@reqvire-org/ads 0.3.18 → 0.3.20

package/docs/BEHAVIORS.md

@@ -366,3 +366,10 @@ Keep ESM modules and explicit imports. Avoid an eagerly imported controller
 registry. Tree shaking and shared chunks follow the project bundler: class methods,
 side effects, global CSS and dynamic maps can retain extra code. Inspect emitted
 resources instead of assuming a controller produces a minimal bundle.
+
+Development-only `review/<Owner>` units may register the same guarantee/check
+contracts for review presentation and controls. Subjects can name that owner's
+separate review API or local headless helpers; checks still run registered project
+profiles and can refer to an existing real scenario. This grants no production
+API, catalogue entry, `covers` credit or runtime import permission. See the
+[portable review guide](../skills/ads-designer/references/review.md).

package/docs/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## Unreleased
+
+## 0.3.20
+
+- Preserve the motion-review checklist separately from the development review-layer
+  guide; both remain self-contained in the motion skill. Version 0.3.19 was tagged
+  but publication was cancelled before this correction.
+
+- Separate project-owned review UI from production patterns. Add `review/` owners,
+  a configurable development entry and derived `/review` alias, guarded companion
+  exports and review contracts. Preserve real component/token render evidence,
+  block production imports and verify review assets stay out of product bundles.
+  Move the working showcase and empty starter helpers to the new layer; publish
+  self-contained migration guidance in all skills and `ads://guides/review`.
+- Enable native form validation and submit events across the showcase, diagnostic
+  explorer and legacy App iframe layers. Retain opaque App origins and block
+  native action requests through CSP. Cover click/Enter submission, custom/native
+  validation and no-network behavior in generic React, Preact and HTML Apps.
+- Enforce runtime component dependency direction and public component contracts
+  for patterns through aliases, re-exports and helpers. Reject proven private
+  style-hook/variable access while preserving ancestor-context layout and documented
+  customization. Publish portable layer guidance in every skill and through MCP.
+
 ## 0.3.18
 
 - Preserve complete typed `@property` registrations through atomic css/styled

package/docs/GUIDE.md

@@ -495,10 +495,10 @@ export default function Scenario() { return <Button>{fixture.label}</Button>; }
 IDs derive from filenames; do not maintain another registry or hand-assigned IDs.
 Token scenarios live beside foundation CSS under the configured token directory.
 The starter includes `tokens/Foundation.scenario.tsx` and its local fixture for
-a project-owned token review pattern. Keep its presentation in that pattern:
+a project-owned token review renderer. Keep its presentation in that pattern:
 
 ```tsx
-import { TokenSamples } from "@ds";
+import { TokenSamples } from "@ds/review";
 import { fixture } from "./Typography.fixture";
 export const scenario = { title: fixture.title, covers: ["TokenSamples"], samples: fixture.samples };
 export default function Scenario() { return <TokenSamples {...fixture} />; }
@@ -723,6 +723,7 @@ inspection errors fail the check. These guards read files and never delete them.
   "dsDir": "design-system",
   "publicAlias": "@ds",
   "publicEntry": "index.ts",
+  "reviewEntry": "review/index.ts",
   "stylesEntry": "styles.css",
   "tokenDir": "tokens",
   "inlineStyleFiles": [],

package/docs/MCP.md

@@ -1,5 +1,11 @@
 # ADS over MCP
 
+For component/pattern classification and dependency/style boundary diagnostics,
+read `ads://guides/layers`. A component supplies one cohesive UI capability; a
+pattern arranges capabilities into reusable structures/workflows. Guards enforce
+resolved ownership boundaries, not component counts. Scenarios may compose public
+UI to demonstrate their subject; application adapters own store access and routing.
+
 `ads mcp [directory]` serves a project's local design system over stdio. It uses
 the same `ds.config.json`, token inspection and core checks as the CLI. It reads
 source and build artifacts. Optionally it manages one configured project
@@ -54,15 +60,21 @@ managed project compiler on demand and after relevant source changes.
 Switching entries overlays a centered loading spinner, then reveals the new
 scenario inside the existing App. Loading and diagnostic overlays do not move the
 preview. Token presentation comes from project-owned scenarios, fixtures and
-public review patterns, using the project's real foundation CSS and extracted
+development-only review helpers, using the project's real foundation CSS and extracted
 styles. The App runtime contains no token sample templates or named token ordering.
 The generic definition inspector remains available without a scenario build.
 
 There are no required browser-page files in the project. Colocated scenarios and
-fixtures, optional public review-layout patterns, and the project's compiler
+fixtures, optional development-only review helpers, and the project's compiler
 entry supply the presentation. Use the existing runtime URL when MCP is connected
 instead of starting a second compiler for that project.
 
+Development review UI lives in `review/`, behind a separate development entry;
+production patterns remain application UI. Discover `ads_status.project.review`
+and read `ads://guides/review` for imports, guarded owners and migration. Review
+exports are not product catalogue entries. They can frame real scenarios and
+render token samples without entering the deployed application's graph.
+
 ## Connect Codex or Claude
 
 Use the published package through `npx`. No ADS checkout or global installation
@@ -397,6 +409,7 @@ The same discovery covers the rest of the project ADS:
 
 | Unit | Scope |
 |------|-------|
+| `review/<Owner>` | Development-only frames, token renderers, demo controls, local checks and review-entry re-exports |
 | `foundation` | Shared ADS entry styles and root helpers |
 | `documentation` | ADS/project guides, shared credits and license notices, and `licenses/` text collections |
 | `assets/brand`, `assets/fonts`, other `assets/*` groups | Original SVG, image, font and other asset files |
@@ -509,8 +522,8 @@ Install changed dependencies before verification; candidates use the project's
 installed `node_modules`.
 
 Resolve ownership diagnostics by preserving the required capability in its proper
-layer. Demo-only sizing, borders and framing belong in a public review/layout
-pattern; a component API addition needs a runtime use case. Measured imperative
+layer. Demo-only sizing, borders and framing belong in a development-only review
+helper; a component API addition needs a runtime use case. Measured imperative
 geometry uses exact `styleWrites` properties. After migrating JSX inline geometry,
 replace its own boundary entries in the same owner patch and check the final state.
 After the gates pass, verify the behavior in a browser.
@@ -518,7 +531,7 @@ After the gates pass, verify the behavior in a browser.
 A small change needs only its hunk. A complete new component may include its
 implementation, public re-export, scenario and fixture in the same unit patch,
 so coverage is checked against a complete candidate. New units use a new
-`components/`, `patterns/` or `composition/` owner ID following the same colocation
+`components/`, `patterns/`, `controllers/`, `review/` or `composition/` owner ID following the same colocation
 convention. A patch cannot include a peer unit, capture existing peers beneath
 a new directory owner, or change unrelated public-entry statements. Shared
 public-entry changes are limited to re-exports from the selected unit. Alongside
@@ -652,6 +665,14 @@ origin hosts the sandbox proxy; that proxy creates an opaque inner App iframe
 and forwards the standard Apps bridge messages. The diagnostic explorer follows
 the same sandbox model. Only the App materializes and executes project resources.
 
+Both ADS hosts allow native form validation and submission events through all
+iframe layers. Client-side forms use their intended `submit` handlers and
+`preventDefault()`. CSP `form-action 'none'` blocks native action requests;
+`allow-forms` grants neither host DOM access nor top-level navigation. External
+hosts choose their own permissions. See the portable
+[scenario guide](../skills/ads-designer/references/scenarios.md#forms-inside-apps)
+for verification and diagnosis.
+
 For inline documents without an explicit App base URL, ADS supplies
 `<base href="about:srcdoc">` and permits the local `about:` base scheme in CSP.
 Bare and named fragment links retain native in-document navigation and state.
@@ -1023,7 +1044,7 @@ instruction reads alone do not establish Apps/Skills activation.
 ### Token sample verification
 
 Token scenarios declare `samples: fixture.samples` and render a project-owned public
-review pattern with that `samples` input. Each fixture record has `{ token, property,
+review renderer with that `samples` input. Each fixture record has `{ token, property,
 probe }`; the tool discovers the resulting token names. Plain token lists and empty
 covers do not satisfy review coverage. The same bindings travel in the compiled
 resource manifest or self-contained App seed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reqvire-org/ads",
-  "version": "0.3.18",
+  "version": "0.3.20",
   "type": "module",
   "description": "A design system your agent can see and shape. Your components. Your look. Your code.",
   "repository": {

package/dist/bootstrap-ds/design-system/patterns/token-preview/Scenario.tsx

@@ -1,4 +0,0 @@
-import { TokenPreview } from "@ds";
-import { fixture } from "./fixture";
-export const scenario = { title: fixture.title, covers: ["TokenPreview"] };
-export default function Scenario() { return <TokenPreview {...fixture} />; }

package/dist/bootstrap-ds/design-system/patterns/token-preview/fixture.ts

@@ -1,8 +0,0 @@
-export const fixture = {
-  "title": "Token preview",
-  "text": "Aa",
-  samples: [
-    {"token": "--accent", "property": "background-color", "probe": "rgb(31, 97, 163)"},
-    {"token": "--space-4", "property": "width", "probe": "13.375px"},
-  ]
-} as const;

package/dist/skills/ads-designer/assets/bootstrap-ds/design-system/patterns/token-preview/Scenario.tsx

@@ -1,4 +0,0 @@
-import { TokenPreview } from "@ds";
-import { fixture } from "./fixture";
-export const scenario = { title: fixture.title, covers: ["TokenPreview"] };
-export default function Scenario() { return <TokenPreview {...fixture} />; }

package/dist/skills/ads-designer/assets/bootstrap-ds/design-system/patterns/token-preview/fixture.ts

@@ -1,8 +0,0 @@
-export const fixture = {
-  "title": "Token preview",
-  "text": "Aa",
-  samples: [
-    {"token": "--accent", "property": "background-color", "probe": "rgb(31, 97, 163)"},
-    {"token": "--space-4", "property": "width", "probe": "13.375px"},
-  ]
-} as const;