mweinbach4/19/2026, 2:13:43 AM

This closes the latest PR #83 review gap in the shared A2UI parser. The
byte-cap guard now applies to object envelopes as well as JSON strings, which
matches the real a2ui tool path and preserves the intended memory/latency
protection before downstream validation and session processing.

Constraint: The shared parser must reject oversized A2UI payloads before schema validation and runtime folding
Rejected: Rely on downstream surface-manager caps only | too late for large object envelopes and bypasses the documented parser guard
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep parser-level A2UI size checks symmetric across string and object inputs whenever the envelope contract changes
Tested: bun test test/a2ui/protocol.test.ts test/tools/a2ui.test.ts test/a2ui/surfaceManager.test.ts; bun run typecheck; bun test --max-concurrency 1
Not-tested: GitHub Actions on the new commit

Parent4ff42e4