@adia-ai/adia-ui-factory 0.8.63 → 0.8.65

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "adia-ui-kit-factory",
-  "version": "0.8.63",
+  "version": "0.8.65",
   "description": "Author and verify apps built ON the adia-ui (@adia-ai) light-DOM web-component framework \u2014 orient, scaffold, compose, wire, verify, and migrate across SPA and SSR rendering modes. Wires the a2ui MCP for catalog retrieval, UI generation, and validation.",
   "author": {
     "name": "Kim",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "adia-ui-kit-factory",
-  "version": "0.8.63",
+  "version": "0.8.65",
   "description": "Author and verify apps built ON the adia-ui (@adia-ai) light-DOM web-component framework — orient, scaffold, compose, wire, verify, and migrate across SPA and SSR rendering modes. Wires the a2ui MCP for catalog retrieval, UI generation, and validation.",
   "author": {
     "name": "Kim",

package/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "adia-gen-ui": {
       "command": "npx",
-      "args": ["-y", "@adia-ai/mcp@0.8.63", "gen-ui"]
+      "args": ["-y", "@adia-ai/mcp@0.8.65", "gen-ui"]
     }
   }
 }

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog — adia-ui-kit-factory
 
+## [0.8.65] — 2026-09-14
+
+### Changed
+
+- chore: `.codex-plugin/plugin.json` version bump only, mirroring `.claude-plugin/plugin.json`'s lockstep bump; no skill or command content change.
+
+### Maintenance
+- **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.65 work shipped in A2UI renderer tree-build cycle guard now checks real DOM ancestry (ticket 10054). See `packages/gen-ui/a2ui/CHANGELOG.md#0865--2026-09-14` for details.
+- **`.claude-plugin/plugin.json` version bump**: moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`): carried by the entry above.
+
+## [0.8.64] — 2026-09-13
+
+### Changed
+
+- chore: allowlist 7 verified real script/prose G8 names, per-plugin `.release-gate-g8-allow.json` (ticket 10036) (#4407)
+- chore: de-reference the phantom `component-token-audit` citations in theme-audit's description and body (ticket 10036) (#4409)
+
+### Docs
+
+- docs: host-wiring gains an A2UI-rendering-hosts paragraph, stating an `<a2ui-root>`-embedding host needs no manual per-component JS/CSS import for LLM-composed content, and must not add one (adr-0115, lld-0037, ticket 10041) (local ticket 10041)
+- docs: clarify tools/delegate_tool.py is a path inside the external Hermes Agent install, not this repo (#4411)
+
+### Maintenance
+- **`.claude-plugin/plugin.json` version bump**: moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`): carried by the entries above.
+- **`skills/` touched in this release window** (4 file(s), e.g. `host-wiring/SKILL.md`): carried by the entries above.
+
 ## [0.8.63] — 2026-09-12
 
 ### Changed

package/README.md

@@ -163,7 +163,7 @@ attributes vs. the shipped component contracts), and `adia-theme-audit.mjs`
 
 ## MCP
 
-`adia-gen-ui` server pinned: `@adia-ai/mcp@0.8.63` (tool SoT:
+`adia-gen-ui` server pinned: `@adia-ai/mcp@0.8.65` (tool SoT:
 `packages/gen-ui/mcp/TOOLS.md` — the `gen-ui` section; stability rule in
 `references/contracts/`; pin lives in `.mcp.json` — `check:plugin-count-claims`
 guards this README copy against it). The server is `adia-mcp gen-ui`,
@@ -237,7 +237,8 @@ Pi has no native MCP support at all, so a Pi session without the third-party
   no automatic wiring. `__init__.py` registers the portable `ui-architect`
   skill (ADR-0091) alongside every other skill, **and** a generated
   `/ui-architect` command — verified against the installed Hermes Agent's
-  real `PluginContext.register_command` + `dispatch_tool` and
+  real `PluginContext.register_command` + `dispatch_tool` and, inside that
+  same external Hermes Agent install (not a path in this repo),
   `tools/delegate_tool.py`'s `delegate_task(goal, context, role, …)` (not
   assumed from documentation): each of planning, composition, and QA runs
   as its own isolated `delegate_task` child (`role="leaf"`), gated by the

package/__init__.py

@@ -313,7 +313,7 @@ def register(ctx):
     ctx.register_skill(
         name="theme-audit",
         path=Path(os.path.join(_HERE, "skills", "theme-audit", "SKILL.md")),
-        description="Classifies a consumer app's theme.css against what the adia-ui framework already ships — restated defaults, re-derived tokens, dead selectors, and hand-built component work. Runs `adia-theme-audit` against a theme file + app root; audits and reports, never rewrites. Use when a theme.css is suspected of restating the kit, after bumping `@adia-ai/web-components`, or before a `find-unused` sweep. NOT for rendering/grading a surface (surface-qa); NOT for picking a token going forward (token-selection); NOT for JS/markup an upgrade left unused (find-unused — the CSS-side sibling); NOT for the framework's OWN token layer in packages/web-components (forge's component-token-audit).",
+        description="Classifies a consumer app's theme.css against what the adia-ui framework already ships, restated defaults, re-derived tokens, dead selectors, and hand-built component work. Runs `adia-theme-audit` against a theme file + app root; audits and reports, never rewrites. Use when a theme.css is suspected of restating the kit, after bumping `@adia-ai/web-components`, or before a `find-unused` sweep. NOT for rendering/grading a surface (surface-qa); NOT for picking a token going forward (token-selection); NOT for JS/markup an upgrade left unused (find-unused, the CSS-side sibling); NOT for the framework's OWN token layer in packages/web-components (a capability this skill's own body also references, not yet a shipped skill in either plugin, ticket 10036).",
     )
     ctx.register_skill(
         name="token-selection",

package/hermes-mcp.yaml

@@ -6,5 +6,5 @@ mcp_servers:
     command: "npx"
     args:
       - "-y"
-      - "@adia-ai/mcp@0.8.63"
+      - "@adia-ai/mcp@0.8.65"
       - "gen-ui"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adia-ai/adia-ui-factory",
-  "version": "0.8.63",
+  "version": "0.8.65",
   "description": "Author and verify apps built ON the adia-ui (@adia-ai) light-DOM web-component framework — orient, scaffold, compose, wire, verify, and migrate across SPA and SSR rendering modes. Wires the a2ui MCP for catalog retrieval, UI generation, and validation.",
   "keywords": [
     "adia-ui",

package/plugin.yaml

@@ -1,4 +1,4 @@
 name: "adia-ui-kit-factory"
-version: "0.8.63"
+version: "0.8.65"
 description: "Author and verify apps built ON the adia-ui (@adia-ai) light-DOM web-component framework — orient, scaffold, compose, wire, verify, and migrate across SPA and SSR rendering modes. Wires the a2ui MCP for catalog retrieval, UI generation, and validation."
 manifest_version: 1

package/skills/host-wiring/SKILL.md

@@ -61,6 +61,16 @@ or the toggle dies (gh#296). Full detail, exact paths, and the fail-loud probe:
 [`references/mode-wiring-detail.md`](references/mode-wiring-detail.md)
 §Icons + the module barrels.
 
+## A2UI-rendering hosts: no manual per-component import
+
+A host embedding `<a2ui-root>` (directly, or via `<canvas-ui>`) for
+LLM-composed content needs no per-component JS/CSS import for that
+content: `ensure()` already loads on demand what a payload actually
+names. Importing the full component barrel to "be safe" defeats that,
+never adds it (adr-0115, lld-0037, ticket 10041). Full detail:
+[`references/mode-wiring-detail.md`](references/mode-wiring-detail.md)
+§A2UI-rendering hosts.
+
 ## CDN / HTML-first, SPA, SSR, hybrid — build order per mode
 
 Each mode has its own build order and gotchas — load exactly one bundle for
@@ -99,7 +109,8 @@ Gates:           registration / route-owner / CSS-links / state — pass | fail,
 
 - [`references/mode-wiring-detail.md`](references/mode-wiring-detail.md) —
   load when actually wiring a host: icon-loader + shell-barrel gotchas
-  (gh#287, gh#296), CDN/HTML-first, SPA, SSR, and hybrid full procedure.
+  (gh#287, gh#296), A2UI-rendering hosts (adr-0115, ticket 10041),
+  CDN/HTML-first, SPA, SSR, and hybrid full procedure.
 - [`references/spa-architecture.md`](../../references/spa-architecture.md) —
   load before writing or editing an SPA host: host document, cascade +
   registration invariants, surface container, router snippets.

package/skills/host-wiring/references/mode-wiring-detail.md

@@ -25,6 +25,27 @@ Two host-wiring details the shared contract doesn't cover — each fails
   `@adia-ai/web-modules/shell/admin-shell.css` (the three-segment
   `/shell/admin-shell/admin-shell.css` is blocked by the exports map, gh#296).
 
+## A2UI-rendering hosts (LLM-composed content, never a manual per-component import)
+
+A host embedding `<a2ui-root>` (directly, or wrapped by `<canvas-ui>`) to
+render LLM-composed A2UI content needs no per-component JS/CSS import for
+anything that content itself renders, and per adr-0115 must not add one:
+`<a2ui-root>` already awaits `asset-loader.js`'s `ensure()` for a
+message's own component types before applying it, so the tag currently
+being composed loads on demand, and only that tag, whatever the payload
+turns out to contain. Importing the full component barrel
+(`@adia-ai/web-components`'s `components/index.js`, or the package-level
+barrel) ahead of this to "be safe" defeats that mechanism for every tag it
+covers instead of adding safety: the tags load anyway; the host just pays
+for the whole catalog on every canvas regardless of what it actually uses
+(lld-0037, ticket 10041: the fix for the exact shape gen-ui's own
+playground carried before this record). This rule is scoped to the
+surface whose composition is decided at generation time; a host's own
+fixed chrome (its shell, toolbar, or any always-present component the host
+itself authors directly) is unaffected and keeps whatever import shape it
+already uses, the two are wired the same way they always were, side by
+side in the same entry file.
+
 ## CDN / HTML-first consumption (no bundler)
 
 For CodePen, marketing pages, static HTML, or a prompt-to-app / Figma-Make

package/skills/theme-audit/SKILL.md

@@ -2,15 +2,16 @@
 name: theme-audit
 description: >-
   Classifies a consumer app's theme.css against what the adia-ui
-  framework already ships — restated defaults, re-derived tokens, dead
+  framework already ships, restated defaults, re-derived tokens, dead
   selectors, and hand-built component work. Runs `adia-theme-audit`
   against a theme file + app root; audits and reports, never rewrites.
   Use when a theme.css is suspected of restating the kit, after bumping
   `@adia-ai/web-components`, or before a `find-unused` sweep. NOT for
   rendering/grading a surface (surface-qa); NOT for picking a token going
   forward (token-selection); NOT for JS/markup an upgrade left unused
-  (find-unused — the CSS-side sibling); NOT for the framework's OWN token
-  layer in packages/web-components (forge's component-token-audit).
+  (find-unused, the CSS-side sibling); NOT for the framework's OWN token
+  layer in packages/web-components (a capability this skill's own body also
+  references, not yet a shipped skill in either plugin, ticket 10036).
 disable-model-invocation: false
 user-invocable: true
 ---
@@ -113,10 +114,10 @@ never ran is not a class that found nothing.
   retired enum values). This skill is the CSS-side sibling of that same
   "what's inert" question — reach for `find-unused` first on a fresh
   upgrade, then this skill on the theme file specifically.
-- **forge's `component-token-audit`** runs framework-side, against
-  `packages/web-components`'s own token layer in this monorepo. This skill
-  never touches framework source; it always targets a consumer app's own
-  theme file.
+- **A framework-side, `packages/web-components`-token-layer audit** is a
+  distinct, not-yet-shipped capability (ticket 10036) in this monorepo. This
+  skill never touches framework source; it always targets a consumer app's
+  own theme file.
 
 ## The one hard rule
 

package/skills/theme-audit/agents/openai.yaml

@@ -1,3 +1,3 @@
 interface:
   display_name: "Theme Audit"
-  short_description: "Classifies a consumer app's theme.css against what the adia-ui framework already ships — restated defaults, re-derived tokens, dead selectors, and hand-built component work."
+  short_description: "Classifies a consumer app's theme.css against what the adia-ui framework already ships, restated defaults, re-derived tokens, dead selectors, and hand-built component work."