[josemontespg]

Summary

Re-exports isSafeRegex and SafeRegexOptions from @a2ui/web_core/v1_0. The function already backs the basic catalog's regex validation and is exported from /v0_9. The v1.0 MCP catalog needs it to accept regular expressions from agents without pulling in the v0.9 entry point or a second ReDoS checker.

Changes

• typescript/core/web_core/src/common/safe_regex.ts (moved from v0_9/basic_catalog/functions/, with its test): the check is version-agnostic, so it lives next to common/basic_functions.ts and the root, v0.8, v0.9 and v1.0 entry points all re-export it from there instead of reaching into the v0.9 tree.
• typescript/core/web_core/src/v1_0/index.ts: export isSafeRegex and type SafeRegexOptions.
• typescript/core/web_core/CHANGELOG.md: Unreleased entry.

Verification

• yarn workspace @a2ui/web_core run build and run lint pass locally.

[gemini-code-assist]

Code Review

This pull request exports isSafeRegex and SafeRegexOptions from the v0_9 directory in v1_0/index.ts. Feedback suggests moving safe_regex.ts to a shared location (such as src/validation/ or src/common/) to avoid introducing a backward dependency on an older version's internal structure, which could cause issues if v0_9 is deprecated or removed in the future.

[ditman]

The move itself is pretty mechanical, and I'm fine with it!

HOWEVER, this introduces a very specific dependency with "redos-detector" into the root of the web_core package.

I think this was OK when it was part of the catalog implementation, because we've been looser with taking dependencies there (the catalog is an optional package for end users).

IMO we should not export this from the root of the package, and keep it under "catalog".

If we want to export this from the root of web_core, IMO we should instead expose an interface for the implementation of the isSafeRegex function (similar to how we render markdown) that end users may optionally inject using the same mechanism as what we do in markdown. Then, we can provide a "redos-detector" package implementation that users can use conveniently.

But mandating a dependency on a specific package looks a little bit too opinionated (when there's alternatives)

[josemontespg]

Thanks for the review! Applied the suggested changes. PTAL when you can.

[josemontespg]

Agreed. @a2ui/catalog-mcp now carries its own copy of the ReDoS check (src/functions/safe_regex.ts, backed by redos-detector) in #3574, so web_core keeps its current API and this PR is not needed. Closing.

[ditman]

Thanks for simplifying this way from web_core!