feat: Add Angular v0.9 renderer and a2ui_explorer sample

Author: gspencergoog

.github/workflows/check_license.yml

@@ -38,7 +38,12 @@ jobs:
 
       - name: Check license headers
         run: |
-          addlicense -check \
+          if ! addlicense -check \
             -l apache \
             -c "Google LLC" \
-            .
+            .; then
+            echo "License check failed. To fix this, install addlicense and run it:"
+            echo "  go install github.com/google/addlicense@latest"
+            echo "  addlicense -l apache -c \"Google LLC\" ."
+            exit 1
+          fi

.gitignore

@@ -22,5 +22,5 @@ coverage/
 a2a_agents/python/a2ui_agent/src/a2ui/assets/**/*.json
 ## new agent SDK path
 agent_sdks/python/src/a2ui/assets/**/*.json
-## Generated JS file from the strictly-typed `sandbox.ts`. 
+## Generated JS file from the strictly-typed `sandbox.ts`.
 samples/client/angular/projects/orchestrator/public/sandbox_iframe/sandbox.js

renderers/angular/.npmignore

@@ -0,0 +1 @@
+a2ui_explorer/

renderers/angular/README.md

@@ -6,4 +6,4 @@ All operational data received from an external agent—including its AgentCard,
 
 Similarly, any UI definition or data stream received must be treated as untrusted. Malicious agents could attempt to spoof legitimate interfaces to deceive users (phishing), inject malicious scripts via property values (XSS), or generate excessive layout complexity to degrade client performance (DoS). If your application supports optional embedded content (such as iframes or web views), additional care must be taken to prevent exposure to malicious external sites.
 
-Developer Responsibility: Failure to properly validate data and strictly sandbox rendered content can introduce severe vulnerabilities. Developers are responsible for implementing appropriate security measures—such as input sanitization, Content Security Policies (CSP), strict isolation for optional embedded content, and secure credential handling—to protect their systems and users.
+Developer Responsibility: Failure to properly validate data and strictly sandbox rendered content can introduce severe vulnerabilities. Developers are responsible for implementing appropriate security measures—such as input sanitization, Content Security Policies (CSP), strict isolation for optional embedded content, and secure credential handling—to protect their systems and users.

renderers/angular/a2ui_explorer/public/favicon.ico

@@ -0,0 +1,29 @@
+/**
+ * Copyright 2025 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { Injectable } from '@angular/core';
+import { Subject } from 'rxjs';
+import { SurfaceGroupAction } from '@a2ui/web_core/v0_9';
+
+@Injectable({ providedIn: 'root' })
+export class ActionDispatcher {
+  private action$ = new Subject<SurfaceGroupAction>();
+  actions = this.action$.asObservable();
+
+  dispatch(action: SurfaceGroupAction) {
+    this.action$.next(action);
+  }
+}

renderers/angular/a2ui_explorer/src/app/action-dispatcher.service.ts

@@ -0,0 +1,126 @@
+/**
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { Injectable } from '@angular/core';
+import { A2uiRendererService } from '@a2ui/angular/v0_9';
+import { SurfaceGroupAction, A2uiMessage } from '@a2ui/web_core/v0_9';
+import { ActionDispatcher } from './action-dispatcher.service';
+
+/**
+ * Context for the 'update_property' event.
+ */
+interface UpdatePropertyContext {
+  path: string;
+  value: any;
+  surfaceId?: string;
+}
+
+/**
+ * Context for the 'submit_form' event.
+ */
+interface SubmitFormContext {
+  [key: string]: any;
+  name?: string;
+}
+
+/**
+ * A stub service that simulates an A2UI agent.
+ * It listens for actions and responds with data model updates or new surfaces.
+ */
+@Injectable({
+  providedIn: 'root',
+})
+export class AgentStubService {
+  /** Log of actions received from the surface. */
+  actionsLog: Array<{ timestamp: Date; action: SurfaceGroupAction }> = [];
+
+  constructor(
+    private rendererService: A2uiRendererService,
+     private dispatcher: ActionDispatcher,
+  ) {
+    // Subscribe to actions dispatched by the renderer
+    this.dispatcher.actions.subscribe((action) => this.handleAction(action));
+  }
+
+  /**
+   * Pushes actions triggered from the rendered Canvas frame through simulation.
+   * - Logs actions into inspector event frame aggregates.
+   * - Emulates generic server-side evaluation triggers delaying deferred updates.
+   * - Dispatch subsequent node-tree node triggers back over `A2uiRendererService`.
+   */
+  handleAction(action: SurfaceGroupAction) {
+    console.log('[AgentStub] handleAction action:', action);
+    this.actionsLog.push({ timestamp: new Date(), action });
+
+    // Simulate server processing delay
+    setTimeout(() => {
+      if ('event' in action) {
+        const { name, context } = action.event;
+        if (name === 'update_property' && context) {
+          const { path, value, surfaceId } = context as unknown as UpdatePropertyContext;
+          console.log(
+            '[AgentStub] update_property path:',
+            path,
+            'value:',
+            value,
+            'surfaceId:',
+            surfaceId,
+          );
+          this.rendererService.processMessages([
+            {
+              version: 'v0.9',
+              updateDataModel: {
+                surfaceId: surfaceId || action.surfaceId,
+                path: path,
+                value: value,
+              },
+            },
+          ]);
+        } else if (name === 'submit_form' && context) {
+          const formData = context as unknown as SubmitFormContext;
+          const nameValue = formData.name || 'Anonymous';
+
+          // Respond with an update to the data model in v0.9 layout
+          this.rendererService.processMessages([
+            {
+              version: 'v0.9',
+              updateDataModel: {
+                surfaceId: action.surfaceId,
+                path: '/form/submitted',
+                value: true,
+              },
+            },
+            {
+              version: 'v0.9',
+              updateDataModel: {
+                surfaceId: action.surfaceId,
+                path: '/form/responseMessage',
+                value: `Hello, ${nameValue}! Your form has been processed.`,
+              },
+            },
+          ]);
+        }
+      }
+    }, 50); // Shorter delay for property updates
+  }
+
+  /**
+   * Initializes a demo session with an initial set of messages.
+   */
+  initializeDemo(initialMessages: A2uiMessage[]) {
+    this.rendererService.processMessages(initialMessages);
+  }
+}

renderers/angular/a2ui_explorer/src/app/agent-stub.service.ts

@@ -0,0 +1,21 @@
+/**
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { ApplicationConfig, provideBrowserGlobalErrorListeners } from '@angular/core';
+
+export const appConfig: ApplicationConfig = {
+  providers: [provideBrowserGlobalErrorListeners()],
+};

renderers/angular/a2ui_explorer/src/app/app.config.ts

@@ -0,0 +1,45 @@
+/**
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { TestBed, fakeAsync, tick } from '@angular/core/testing';
+import { App } from './app';
+
+describe('App', () => {
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [App],
+    }).compileComponents();
+  });
+
+  it('should create the app', () => {
+    const fixture = TestBed.createComponent(App);
+    const app = fixture.componentInstance;
+    expect(app).toBeTruthy();
+
+    fixture.detectChanges(); // Trigger ngOnInit
+
+    const compiled = fixture.nativeElement as HTMLElement;
+    expect(compiled.querySelector('.canvas-frame')).toBeTruthy();
+  });
+
+  it('should render title', () => {
+    const fixture = TestBed.createComponent(App);
+    fixture.detectChanges();
+
+    const compiled = fixture.nativeElement as HTMLElement;
+    expect(compiled.querySelector('h3')?.textContent).toContain('A2UI Examples');
+  });
+});

renderers/angular/a2ui_explorer/src/app/app.spec.ts

@@ -0,0 +1,31 @@
+/**
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { Component } from '@angular/core';
+import { DemoComponent } from './demo.component';
+
+/**
+ * Root Component of the A2UI Angular Demo app.
+ *
+ * This component acts as a direct container that embeds the `<a2ui-v0-9-demo>` dashboard.
+ * All dynamic canvas layout and agent rendering behavior is handled inside `DemoComponent`.
+ */
+@Component({
+  selector: 'app-root',
+  imports: [DemoComponent],
+  template: '<a2ui-v0-9-demo></a2ui-v0-9-demo>',
+})
+export class App {}