Repository navigation
[iFrame] Add the @a2ui/catalog-iframe package and frame bridge - #2797
Draft
josemontespg wants to merge 1 commit into
Draft
josemontespg wants to merge 1 commit into
josemontespg wants to merge 1 commit into
Conversation
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
September 25, 2026 02:36
963297d to
88e7b37
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces the @a2ui/catalog-iframe package, which implements the A2UI iframe catalog for web renderers. It includes the sandbox proxy assets, configuration utilities, and the WebAppFrameBridge host-side protocol bridge that manages data model synchronization, allowlist validation, function calls, and frame sizing. Feedback on the changes highlights a correctness bug in DataModelSync where deleted properties or removed array elements are ignored, potentially causing state desynchronization. Additionally, it is recommended to replace the multi-pass string replacements used for unescaping JSON Pointer escape sequences in both payload_validation.ts and fake_frame_host.ts with a single-pass regex to prevent order-of-operations bugs.
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
September 25, 2026 06:22
88e7b37 to
6ec8017
Compare
josemontespg
added this pull request to stack #2804
September 25, 2026 18:11
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
2 times, most recently
from
September 25, 2026 20:21
695e3fc to
a30511e
Compare
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 1, 2026 20:11
a30511e to
7e497bd
Compare
josemontespg
removed this pull request from stack #2804
October 1, 2026 20:12
josemontespg
added this pull request to stack #2940
October 1, 2026 20:12
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 1, 2026 20:43
7e497bd to
86a2e7b
Compare
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 1, 2026 21:42
86a2e7b to
5f1cc69
Compare
josemontespg
removed this pull request from stack #2940
October 1, 2026 21:56
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 1, 2026 21:56
5f1cc69 to
ba0153a
Compare
josemontespg
added this pull request to stack #2946
October 1, 2026 21:56
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 1, 2026 22:14
ba0153a to
5988e56
Compare
josemontespg
added a commit
that referenced
this pull request
Oct 1, 2026
### Summary `ResolveA2uiProp` turns every prop whose type matches `ActionLike` into a `() => Promise<void>` thunk. Since #2859 added `V1Action` to `ActionLike`, whose function-call variant infers as the weak type `{functionCall?: any}`, every object type matches it, so props declared as `z.record(z.unknown())` (or any `Record<string, ...>`) now resolve to an action thunk instead of their data type. The runtime binder is unaffected (it reads the zod schema), so this is a type-only regression, but it breaks `tsc` for catalogs that read such props, for example the iframe and MCP catalogs in #2797 and #2799. Object types with a string index signature now resolve as data, as before #2859. Props shaped like an action (`{event: ...}`, `{functionCall: ...}`, `V1Action`) still resolve to the thunk. ### Changes * `typescript/web_core/src/resolution/generic-binder.ts`: add `HasStringIndex<T>` and check it inside the `ActionLike` branch of `ResolveA2uiProp` before producing the thunk type. * `typescript/web_core/CHANGELOG.md`: Unreleased entry. ### Verification * `yarn --cwd typescript/web_core test` (842 tests) and `./scripts/fix_format.sh --check` pass locally. * The iframe and MCP catalog packages of the stack above typecheck again with this change.
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 1, 2026 22:41
5988e56 to
ec968bd
Compare
josemontespg
removed this pull request from stack #2946
October 2, 2026 00:35
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 2, 2026 00:35
ec968bd to
4dd00a0
Compare
josemontespg
added this pull request to stack #3011
October 5, 2026 20:45
josemontespg
removed this pull request from stack #3011
October 7, 2026 23:18
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 7, 2026 23:19
bbf025e to
77599be
Compare
josemontespg
added this pull request to stack #3055
October 7, 2026 23:19
josemontespg
removed this pull request from stack #3055
October 7, 2026 23:32
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 7, 2026 23:33
77599be to
a56a4d4
Compare
josemontespg
changed the title
josemontespg
added this pull request to stack #3057
October 7, 2026 23:34
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 8, 2026 19:25
a56a4d4 to
e08c4d2
Compare
josemontespg
changed the title
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 8, 2026 20:22
e08c4d2 to
eff4666
Compare
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 8, 2026 20:31
eff4666 to
5dd2e62
Compare
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 8, 2026 20:47
5dd2e62 to
6d7b8c9
Compare
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 8, 2026 21:17
6d7b8c9 to
a802168
Compare
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 8, 2026 21:34
a802168 to
143f826
Compare
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 8, 2026 22:05
143f826 to
4ece69e
Compare
josemontespg
force-pushed
the
catalogs-shared-sandbox-iframe-package
branch
from
October 8, 2026 22:58
4ece69e to
a79f181
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the
@a2ui/catalog-iframepackage (typescript/catalogs/iframe/) for the v1.0 iframe catalog, building ontypescript/catalogs/shared/sandbox/to implement the host side of thea2ui_*message protocol (WebAppFrameBridge,payload_validation,messages) and bundle the sandbox proxy intodist/sandbox/. TheWebAppFrameUrlandWebAppFrameSrcdoccomponents follow in #2798.Changes
typescript/catalogs/iframe/: the@a2ui/catalog-iframeworkspace. Copiescatalogs/iframe/catalog.jsonandtypescript/catalogs/shared/intosrc/at build time, bundles the proxy intodist/sandbox/with esbuild, and exportsIFRAME_CATALOG_ID, the sandbox configuration API,FrameHost, andWebAppFrameBridge.typescript/catalogs/iframe/src/bridge/:WebAppFrameBridge,messages.ts, andpayload_validation.tsvalidating actions, data changes, and function calls against the component allowlists and JSON Schemas, with Karma unit tests.typescript/catalogs/iframe/README.md&CHANGELOG.md: documents sandbox asset deployment (/a2ui-sandbox/andconfigureSandbox) and the bridge API.Verification
yarn --cwd typescript/catalogs/iframe test: Karma reports192 SUCCESS.yarn --cwd typescript/catalogs/iframe lint,./scripts/fix_format.sh --check, andpython3 scripts/fix_licenses.py --checkpass.Related to #3157