n4ff4h · Nov 1, 2026 · Nov 1, 2026 · Nov 1, 2026 · Nov 1, 2026 · Nov 1, 2026
diff --git a/.changeset/config.json b/.changeset/config.json
@@ -2,7 +2,7 @@
   "$schema": "https://unpkg.com/@changesets/config@3.0.0/schema.json",
   "changelog": "@changesets/cli/changelog",
   "commit": false,
-  "fixed": [],
+  "fixed": [["@javaabu/onu", "@javaabu/onu-mcp"]],
   "linked": [],
   "access": "public",
   "baseBranch": "main",

diff --git a/.changeset/drop-unused-peers.md b/.changeset/drop-unused-peers.md
@@ -0,0 +1,5 @@
+---
+"@javaabu/onu": patch
+---
+
+Removed four optional peers nothing imports: `@tiptap/extension-link`, `@tiptap/extension-drag-handle-react`, `@tiptap/extension-code-block-lowlight` and `lowlight`.
diff --git a/.changeset/peer-form-and-query.md b/.changeset/peer-form-and-query.md
@@ -0,0 +1,5 @@
+---
+"@javaabu/onu": minor
+---
+
+`react-hook-form` and `@tanstack/react-query` are now peer dependencies. `getOnuQueryClient` is gone: the fallback client belongs to each `OnuProvider`, and `invalidateApiOptions` takes the client first.
diff --git a/.changeset/react-19-only.md b/.changeset/react-19-only.md
@@ -0,0 +1,5 @@
+---
+"@javaabu/onu": minor
+---
+
+Onu now requires React 19; React 18 is no longer in the peer range.
diff --git a/.changeset/remove-base-ui-combobox.md b/.changeset/remove-base-ui-combobox.md
@@ -0,0 +1,5 @@
+---
+"@javaabu/onu": minor
+---
+
+Removed the unused `Combobox` primitive from `@javaabu/onu/primitives`, and with it the `@base-ui/react` dependency.
diff --git a/.changeset/thaana-fonts-always.md b/.changeset/thaana-fonts-always.md
@@ -0,0 +1,5 @@
+---
+"@javaabu/onu": patch
+---
+
+Faruma and MV Faseyha now load from `tailwind.css` and `styles.css`, so Thaana text works without the optional font pack.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -41,6 +41,7 @@ jobs:
               exit 1
             fi
           done
+          node scripts/sync-plugin-version.mjs --check
       - name: Check the npm token
         run: |
           if [ -z "$NPM_TOKEN" ]; then

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -85,10 +85,10 @@ Every change that affects a published package adds a changeset (`pnpm changeset`
 
 To release:
 
-1. On `dev`, run `pnpm changeset version`. It bumps every package with pending changesets, writes their `CHANGELOG.md` and deletes the changesets. All packages share one version, so check that `packages/onu` and `packages/onu-mcp` match.
+1. On `dev`, run `pnpm changeset version && node scripts/sync-plugin-version.mjs`. `@javaabu/onu` and `@javaabu/onu-mcp` are a fixed group in `.changeset/config.json`, so they always move to the same version; the script copies that version into `plugins/onu/.claude-plugin/plugin.json`, which changesets can't see. `changeset version` also writes their `CHANGELOG.md` and deletes the changesets.
 2. Commit (`Release v0.1.0`) and merge `dev` into `main`. Wait for CI to pass on `main`.
 3. Tag that commit on `main` and push the tag: `git tag v0.1.0 && git push origin v0.1.0`.
 
-The **Release** workflow runs only for `v*` tags. It checks that the tagged commit is on `main` and that every package's version matches the tag, then builds and publishes to npm (versions already on npm are skipped). Tags with a pre-release suffix (`v1.0.0-beta.1`) publish under the `next` dist-tag.
+The **Release** workflow runs only for `v*` tags. It checks that the tagged commit is on `main` and that every package's version and the plugin's match the tag, then builds and publishes to npm (versions already on npm are skipped). Tags with a pre-release suffix (`v1.0.0-beta.1`) publish under the `next` dist-tag.
 
 Publishing needs an `NPM_TOKEN` repository secret: an npm granular access token with read and write access to the `@javaabu` scope and "bypass 2FA" allowed, from an account that can publish to `@javaabu`. Write tokens expire after about 90 days. Provenance is signed only once the repository is public. After the first release, you can switch to npm trusted publishing (each package's settings on npmjs.com, pointing at `release.yml`) and remove the token.
diff --git a/DEPENDENCIES.md b/DEPENDENCIES.md
@@ -9,7 +9,6 @@ Selection order: shadcn/ui component → reputable library (shadcn ecosystem fir
 | Package                                            | Purpose                                                                    | Licence    | Notes                                                                                            |
 | -------------------------------------------------- | -------------------------------------------------------------------------- | ---------- | ------------------------------------------------------------------------------------------------ |
 | `radix-ui`                                         | Accessible primitives behind the shadcn components                         | MIT        | shadcn default base                                                                              |
-| `@base-ui/react`                                   | Combobox primitive (shadcn's combobox)                                     | MIT        | From the Radix / MUI team                                                                        |
 | `class-variance-authority`                         | Variants (`buttonVariants`, …)                                             | Apache-2.0 | Stable and feature-complete; last release 2024 (exception to the 12-month rule, used by shadcn)  |
 | `clsx`, `tailwind-merge`                           | `cn()` class merging so consumer classes win                               | MIT        |                                                                                                  |
 | `tw-animate-css`                                   | Enter/exit animations                                                      | MIT        | shadcn default                                                                                   |
@@ -19,25 +18,27 @@ Selection order: shadcn/ui component → reputable library (shadcn ecosystem fir
 | `vaul`                                             | Drawer / bottom sheet                                                      | MIT        | shadcn `drawer`. **Watch-list**: reduced maintenance (R4.3); kept behind Onu's API               |
 | `input-otp`                                        | OTP input                                                                  | MIT        | shadcn `input-otp`                                                                               |
 | `react-day-picker`, `date-fns`                     | Calendar and date maths                                                    | MIT        | shadcn `calendar`; Dhivehi locale maintained in Onu                                              |
-| `@internationalized/date`                          | Hijri (Umm al-Qura) calendar maths, date/time fields                       | Apache-2.0 | Adobe                                                                                            |
-| `react-aria-components`                            | Tree, colour picker, date/time segment fields                              | Apache-2.0 | Adobe; fills Radix gaps (§4 step 3)                                                              |
+| `@internationalized/date`                          | Hijri (Umm al-Qura) calendar maths, date/time segment fields               | Apache-2.0 | Adobe                                                                                            |
+| `react-aria-components`                            | Tree, colour picker                                                        | Apache-2.0 | Adobe; fills Radix gaps (§4 step 3)                                                              |
 | `embla-carousel-react`                             | Carousel                                                                   | MIT        | shadcn `carousel`                                                                                |
-| `react-hook-form`                                  | Form state                                                                 | MIT        |                                                                                                  |
 | `@tanstack/react-table`, `@tanstack/react-virtual` | Tables, data grid, virtualised lists                                       | MIT        |                                                                                                  |
-| `@tanstack/react-query`                            | API select caching and de-duplication                                      | MIT        | R16.5                                                                                            |
 | `@dnd-kit/react`, `@dnd-kit/helpers`               | Drag and drop (kanban, sortable lists, row reordering) with touch sensors  | MIT        | The maintained successor of `@dnd-kit/core`                                                      |
 | `@dnd-kit/dom`                                     | dnd-kit's `Accessibility` plugin, configured with translated announcements | MIT        | Already installed by `@dnd-kit/react`; imported directly so drag announcements follow the locale |
 | `react-phone-number-input`                         | Phone input (libphonenumber)                                               | MIT        | Default region MV                                                                                |
 | `@sindresorhus/slugify`                            | Slug generator                                                             | MIT        |                                                                                                  |
 | `uqr`                                              | QR code encoding for `QrCode` (media entry); Onu renders the SVG           | MIT        | unjs; zero-dep, typed. Picked over `qrcode` (Node deps), `qrcode-generator` (stale)              |
 
+## Peers (core)
+
+`react-hook-form` (form state, MIT) and `@tanstack/react-query` (API select caching and de-duplication, R16.5, MIT) are required peers, alongside `react` and `react-dom`. Onu reads their React context, so the app and Onu must resolve the same copy. They stay required because the core entry imports them statically.
+
 ## Optional peers (entry points)
 
 | Entry                             | Packages                                                                                                                                                                                                                                                     | Licence                                                         |
 | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- |
 | `@javaabu/onu/charts`             | `recharts`                                                                                                                                                                                                                                                   | MIT                                                             |
 | `@javaabu/onu/maps`               | `@vis.gl/react-google-maps`, `terra-draw`, `terra-draw-google-maps-adapter`, `@googlemaps/markerclusterer`, `@deck.gl/core`, `@deck.gl/layers`, `@deck.gl/aggregation-layers`, `@deck.gl/google-maps`, `@turf/turf`                                          | MIT / Apache-2.0                                                |
-| `@javaabu/onu/editor`             | `@tiptap/core`, `@tiptap/react`, `@tiptap/pm`, `@tiptap/starter-kit`, `@tiptap/static-renderer`, `@tiptap/suggestion` (slash menu), `@tiptap/extension-*` (MIT packages only), `lowlight`, `shiki`                                                           | MIT                                                             |
+| `@javaabu/onu/editor`             | `@tiptap/core`, `@tiptap/react`, `@tiptap/pm`, `@tiptap/starter-kit`, `@tiptap/static-renderer`, `@tiptap/suggestion` (slash menu), `@tiptap/extension-*` (MIT packages only), `shiki`                                                                       | MIT                                                             |
 | `@javaabu/onu/calendar`           | `@fullcalendar/core`, `@fullcalendar/react`, `@fullcalendar/daygrid`, `@fullcalendar/timegrid`, `@fullcalendar/list`, `@fullcalendar/interaction` (standard plugins only, v6)                                                                                | MIT                                                             |
 | `@javaabu/onu/media`              | `react-easy-crop`, `signature_pad`, `barcode-detector`, `yet-another-react-lightbox`, `media-chrome`                                                                                                                                                         | MIT                                                             |
 | `@javaabu/onu/export`             | `write-excel-file` (Excel `.xlsx` only; CSV and PDF need nothing). Loaded with `import()` on the first Excel export. Chosen over the npm `xlsx` (SheetJS) package, whose npm release is outdated; supports right-to-left sheets and keeps Thaana text intact | MIT                                                             |

diff --git a/README.md b/README.md
@@ -24,8 +24,8 @@ See [`REQUIREMENTS.md`](REQUIREMENTS.md) for the full specification and [`docs/`
 ## Install
 
 ```bash
-npm install @javaabu/onu
-# optional font pack (Inter, JetBrains Mono, Noto Sans Thaana; Faruma and MV Faseyha are bundled)
+npm install @javaabu/onu react-hook-form @tanstack/react-query
+# optional font pack (Inter, JetBrains Mono, Noto Sans Thaana; Faruma and MV Faseyha come with tailwind.css and styles.css)
 npm install @fontsource-variable/inter @fontsource-variable/jetbrains-mono @fontsource-variable/noto-sans-thaana
 ```
 

diff --git a/REQUIREMENTS.md b/REQUIREMENTS.md
@@ -86,7 +86,7 @@ This document captures the requirements, constraints and full build list for Onu
   - `@javaabu/onu/styles.css` — theme tokens + base styles
   - `@javaabu/onu/tailwind.css` — Tailwind `@theme` / `@source` entry for consumers
 - **R2.6** Heavy or licensed third-party dependencies (map SDKs, chart libs, editors, scanners, FontAwesome, fonts) are **optional peer dependencies**, required only when the matching subpath is imported.
-- **R2.7** Peer dependencies: `react` and `react-dom` `^18.3 || ^19`, `tailwindcss` `^4`.
+- **R2.7** Peer dependencies: `react` and `react-dom` `^19`, `tailwindcss` `^4`.
 - **R2.8** Ship TypeScript declarations; source written in TypeScript `strict` mode. No `any` in public APIs.
 - **R2.9** Every client component file carries a `"use client"` directive so it works in React Server Component environments (Next.js App Router).
 - **R2.10** Semantic versioning. Releases managed with [Changesets](https://github.com/changesets/changesets); `CHANGELOG.md` generated from them.
@@ -181,7 +181,7 @@ A dependency must meet **all** of these criteria:
 - **Maintained**: a release or meaningful commit within the last 12 months, a responsive issue tracker, and not archived or deprecated.
 - **Reputable**: widely adopted, and backed by an organisation or established maintainers.
 - **Typed**: first-party TypeScript types.
-- **Compatible**: React 18 and 19, SSR-safe, tree-shakable.
+- **Compatible**: React 19, SSR-safe, tree-shakable.
 - **Accessible and RTL-capable**, or can be made so by wrapping.
 - **Reasonable bundle size** for what it provides.
 

diff --git a/docs/choice-inputs/api-select.md b/docs/choice-inputs/api-select.md
@@ -35,7 +35,7 @@ import { ApiSelect } from '@javaabu/onu';
 - **Paging**: when the response says there is a next page (`meta.last_page`, `last_page`, `next_page_url`, `links.next`, `next_cursor`), the next page loads as the list scrolls to the end.
 - **Preloading**: options load when the list opens, or immediately with `preload`.
 - **States**: loading, empty ("No results for …"), and an error with a **Retry** button. All are announced in a polite live region.
-- **Caching**: per endpoint + params + query, for `staleTime` (5 minutes). After creating a record elsewhere, call `invalidateApiOptions(url)` (or `queryClient.invalidateQueries({ queryKey: apiOptionsQueryKey(url) })` with your own client). Quick-create (`onCreate`) invalidates automatically.
+- **Caching**: per endpoint + params + query, for `staleTime` (5 minutes). After creating a record elsewhere, call `invalidateApiOptions(client, url)` with the client from `useOnuQueryClient()` (or `queryClient.invalidateQueries({ queryKey: apiOptionsQueryKey(url) })` with your own). Quick-create (`onCreate`) invalidates automatically.
 - **No requests without a URL or fetcher** you supply; CSRF and auth headers are yours to add (`headers`, `credentials`).
 
 ## Props
@@ -70,7 +70,7 @@ Values are strings (`id: 12` becomes `"12"`), so they round-trip through forms u
 
 ## Data layer
 
-The helpers behind it are exported for Autocomplete and your own components: `fetchApiOptions`, `parseApiResponse`, `parseApiItem`, `mapApiItem`, `detectHasMore`, `buildUrl`, `requestJson`, `useOnuQueryClient`, `getOnuQueryClient`, `invalidateApiOptions`, `apiOptionsQueryKey`.
+The helpers behind it are exported for Autocomplete and your own components: `fetchApiOptions`, `parseApiResponse`, `parseApiItem`, `mapApiItem`, `detectHasMore`, `buildUrl`, `requestJson`, `useOnuQueryClient`, `invalidateApiOptions`, `apiOptionsQueryKey`.
 
 ## Accessibility
 

diff --git a/docs/guides/dhivehi-and-locales.md b/docs/guides/dhivehi-and-locales.md
@@ -101,4 +101,4 @@ Charts have their own `useChartFormat` in `@javaabu/onu/charts`, with axis and p
 
 # Fonts
 
-Dhivehi text uses Faruma, with MV Faseyha for headings and bold, both bundled with `fonts.css`. See [Fonts](./fonts).
+Dhivehi text uses Faruma, with MV Faseyha for headings and bold, both loaded by `tailwind.css`. See [Fonts](./fonts).
diff --git a/docs/guides/fonts.md b/docs/guides/fonts.md
@@ -29,13 +29,11 @@ All of these are self-hosted from npm, so no requests go to a font CDN.
 
 # Thaana fonts
 
-Onu ships Faruma and MV Faseyha with `fonts.css`, as `woff2` files subset to Thaana and its punctuation (about 12 kB each). Their `unicode-range` means a browser only downloads them when a page shows Thaana text, and Latin text in a mixed sentence stays in Inter.
+`tailwind.css` and `styles.css` load Faruma and MV Faseyha, so they work without `fonts.css` and its packages. They ship as `woff2` files subset to Thaana and its punctuation (about 12 kB each). Their `unicode-range` means a browser only downloads them when a page shows Thaana text, and Latin text in a mixed sentence stays in Inter.
 
 - **Faruma** is used for Dhivehi body text (`--onu-font-thaana`).
 - **MV Faseyha** is used for Dhivehi headings and `<b>`/`<strong>` (`--onu-font-thaana-bold`). Both fonts have a single weight and Onu turns off faux bold for Dhivehi, so emphasis uses the second face instead.
-- Characters neither font covers fall back to Noto Sans Thaana.
-
-If you don't import `fonts.css`, the same names still apply to copies installed on the device.
+- Characters neither font covers fall back to Noto Sans Thaana when you import `fonts.css`.
 
 # Mixed Dhivehi and English
 

diff --git a/docs/guides/inertia-and-nextjs.md b/docs/guides/inertia-and-nextjs.md
@@ -3,7 +3,7 @@ title: Inertia & Next.js
 sidebar_position: 13
 ---
 
-Onu is plain React, so it works in Vite apps, Laravel + Inertia (React) and Next.js.
+Onu is plain React (React 19), so it works in Vite apps, Laravel + Inertia (React) and Next.js.
 
 # Links
 

diff --git a/docs/installation-and-setup.md b/docs/installation-and-setup.md
@@ -5,10 +5,10 @@ sidebar_position: 1.2
 
 # Installation
 
-First install the NPM package
+Onu needs React 19. First install the NPM package
 
 ```bash
-npm install @javaabu/onu --save
+npm install @javaabu/onu react-hook-form @tanstack/react-query --save
 ```
 
 # Styles
@@ -25,7 +25,7 @@ npm install @fontsource-variable/inter @fontsource-variable/jetbrains-mono @font
 @import "@javaabu/onu/fonts.css"; /* optional: needs the font packages above */
 ```
 
-Without the font pack, leave out the last line. Faruma and MV Faseyha (Thaana) are inside `@javaabu/onu`; see [Fonts](./guides/fonts).
+Without the font pack, leave out the last line. `tailwind.css` already loads Faruma and MV Faseyha (Thaana); see [Fonts](./guides/fonts).
 
 `tailwind.css` adds Onu's design tokens, the dark mode variant, and tells Tailwind to scan Onu's components for classes.
 

diff --git a/docs/requirements.md b/docs/requirements.md
@@ -5,8 +5,9 @@ sidebar_position: 1.1
 
 This package requires:
 
-- [React](https://react.dev) 18.3+ or 19
+- [React](https://react.dev) 19
 - [Tailwind CSS](https://tailwindcss.com) 4
+- [React Hook Form](https://react-hook-form.com) 7 and [TanStack Query](https://tanstack.com/query) 5, which share React context with your app
 
 Onu supports every browser Tailwind CSS 4 supports: Chrome and Edge 111+, Safari 16.4+, Firefox 128+, and their mobile versions.
-Original file line number
+Diff line change
@@ Expand Up / @@ -41,6 +41,7 @@ jobs: @@
                   exit 1
                 fi
               done
+              node scripts/sync-plugin-version.mjs --check
           - name: Check the npm token
             run: |
               if [ -z "$NPM_TOKEN" ]; then
@@ Expand Down @@
Original file line number	Diff line number	Diff line change
Expand Up		@@ -101,4 +101,4 @@ Charts have their own `useChartFormat` in `@javaabu/onu/charts`, with axis and p

		# Fonts

		Dhivehi text uses Faruma, with MV Faseyha for headings and bold, both bundled with `fonts.css`. See [Fonts](./fonts).
		Dhivehi text uses Faruma, with MV Faseyha for headings and bold, both loaded by `tailwind.css`. See [Fonts](./fonts).