A2uiImageLoader

How a host draws the image at a URL.

This module does not fetch anything, and that is deliberate. Compose Multiplatform has no remote image of its own, so drawing one means an HTTP stack and a cache -- an engine-sized dependency in a module whose job is a design-system adapter. A host almost always already has one, and a host that does not can add Coil in a line:

CompositionLocalProvider(
    LocalA2uiImageLoader provides A2uiImageLoader { url, description, scale, modifier ->
        AsyncImage(model = url, contentDescription = description, contentScale = scale, modifier = modifier)
    },
) { A2uiSurface(/* ... */) }

The modifier handed in already carries the size the variant asks for and the margin the layout needs; an implementation should pass it to whatever it draws rather than sizing the image itself.

url is guaranteed to be an absolute http or https URL, and that guarantee is the same one the core gives UrlOpener. Fetching an agent's string is a capability, and the two places this library hands one over should not disagree about who filters it: the evaluator applies the specification's allowlist before openUrl reaches a host, and ImageRenderer applies the same one before a loader does. A url with any other scheme draws the placeholder instead.

What that refuses is worth naming, because an image loader would otherwise accept it. file:// and, on Android, content:// resolve through the usual loaders, so a payload could name a local path and learn from whether the image appeared that it was readable. It does not refuse the ordinary risk of a remote URL, which no allowlist can: an https image the agent chose is still fetched the moment the surface composes, with no gesture, disclosing the viewer's address and user agent to whoever the agent named. A host rendering untrusted agents may want to decide separately whether an image may be fetched before the user has asked to see it.

data: is refused too, so a host that wants inline images registers its own Image renderer -- the same escape hatch Icon offers for a host that wants the real Material Symbols set.

Hand over the same instance every time. Image's and Video's calls to Image are keyed on the loader instance (#31), so a loader rebuilt on every recomposition of the scope providing it -- the example above, if that scope recomposes -- drops whatever it remembered for each image, its request state included. Hoist it to a top-level val or remember it.