Skip to main content
Documents saga a2ui 1.0.0 (stable). This is the SDK guide docs/public-install.md at source revision 15591e3. It is published as a snapshot: later source changes do not alter it. Licensed under Apache-2.0.
The public release set contains seven packages: Use Node 22.12.0 or newer and a TypeScript-aware bundler. The packages export TypeScript source. An application normally installs one stack and its framework peers, and imports from that stack only.

​
Choose an exact published version

Check the registry before selecting a version:
The current release is saga a2ui 1.0, published under both latest and next and verified against the registry on 5 November 2026. The packages share major and minor versions and differ in patch: @saga-a2ui/core, components, lit and react are 1.0.0, @saga-a2ui/mcp is 1.0.2, and both stacks are 1.0.1. The recipes below pin those versions. The registry’s own record of each version is the receipt. Open https://registry.npmjs.org/@saga-a2ui/<package>/<version> (or the package’s page on npmjs.com) to see its dist.integrity; the values should equal these: Both recipes below were run from empty directories with npm 11 on 5 November 2026 and installed these exact versions from the registry, with every package in the resulting lockfile resolved from registry.npmjs.org. Each stack pins its SDK siblings exactly, so its patch version can differ from theirs. For another release, confirm the stack version and its framework peers in npm before replacing the pins. Source manifests and candidate builds can be ahead of the registry.

​
Install one stack plus framework peers

At your application’s root, preserve existing overrides and add the following. If the application already directly declares any of these three packages, use the same exact specifier in its dependency field too; npm rejects a direct dependency and override with different specifiers (EOVERRIDE).
The DOMPurify and Hono overrides replace vulnerable transitive versions pinned or permitted by upstream dependencies. npm applies overrides only from the application root; the SDK cannot impose them through its own manifest. Regenerate the application’s lockfile after changing them. A2UI still requires Zod 3, which is covered by the Zod resource-consumption advisory. The available upstream fix is in Zod 4; forcing it into the A2UI v3 context breaks schema compatibility. These overrides do not resolve that advisory. Bound untrusted request sizes at the application’s ingress while that dependency remains in use. For Lit:
For React:
Commit the application lockfile. Each stack declares its SAGA siblings as regular dependencies with exact pins, so the application does not declare those packages separately. Use the stack root for an application-owned catalog and /faithful-card for a card application; /server is composed separately and stays out of browser bundles. A stack’s server entry requires the full application’s framework peers. For pnpm, put the equivalent Markdown override in the consumer workspace root. See React consumer dependencies for the separate A2UI Zod 3 and MCP Zod 4 contexts. Do not add direct upstream A2UI packages to a stack application.

​
Lower-level integrations

Applications that intentionally compose lower-level SDK APIs may install the packages they import, using the versions in the table above. The original four-package 0.1.0-rc.1 release remains historical; it predates the stacks. See package layout for ownership and entry points.

​
Run a demo or use a starter

Getting started creates a Lit starter or the React starter on Hono, or attaches SAGA to an existing backend, and its two tracks build an application (React, Lit, which also runs the synthetic demo). The React tutorial installs published npm packages in the reader’s own app directory. The source CLI and contributor workflows build matched candidate tarballs from a checkout to test unpublished changes. Candidates have versions such as 0.0.0-candidate.g<12 hex> and are distinct from public npm releases; see candidate installation, updates and rollback. The source CLI, root workspace and example applications are not npm packages. Continue with the Lit track or the React track to connect a view, then the action guide to trace a complete interaction. Host compatibility records the flows observed in ChatGPT, Claude and Alexa+. Installing a package does not deploy an application or establish acceptance in an assistant host.

​
Maintainer publication

Release preparation describes the seven-package set, exact tarball qualification and publication verification. Source metadata and passing CI prepare a release; successful publication followed by an anonymous exact-version install establishes registry availability. Keep current release receipts here instead of copying mutable registry status into agent instructions and development guides. For repeat releases, npm trusted publishing needs a matching package repository URL, a supported Node/npm combination and id-token: write confined to its publishing job. The existing validation workflow does not publish. Verify scope ownership and approved versions and tags before publishing with public npm access.