subset (ECMAScript Pattern in Unicode mode with no flags), enforces the 4-rule static ReDoS safety guard (PATTERN_TOO_LONG at 256 code points, NESTED_QUANTIFIER, OVERLAPPING_ALTERNATION, and ADJACENT_OVERLAP), translates patterns to Python re with exact ECMAScript character class and anchor semantics (\A, \Z, ASCII \d/\w/\b/\B, and \uXXXX/\UXXXXXXXX bracket classes), raises A2uiExpressionError with the rejection token on invalid or unsafe patterns, and returns False / {"valid": False} without raising when the input value exceeds 4,096 Unicode code points. Recommended migration: rewrite patterns that use lookbehind, backreferences, named groups, \p{...}, inline flags, or nested/overlapping unbounded quantifiers to the portable subset. Exports parse_regex_subset, check_regex_safety, analyze_regex, translate_to_python, compile_guarded, regex_test, RegexNode, RegexRejection, RegexAnalysisResult, RegexSyntaxError, MAX_REGEX_PATTERN_CODE_POINTS, and MAX_REGEX_VALUE_CODE_POINTS from a2ui.core and a2ui.core.common (#3854).
• BREAKING CHANGE: (v1_0) The basic catalog TextField requires value,
  as the other input components do, so a TextField without one fails
  validation instead of accepting input that never reaches the data model.
  Recommended migration: bind value to a data model path, such as
  {"@path": "/form/email"}. The path does not have to exist yet
  (#3830, #3868).
• BREAKING CHANGE: DynamicBoolean properties and function arguments now
  coerce any resolved value to a boolean according to the protocol
  specification: booleans are kept as is, ValidationResult objects coerce to
  valid, strings coerce to True only when case-insensitively equal to
  "true" (and False for "false" and all other strings), numbers coerce to
  value != 0 (NaN is False), and None, absent values, other objects,
  and arrays coerce to False. Recommended migration: pass explicit booleans,
  non-zero/zero numbers, "true"/"false" strings, or ValidationResult
  dicts rather than relying on Python truthiness or None pass-through
  (#3850).
• BREAKING CHANGE: On every protocol version, a function call whose
  nested argument call fails no longer runs with None for that argument: it
  fails too, and the argument's error is reported once. Recommended migration:
  handle a missing value inside the nested function instead of relying on the
  enclosing one to receive None.
  (#3415,
  #3536,
  #3740)
• BREAKING CHANGE: Action errors are classified the same way in every
  kind of action. A local function that ran and raised is EXECUTION_ERROR,
  in an event action's context and userMessage as well as in
  action.functionCall; previously the event values reported
  EXPRESSION_ERROR. A refused call (missing user activation, agentOnly,
  invalid arguments) is EXPRESSION_ERROR everywhere; previously a
  functionCall action refused for user activation reported
  EXECUTION_ERROR. GenericBinder runs a function call action through
  DataContext.resolve_action, so these codes and requires_user_activation
  apply there, and its closure returns the result's current value.
  Recommended migration: treat EXECUTION_ERROR as a function failure and
  EXPRESSION_ERROR as a refused or malformed call.
  (#3415,
  #3536,
  #3740)
• (v1_0) The common types IndexSystemFunction schema declares "returnType": "number", like catalog functions do (#3725, #4025).
• (v0_9) Restore list_style (listStyle) property to basic catalog List component schema (#3956).
• (v1_0) The basic catalog regex function's pattern description now names
  the A2UI regex dialect and its safety limits
  (#3820).
• (v1_0) Function calls inside ${...} template expressions of formatString
  now inherit the catalogId that the enclosing formatString call resolved
  to, even when the surface defines a different default catalogId, while
  preserving reserved @-prefixed system calls such as ${@index()} as
  catalogless. DataContext.active_catalog_id exposes the catalog ID of the
  currently executing function call
  (#3727).
• Add RpcHandler.cancel_surface_calls to cancel pending outbound agent
  function calls with RpcErrorCode.CANCELLED.
• DataModel now defensively copies initial_data and values passed to set(), preventing subsequent caller mutation of input dicts or lists from silently mutating internal state, and PayloadValidator now validates component type names against UAX 31 identifier syntax on v1.0+ surfaces.
• (v1_0) Catalog.from_json() now rejects function definitions that set
  requiresUserActivation: true when allowedCallers is not 'rendererOnly'
  (such as 'agentOnly' or 'rendererOrAgent') by raising A2uiCatalogError,
  matching the v1.0 catalog definition schema
  (#3840).
• MessageProcessor writes an inline createSurface.dataModel as one
  DataModel.set per top-level key (/<escaped_key>, escaping ~ as ~0 and
  / as ~1 per RFC 6901) before applying inline createSurface.components
  (#3857).
• (v1_0) A function call whose function the renderer does not implement
  (undeclared in the catalog the call resolves to, or declared schema-only) is
  sent to the agent with callAgentFunction, as the specification's fallback
  routing defines, for bindings, check rules, action.functionCall and
  action.event. MessageProcessor enables it on v1.0 surfaces that have an
  outbound_listener. The call names its resolved catalog, and a schema-only
  function's arguments are validated once they resolve and sent with the
  schema's defaults. A call is not sent, and reports EXPRESSION_ERROR, when
  its function is agentOnly, needs user activation the evaluation lacks, has
  arguments with no JSON form, or is read by a one-shot resolve_dynamic_value call, which never sends but may return the answer the surface already holds for the same call. formatString template parts and the arguments of an agent's callRendererFunction never use the agent: an unimplemented function there is an EXPRESSION_ERROR (template parts, which render empty) or an EXECUTION_ERROR response (callRendererFunction). While the answer is
  pending the value is None (a signal with peek=False), and a pending
  check rule doesn't fail. Event action values resolve in order, and the first
  failure stops the action. Identical binding calls share one request and a
  cached answer; action calls never do. Evaluate on the event loop that owns
  the surface: off the loop, a call that would have to be sent fails at once.
  Adds SurfaceModel.agent_function_caller, SurfaceModel.settled_agent_answer,
  SurfaceModel.call_agent_function, SurfaceModel.disposed,
  DataContext.is_user_activated, MessageProcessor.dispose,
  RpcHandler.cancel_surface_calls, AgentFunctionCall and
  AgentFunctionCaller.
  (#3415,
  #3536,
  #3740)
• deleteSurface cancels the surface's pending agent calls with CANCELLED,
  and MessageProcessor.dispose() disposes every surface and cancels all
  pending calls. Cancelled calls report no error.
  (#3415,
  #3536,
  #3740)
• (v1_0) Add AgentFunction, AgentFunctionContext and AgentFunctionHandler
  (exported from a2ui.core) for catalog functions that run on the agent:
  AgentFunction(...) for a rendererOnly function defined in code,
  AgentFunction.from_api(...) to bind a catalog declaration, and
  with_handler. Catalog.copy_with(agent_functions=...) adds them, and
  Catalog.agent_functions and Catalog.renderer_functions list them. An
  agent function's local $defs may not define a name differently from ...

• BREAKING CHANGE: (v1_0) validate_payload and RendererState.apply
  check each callRendererFunction against the catalogs instead of running
  it, and reject one the renderer would refuse: a surface that doesn't exist
  when the call arrives, a catalog that isn't active, a function the catalog
  doesn't declare, a rendererOnly function (the default) or one that
  requires user activation, arguments that don't match the function's schema,
  and a nested call the renderer can't make (to an agentOnly function or one
  that requires user activation, malformed, or naming no catalog on a surface
  without a default one), a nested @index call (the arguments are resolved
  outside any list template), and a malformed data binding (an @path that
  isn't a string, or a field other than @path). Each refusal has the code
  INVALID_FUNCTION_CALL. A nested call that names no catalog is checked
  against the default catalog of the surface the call names. They also reject
  an agentOnly function bound into a component. Recommended migration:
  declare the functions an agent calls with allowedCallers set to
  agentOnly or rendererOrAgent in the catalog the call names
  (#3534,
  #4008).
• BREAKING CHANGE: PromptGenerator.generate() is now final and returns
  assemble_instructions(self), which SkillGenerator.generate_skill() also
  uses, so a monolithic skill for a format's own catalogs holds its prompt
  snippet. A PromptGenerator subclass now implements the abstract catalogs
  property and the three hooks (generate_base_rules,
  generate_catalog_instructions, generate_examples) instead of overriding
  generate(); built-in snippets are unchanged.
  #3568
• BREAKING CHANGE: ExpressPromptGenerator, DirectJsonPromptGenerator,
  ElementalPromptGenerator and AtomPromptGenerator are no longer exported
  from a2ui.inference_formats or their format packages. Reach a format's
  generator through InferenceFormat.prompt_generator, and subclass
  PromptGenerator to write a format of your own.
  #3568
• BREAKING CHANGE: (v1_0) The TextField builder in
  a2ui.builder.v1_0.catalogs.basic requires value, following the basic
  catalog. Recommended migration: pass value, such as
  value=DataBinding(path="/form/email"). The path does not have to exist yet
  (#3830,
  #3868).
• (v1_0) Express compiles, decompiles and prompts the protocol's system
  functions, which no catalog defines: @index() and @index(offset=1)
  compile to {"@call": "@index", ...} without a catalogId, the decompiler
  writes such calls back as @index(...), and the v1.0 Express prompt lists
  @index(offset?). Before v1.0, @index() is a validation error
  (#3725, #4025).
• RendererFunctionCalls.call checks its arguments in a fixed order shared
  with the TypeScript and Dart SDKs. An empty function_call_id is now
  refused with INVALID_FUNCTION_CALL instead of replaced by a generated
  one, and so are a name that isn't a UAX #31 identifier or starts with
  @, and args that aren't a mapping with identifier keys and JSON values
  (no NaN or infinity). timeout and default_timeout must be finite
  positive numbers (not bools); only default_timeout=None turns the limit
  off. (#3939)
• RendererFunctionCalls takes optional catalogs. With them, call raises
  UNKNOWN_FUNCTION for a catalog they lack or a name that isn't one of its
  renderer functions (agent functions included), and
  INVALID_FUNCTION_CALL for a rendererOnly function or one that requires
  user activation, before anything is registered. Two catalogs with one ID
  raise A2uiCatalogError.
  (#3939)
• Add RendererFunctionCalls to a2ui.rpc, which sends v1.0
  callRendererFunction messages for one conversation and settles each call's
  future from the renderer's rendererFunctionResponse, with timeouts (30
  seconds by default), max_pending and dispose(). Its resolve method is
  the on_renderer_function_response callback of
  RendererToAgentMessageProcessor: it returns True when it settles (or, for
  a malformed response, fails) a pending call and False otherwise, so the
  processor declines responses to calls it didn't make. is_pending tells
  whether a response answers one of its calls. agent_development.md describes it
  (#3535).
• Export read_json from a2ui.inference_formats.direct_json, which reads a
  complete JSON document the way the Direct JSON parser does: it accepts
  trailing commas and raw line breaks in strings, and straightens curly quotes.
  Export JSON_PAYLOAD_START_RE from a2ui.parser, the pattern a
  BlockLexer for JSON blocks passes as payload_start_pattern to recover a
  block whose open tag is missing.
  #3790
• Add agent_callable_functions to a2ui.utils to return the functions on v1.0+ catalogs that an agent may invoke via callRendererFunction (#3864, #3880).
• ExpressCompiler and ExpressResponseStream now raise ExpressValidationError for a check list passed to a component whose catalog schema declares no checks property, and emit an updateComponents message for a component scope that defines no root instead of raising ExpressUndefinedRootError (#3099, #3880). A statement holding an out-of-range number literal such as 1e999 now raises ExpressParseError instead of being dropped from the compiled block.
• Add buffer_incomplete_components to DirectJsonParser, DirectJsonFormat, and DirectJsonFormatFactory so callers can hold streaming updateComponents entries until each component object closes (#3880).
• The Express prompt generator (ExpressFormat.prompt_generator.generate_base_rules()) now includes the standalone renderer function call rule in v1.0 when callRendererFunction is allowed and the active catalogs define at least one agent-callable function, listing only agent_callable_functions(catalogs) and numbering multi-catalog rules sequentially (#3864, #3880).
• Prompt snippets (PromptGenerator.generate() and
  prompt_snippet) follow one layout across formats and SDKs: the base rules,
  then the catalog instructions, then the examples under ### Examples:
  followed by a blank line. The ## Workflow Description: heading before the
  base rules (and Atom's ## Instructions:) is gone; add your own heading
  around the snippet if you want one. A Direct JSON snippet puts the protocol
  schemas in one schema block after the rules and each catalog schema in a
  schema block of its own, and generate_catalog_instructions() with no
  catalog returns one block per catalog. a2ui.constants.EXAMPLES_HEADING holds
  the examples heading. #3567
• Add A2UI Protocol v1.0 support to @macro and MacroExpander:
  • Synthesize v1.0 schemas (component const discriminators, Child and Extensions $refs, Annotated field descriptions, oneOf unions, typed dict[str, V] additionalProperties, and nested Pydantic sub-models such as TabItem, ChoicePickerOption, IconNameSvgPath, and ActionEvent) and coerce v1.0 wire directives (@path, @call, Action with userMessage, CheckRule, DynamicChildList, AccessibilityAttributes, typed dict[str, V] maps, and nested sub-models).
  • Add MacroExpander.transform_catalogs(catalogs), protocol_version, and on_error="passthrough" | "raise", enforce single-version invariants and UAX #31 / reserved 'Surface' macro name checks, and close transform_to_transport over registered base_catalogs by rewriting pure macro-sidecar createSurface.catalogId defaults and stamping unique owning catalogIds onto unannotated lowered primitives.
  • Export Extensions from a2ui.builder.v1_0 and support class MyCatalogNode(ComponentBuilderNode, catalog_id=...) alongside field-default catalog_id overrides while preserving wire aliases (#3776, #3778).
• The Direct JSON prompt rule says the JSON part is a JSON array of A2UI messages, each following the schema, instead of "a single, raw JSON object (usually a list of A2UI messages)" that "MUST validate" against it. #3721
• MacroExpander.transform_to_transport no longer passes component envelope
  fields (accessibility, catalogId, metadata) to macro functions unless
  declared as parameters, and merges undeclared accessibility and v1.0
  metadata onto the expanded root component without copying the macro
  invocation's catalogId onto emitted primitives
  (#3626,
  #3777).
• MacroExpander accepts optional catalog_id and base_catalogs parameters
  (plus register_catalog) and tracks surface default catalogs across
  createSurface/deleteSurface (or a per-call surface_catalogs mapping on
  transform_to_transport) to scope macro expansion...

• a2ui_rpc_callback takes renderer_calls, a provider of the session's
  RendererFunctionCalls such as A2uiRendererCallsStore.get, and catalogs
  becomes optional (pass one or both). The callback processes each message
  with a RendererToAgentMessageProcessor whose
  on_renderer_function_response is RendererFunctionCalls.resolve, and
  answers the request without running the agent only when every message is
  handled. A response to a call the session didn't make, such as one the
  model wrote, is declined and goes to the agent. Responses that answer
  pending calls always settle them, even in a request that goes to the agent,
  and a malformed one fails the call it names. It needs the a2a
  extra. #3535
• Add a2ui_rpc_interceptor, an A2aAgentExecutor interceptor that ends a
  task completed when its request held only callAgentFunction and
  rendererFunctionResponse messages and ADK would end it working because
  there was nothing to send back. Other final states are left as they are. It
  needs the a2a extra.
  #3535
• Add A2uiRendererCallsStore, which keeps a RendererFunctionCalls for each
  session. get returns the session's instance, creating it on first use, and
  is the renderer_calls provider of a2ui_rpc_callback. remove disposes a
  session's instance, which fails its pending calls.
  #3535
• Add a2ui_rpc_callback, which returns a before_agent_callback that
  answers the renderer's A2UI v1.0 callAgentFunction messages without
  running the agent. When the user content holds only such calls, it builds a
  RendererToAgentMessageProcessor from the agent's catalogs (or from the
  catalogs a provider returns per context, such as the session's
  A2uiRequestProcessor.active_catalogs), and returns the
  agentFunctionResponse replies as the agent's response, which
  A2aAgentExecutor sends as A2UI parts. It reads and writes the parts with
  ADK's own A2A part converters. Any other content, including the renderer's
  action, error and rendererFunctionResponse messages, goes to the agent.
  It needs the a2a extra.
  #3795
• SendA2uiToClientToolset removes the callAgentFunction and
  agentFunctionResponse messages from the contents sent to the model; the
  session's events keep them. Add exclude_a2ui_rpc_from_prompt, a
  before_model_callback that does the same for agents without the toolset.
  It needs the a2a extra.
  #3795
• Package dependencies updated to require a2ui-agent-sdk>0.10.0 and
  a2ui-a2a>0.2.0 (for the a2a extra).

Published to PyPI: a2ui-adk 0.3.0

pip install a2ui-adk==0.3.0

• Add get_a2ui_messages, which returns the A2UI messages in an A2A message's
  A2UI parts, and create_a2ui_parts, which wraps A2UI messages, such as the
  replies of RendererToAgentMessageProcessor, as A2UI parts. Models are
  serialized as to_message_dicts serializes them, with only the fields that
  were set, so an agentFunctionResponse keeps a value of None, and a
  model's default version is written for v0.9 and later.
  #3795
• Add extract_a2ui_json_to_parts to extract text and <a2ui-json> blocks into
  A2A parts without requiring a Catalog or Parser. A block that is unclosed,
  is not JSON, or is not a JSON object or array of objects is logged and
  skipped. A block whose open tag is missing starts at the first line that
  opens a JSON array or object. Requires an a2ui-agent-sdk release later than
  0.10.0.
  #3790

Published to PyPI: a2ui-a2a 0.3.0

pip install a2ui-a2a==0.3.0

Immutable, content-addressed media assets referenced by docs/site/assets-manifest.json.

• BREAKING CHANGE: DataContext refuses a function whose allowed_callers
  is agentOnly, before running it, so a binding, check or function call
  action that calls one reports an EXPRESSION_ERROR instead of running it, as
  the v1.0 specification requires. RpcHandler still runs such a function for
  an agent's callRendererFunction. Recommended migration: set
  allowed_callers to rendererOrAgent on a function both the renderer and
  the agent call (#3483,
  #3773).
• From v0.9, a component its catalog declares with no ComponentId or
  ChildList property has no child references. Previously any of its string
  properties that named a component on the surface, such as an Icon named
  mail inside the Row whose id is mail, was read as one, so a valid
  surface could fail topology checks as a cycle. A property declared as a plain
  string is read as text, as the protocol's catalog rules require. v0.8
  catalogs, and components a catalog does not declare, still infer references
  from property names and values.
• BREAKING CHANGE: Unify the v1.0 protocol version wire value on '1.0'
  (without a 'v' prefix) across message envelopes, capability objects, and
  catalog documents (ProtocolVersion.V1_0.value is now '1.0'), while
  continuing to accept 'v1.0' in Catalog.from_json.
  Catalog.protocol_version is typed as ProtocolVersion | str.
  #3097,
  #3726
• BREAKING CHANGE: validate_composition_constraints and
  SurfaceComponentsModel.validate_components_update apply the "Surface"
allowedParents rule only to the surface's root component (root_id,
  "root" by default), even when another component also references it, and
  check every parent of a component that has several, not only the last one
  in surface order. A non-root component that nothing references is no longer
  checked against "Surface"; the topology checks report it as an orphan, or
  allow it. This matches the specification and the TypeScript, Dart and Swift
  SDKs, and changes which payloads are accepted.
  (#3354,
  #3360)
• BREAKING CHANGE: A MessageProcessor without a validation_config, as a
  renderer has by default, checks each updateComponents against the
  allowedParents and allowedChildren rules of its catalogs, as the
  TypeScript and Dart SDKs do. Before, it checked nothing, so a payload
  that breaks those rules is now rejected. The check is skipped when no catalog
  of the surface's components declares such rules.
  #3360
• Add extension metadata APIs across SurfaceModel (metadata, extensions, on_metadata_changed, set_extension, remove_extension, and dispatch_action(..., metadata=...)), ComponentModel (metadata, extensions, on_metadata_changed, set_extension, remove_extension), ComponentNode (metadata and on_metadata_changed), ComponentContext and GenericBinder (metadata, extensions, and optional metadata on bound action closures), and ComponentApi (metadata parsed and serialized in Catalog.from_json() and Catalog.to_json()). Fix MessageProcessor to store component metadata on ComponentModel.metadata outside ComponentModel.properties and validate UAX 31 extension keys on component creation as well as updates, and fix Pydantic code generation to emit a distinct ActionMetadata wrapper model instead of colliding with Extensions (#3103, #3468, #3560, #3708, #3757).
• A function defined without an argument schema (FunctionApi or
  FunctionImplementation without schema) takes any args, as one given
  schema={} does: validation_schema and resolved_function_schema give
  {} for it rather than None. Catalog.to_json writes the args of either
  as {"type": "object", "additionalProperties": true}, so a catalog read back
  with Catalog.from_json accepts any args for it too. to_json used to write
  {"type": "object"} for schema={}, which from_json reads as taking no
  args. to_json no longer raises TypeError for a catalog that holds such a
  function, and neither do the paths that call it: link_catalogs, and so a
  MessageProcessor of two or more catalogs, and get_renderer_capabilities
  with v1.0 inline catalogs.
• (v1_0) DataContext reads a ValidationResult dict that a function argument
  resolves to by its valid boolean wherever the function's argument schema
  types that argument as DynamicBoolean, as the specification defines the
  type. This applies to every DynamicBoolean argument, in built-in and
  custom catalogs, so formatNumber's grouping and a custom function's
  boolean parameters now read a failing validation as False rather than as
  a truthy dict; and, or and not already did. Catalogs below v1.0, whose
  validation functions return booleans, are unchanged.
  #3653
• Add map_error_to_renderer_message, extract_envelope_error_context, and ErrorEnvelopeContext to a2ui.core.processing and the a2ui.core public facade, along with SurfaceGroupModel.on_error and MessageProcessor.process_messages_with_errors for emitting and collecting structured wire-format renderer error messages. #3580
• Add NodeResolver, ComponentNode, and NodeState to a2ui.core.resolution and the a2ui.core public facade for reactive surface node-graph resolution, template expansion, and placeholder/cycle tracking. #3580
• (v1_0) Support @-prefixed system function calls (such as ${@index()}) in ExpressionParser string interpolation templates, and preserve ValidationResult.message on path-bound CheckRule conditions in GenericBinder while overriding function default messages on evaluated checks. #3583
• BREAKING CHANGE: Cross-catalog $ref resolution across peer catalogs is
  removed. Catalog.peer_catalogs, Catalog.with_peer_catalogs and
  link_catalogs are gone, inline_local_refs no longer takes a peers
  argument, and MessageProcessor no longer links the catalogs passed to it.
  A catalog resolves $refs only against its own document and the protocol's
  common_types.json. Catalog.from_json raises A2uiCatalogError for a
  v1.0 catalog with a $ref to any other document, such as
  basic_catalog.json#/components/Text or an absolute catalog URI, and never
  fetches it; v0.8 and v0.9 catalogs load as before. Recommended migration:
  bundle referenced components, properties and functions into each catalog so
  it is standalone.
  #3232,
  #3575
• Add Catalog.derive, which builds a catalog with a new catalog_id from
  the named components and functions of an existing one and new entries,
  with the instructions it is given, and does not keep the source's $id,
  title, description or instructions.
  #3597
• (v1_0) Relaxed v1.0 CatalogDefinition schema rules to permit non-object
  catalog $defs (such as primitive, enum, or union design tokens), property
  $refs to #/$defs/..., and arbitrary vendor/metadata extension keys on
  components and functions. Factored weight in the v1.0 basic catalog into
  #/$defs/Weight (annotated with CatalogDef), inlining leaf catalog $defs
  into component schemas in Catalog.from_json and
  Catalog.resolved_component_schema while restoring #/$defs/... references
  in Catalog.to_json() and Catalog.validation_schema
  (#2724).
• Schema validation never fetches a $ref over the network. A $ref to a
  document that is not available locally fails validation with an
  unresolvable-reference error instead of being downloaded
  (#3554).
• (v1_0) The createSurface description no longer says that a surface's
  components and data must come in later messages. They can be sent inline in
  createSurface or in later updateComponents and updateDataModel messages.
  #3678
• SchemaValidator.evolve no longer raises TypeError (_registry) for a
  subschema that declares its own $schema, and keeps the validator's
  registry.
• to_protocol_version is exported from the a2ui.core public facade.
• Under a ValidationConfig that allows dangling references, and orphans or a
  missing root, as an agent mirroring a renderer's surfaces uses,
  MessageProcessor checks each updateComponents against the components it
  changes rather than copying the surface and walking its whole graph. A
  surface that arrives in many small messages now takes time in proportion to
  its size rather than its square. The checks and the errors they raise are
  unchanged: composition constraints, the root when it is required, and
  self-references, cycles and depth. Other configs check the whole surface as
  before.
• SurfaceComponentsModel.components_update_applied reports that a batch
  validate_components_update passed has been applied, so that the next check
  can start from what that check found. MessageProcessor calls it.
• `SurfaceComponentsModel.insert_component(ind...

• Add incremental streaming support for the Express inference format via ExpressResponseStream (ExpressFormat.supports_streaming and ExpressParser.supports_streaming now return True). ExpressFormatFactory, ExpressFormat, and ExpressParser accept progressive_keys (defaulting to DEFAULT_EXPRESS_PROGRESSIVE_KEYS = frozenset({"text"})) to heal unclosed string literals in matching component properties and data path assignments as chunks arrive, while gating initial createSurface emission on root = ... for new surfaces, emitting delta updateComponents and per-path updateDataModel messages on subsequent chunks, and holding statements with unresolved value variables until defined (#2896).
• BREAKING CHANGE: Use '1.0' (without a 'v' prefix) as the version
  field on v1.0 protocol messages and capabilities in inference format
  compilers, parsers, decompilers, builders (a2ui.builder.v1_0),
  RendererState, resolve_catalogs, and prompt examples.
  #3097,
  #3726
• BREAKING CHANGE: The a2ui.extensions.file_resolve module
  (FileResolver, FileResolverSecurityError and ResolvedFileConverter) is
  removed, and the package no longer depends on httpx. File pointers are not
  part of the A2UI protocol, so resolving them is left to the agent.
  #3731
• Add ComponentBuilderNode.metadata, ComponentBuilderNode.with_extension(namespace, value), and set_surface_extensions(messages, *, surface_id=..., extensions=...) in a2ui.builder.v1_0 with UAX 31 extension key validation, and support the reserved extensions= keyword argument on surface(...) and component calls in v1.0 A2UI Express (ExpressCompiler and ExpressParser.decompile) (#3708, #3757).
• BREAKING: In Express (ExpressCompiler), data path assignments ($/... = ...) in surface-updating scopes (scopes that do not create a surface with root or carry update=true) now emit one targeted updateDataModel message per assigned path at its JSON Pointer path instead of folding all assignments into a single root updateDataModel with path: "/" (which overwrote the entire surface data model on the renderer). Surface-creating scopes continue to fold data path assignments into a single root data model and now support list element traversal, canonical numeric-segment list auto-vivification, and full root replacement via $/ = {...} (#3677).
• BREAKING CHANGE: When ResponseStream.feed or close raises an
  A2uiError, its partial_results holds the parts the call made ready before
  the failure, as for parse_response, and they stay applied to the stream's
  RendererState. Before, a chunk that finished a block and then failed in the
  next one raised without those parts and rolled them back. Recommended
  migration: show error.partial_results before ending the stream. #3597
• BREAKING CHANGE: ResponseStream is generic in the parts it returns
  (ResponseStream[ResponsePart] by default, ResponseStream[StreamPart] for
  a stream that reads past rejected blocks) and has an abstract is_in_block
  property, so a subclass must implement it and an annotation must name the
  part type. #3597
• BREAKING CHANGE: DirectJsonPromptGenerator.generate_base_rules() now
  returns the workflow rules followed by the protocol schemas (agent-to-renderer
  and pruned common types) and accepts allowed_messages, while
  generate_catalog_instructions() returns only the catalog schemas and drops
  allowed_messages (#3526).
  Direct JSON catalog skills generated by SkillGenerator now require
  a2ui-core to be loaded alongside them, and callers combining
  generate_base_rules() with schema_to_prompt() (such as
  SendA2uiToClientToolset users) should use DEFAULT_WORKFLOW_RULES instead.
  #3559
• open_stream takes after_rejected_block="continue" to read past a
  rejected block. The stream then returns an ErrorPart in its place, skips
  the rest of the block, and reads the text and blocks after it; the messages
  the block emitted before it was rejected stay in the state. A block still
  open when the response ends is returned as an ErrorPart too. By default the
  first rejected block still ends the stream. #3597
• Add ResponseStream.is_in_block, which tells whether the response read so
  far ends inside a block, so a client that joins the chunks of a paused and
  resumed response can tell whether a space between them could break a block.
  #3597
• Introduce typesafe fluent builder package for A2UI Protocol v1.0 (a2ui.builder.v1_0),
  re-exporting v1.0 common types (DataBinding, FunctionCall,
  AccessibilityAttributes, ActionEvent, and CheckRule) from
  a2ui.core.schema.v1_0, defining builder models (ComponentBuilderNode with
  catalog_id, accessibility, and extensions, Action, and
  DynamicChildList), and generating the v1.0 basic catalog components (Button
  with child slot, TextField with placeholder, Slider with steps, and
  Video with posterUrl)
  (#3070).
• BREAKING: Skill and SkillSet raise A2uiValidationError (a ValueError) for a filename that is absolute or has an empty, . or .. segment, which they used to accept; the check runs on construction, on assignment, and in SkillSet.add. SkillSet.export_to_directory now removes only the directory that holds each skill file (for example src/skills/nested for src/skills/nested/SKILL.md) instead of the first path segment (src), removes a symlink or file at that path instead of following it, and raises before touching anything when a skill directory's parent is a symlink out of the output directory.
• BREAKING CHANGE: parse_and_fix and the a2ui.parser.payload_fixer
  module are removed. Nothing in the SDK used them any more: each inference
  format's parser repairs the model's output, and the Direct JSON parser's
  reader accepts trailing commas, unescaped control characters, smart quotes
  used as JSON delimiters and a single message outside an array. Unlike
  parse_and_fix, it keeps typographic quotes inside string values, so valid
  JSON such as "Willkommen im „Café Central“" is no longer rejected
  (#2934). To read a Direct
  JSON block, use DirectJsonParser(catalogs).compile(text) or
  A2uiRequestProcessor.parse_response.
  #3632
• BREAKING CHANGE: Cross-catalog $ref resolution across peer catalogs is
  removed. resolve_catalogs, validate_payload, RendererState, and the
  Direct JSON and Express formats no longer link the catalogs they are given,
  so a catalog's $refs resolve only against its own document and the
  protocol's common_types.json. Loading a v1.0 catalog with a $ref to any
  other document raises A2uiCatalogError. Recommended migration: bundle
  referenced components, properties and functions into each catalog so it is
  standalone.
  #3232,
  #3575
• The Express compiler accepts userMessage= and context= keyword arguments on Event(...), compiling userMessage to the v1.0 event.userMessage field, and raises ExpressValidationError for userMessage before v1.0 and for any keyword Event does not define, where it used to drop them. A function call in an action slot nested inside a list item or object property (such as items: [{label, action: openUrl(...)}]) is now compiled as a functionCall action. ExpressDecompiler writes userMessage= back (#3598).
• The Express compiler keeps a map literal as written, quoted keys or not, when
  one of its keys shares a name with an Express construct (variable, path,
  call, check, skipped); before, such a map was read as a variable
  reference, data binding, function call or check, and lost its data
  (#3410). In v1.0 and
  later, only @path marks a data binding when the compiler checks a property
  that does not admit one, so a plain path key is data. A _ anywhere but in
  place of an argument now raises ExpressValidationError.
• The Express compiler finds a data binding inside a map literal given to a
  property that does not admit one even when the map has keys named event,
  functionCall or @call, and raises ExpressForbiddenDatabindingError.
• A map literal with a catalogId key among the arguments of an Express check
  holds the check's options: any other key in it, or two such maps naming
  different catalogs, raises ExpressValidationError. Before, only a map with
  a single catalogId string was read as options, and any other was passed to
  the check as an argument. A null catalogId in such a map raises
  ExpressValidationError rather than being ignored.
• Only a $path given to an Express component's value, directly or through
  variables, is passed to the component's checks. A map literal shaped like a
  data binding is data and is not.
• An Express variable whose value refers back to it, directly or through other
  variables, raises ExpressValidationError rather than RecursionError.
• The Express d...

• BREAKING CHANGE: GenAIFileResolver is removed, along with the
  FileResolver it extended in a2ui-agent-sdk.
  #3731
• BREAKING CHANGE: SendA2uiToClientToolset(a2ui_enabled, a2ui_processor)
  takes the request's A2uiRequestProcessor, or an A2uiProcessorProvider
  that returns it per context, instead of catalogs and examples. The processor
  holds the catalogs, the example turns, the inference format and, for a canvas
  agent, the bound RendererState. A2uiCatalogsProvider and
  A2uiExamplesProvider are removed; markdown examples are no longer accepted,
  so pass example turns to A2uiGenerator or A2uiRequestProcessor. To
  migrate, put generator.create_processor(capabilities) in an
  A2uiProcessorStore and pass A2uiProcessorStore.get as the
  provider. A canvas agent binds its RendererState to the processor it puts
  there.
  #3299
• BREAKING CHANGE: The tool reads its argument, renamed from a2ui_json to
  a2ui_payload, in the processor's inference format (Express by default)
  instead of always reading JSON. It compiles the payload with the format's
  parser, no longer with parse_and_fix, validates it against the processor's
  bound state or, without one, with validate_payload, and still returns A2UI
  JSON messages for the part converter. The prompt it adds comes from the
  format's prompt generator, and it skips each section (rules, catalogs,
  examples) that the agent's system instruction already holds, such as when the
  instruction includes processor.prompt_snippet.
  #3299
• BREAKING CHANGE: A2uiPartConverter takes the processor, plus the
  keyword arguments bypass_tool_check and fallback_text, instead of
  catalogs, parser, version and state. It reads text-based A2UI with the
  processor's parser and checks it against the processor's bound state, as a
  response that shows new UI when there is none, so a response that updates a
  surface it does not create is then rejected and logged. Each part is labeled
  with its message's protocol version.
  #3299
• BREAKING CHANGE: A2uiEventConverter takes the request's processor, or
  a provider that returns it or None, in the required keyword argument
  a2ui_processor, instead of reading catalogs from session state. Its
  catalogs_key argument and the system:a2ui_catalogs key are removed. When
  the processor's format can stream, it opens one ResponseStream per
  response, feeds it each partial ADK event, and closes it on the final event.
  A response is keyed by its invocation and its event's branch or author, so
  the sub-agents of a ParallelAgent don't share a stream. A stream that gets
  no event for stream_idle_timeout seconds (600 by default), as when a run is
  cancelled, is dropped.
  #3299
• A2uiProcessorStore keeps each session's request processor in memory, since
  ADK's persistent session services save state as JSON and can't hold one. Its
  get and is_enabled methods are providers for SendA2uiToClientToolset
  and A2uiEventConverter.
  #3299
• SendA2uiToClientToolset and A2uiEventConverter log a warning when they
  get one processor for every request with a RendererState bound to it,
  since every conversation would share that state.
  #3299
• A2uiEventConverter now streams responses in the default ExpressFormat
  incrementally as statements and progressive strings arrive, rather than waiting
  for the closing </a2ui> tag.
  #3712
• Tool and parse errors, which may quote the A2UI payload, are logged by type
  at warning level and in full only at debug level.
  #3299
• Add A2uiInstruction, an ADK instruction provider for an agent that writes
  A2UI in its text response. It appends the processor's prompt_snippet to
  the agent's own instruction. ADK reads {name} session state templates out
  of a string instruction, and the A2UI prompt holds braces that are not state
  keys, such as the ${expression} in the basic catalog, so a string
  instruction failed with KeyError: "Context variable not found: 'expression'."
  under adk run and adk web. As a provider, A2uiInstruction is used as
  it is, while the agent's own instruction keeps its templates.
  #3763
• SendA2uiToClientToolset no longer adds the prompt's rules and catalog
  schemas a second time when the system instruction already holds the
  processor's whole prompt_snippet in the Direct JSON format, whose snippet
  lays the schemas out in one block rather than per section.
  #3763

Published to PyPI: a2ui-adk 0.2.0

pip install a2ui-adk==0.2.0

• create_a2ui_part labels a part with the message's own version field when
  no version is passed, so a v0.9.1 or v1.0 message gets the current A2UI MIME
  type. #3299
• parse_content_to_parts logs a parse error, which may quote the response,
  by type at warning level and in full only at debug level.
  #3299

Published to PyPI: a2ui-a2a 0.2.0

pip install a2ui-a2a==0.2.0