zz-meridian 0.18.0 → 0.18.1

package/dist/adopt.js

@@ -8,12 +8,12 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { VERSION, brandArgs, effectiveBrand, inside, installSkill, jsoncExtras, packageManager, payloadBytes, payloadFiles, readJsonc, readPayload, relativeImports, run, runTool, sha256, writeIn, writeManifest, } from './files.js';
+import { VERSION, brandArgs, effectiveBrand, inside, installArgs, installSkill, jsoncExtras, packageManager, payloadBytes, payloadFiles, readJsonc, readPayload, relativeImports, run, runTool, sha256, writeIn, writeManifest, } from './files.js';
 import { BRIEF_TEMPLATE, managedBlock, upsertManagedBlock } from './context.js';
 import { FIXED, adoptSetOf, managedPaths } from './ownership.js';
 /** The template's dependencies a dashboard built from these files needs. */
 const DEPS = ['next', 'react', 'react-dom', 'radix-ui', 'lucide-react', 'clsx', 'tailwind-merge', 'react-markdown', 'remark-gfm', 'ai', '@ai-sdk/react', 'zod'];
-const DEV_DEPS = ['typescript', '@types/node', '@types/react', '@types/react-dom', 'tailwindcss', '@tailwindcss/postcss', 'eslint', 'eslint-config-next', 'vitest', '@vitejs/plugin-react', 'jsdom', '@testing-library/react', '@testing-library/jest-dom'];
+const DEV_DEPS = ['typescript', '@types/node', '@types/react', '@types/react-dom', 'tailwindcss', '@tailwindcss/postcss', 'eslint', 'eslint-config-next', 'vitest', '@vitejs/plugin-react', 'jsdom', '@testing-library/react', '@testing-library/dom', '@testing-library/jest-dom'];
 const SCRIPTS = ['typecheck', 'test', 'tokens', 'check', 'contrast', 'gate', 'audit', 'verify', 'brand', 'shot', 'interactions', 'keyboard', 'vitals'];
 const major = (spec) => Number(/(\d+)/.exec(spec)?.[1] ?? NaN);
 const TS = /\.(ts|tsx)$/;
@@ -356,7 +356,7 @@ Rename or move them, then run adopt again.`);
     let typed = 'not run (--no-install)';
     if (o.install) {
         say(`\nInstalling with ${pm}…`);
-        if (run(pm, ['install'], root).status !== 0)
+        if (run(pm, installArgs(pm), root).status !== 0)
             return fail(`${pm} install failed (above). Fix it, then run ${pm} install and ${pm} run typecheck.`);
         // Route types first (LayoutProps, PageProps), as the gate does.
         runTool(root, 'next/dist/bin/next', ['typegen']);

package/dist/files.js

@@ -77,6 +77,11 @@ export function packageManager(root) {
         return 'bun';
     return 'npm';
 }
+/**
+ * The install that follows Meridian's own edit to package.json. pnpm freezes the lockfile where `CI` is set and refuses
+ * the edit it was run to take in, so it is asked to write the lockfile; the other managers write it as they are.
+ */
+export const installArgs = (pm) => (pm === 'pnpm' ? ['install', '--no-frozen-lockfile'] : ['install']);
 /** A tool in the project's node_modules, run as `node <its script>`: no shell and no .cmd shim on any platform. */
 export function runTool(root, entry, args, quiet = true) {
     return spawnSync(process.execPath, [path.join(root, 'node_modules', entry), ...args], { cwd: root, encoding: 'utf8', stdio: quiet ? 'pipe' : 'inherit' });

package/dist/reconcile.js

@@ -3,7 +3,7 @@
 import { builtinModules } from 'node:module';
 import { upsertManagedBlock } from './context.js';
 /** Adopt's dev dependencies and scripts, which `update` also needs. They mirror `DEV_DEPS` and `SCRIPTS` in adopt.ts. */
-export const TOOLCHAIN = ['typescript', '@types/node', '@types/react', '@types/react-dom', 'tailwindcss', '@tailwindcss/postcss', 'eslint', 'eslint-config-next', 'vitest', '@vitejs/plugin-react', 'jsdom', '@testing-library/react', '@testing-library/jest-dom'];
+export const TOOLCHAIN = ['typescript', '@types/node', '@types/react', '@types/react-dom', 'tailwindcss', '@tailwindcss/postcss', 'eslint', 'eslint-config-next', 'vitest', '@vitejs/plugin-react', 'jsdom', '@testing-library/react', '@testing-library/dom', '@testing-library/jest-dom'];
 export const MERIDIAN_SCRIPTS = ['typecheck', 'test', 'tokens', 'check', 'contrast', 'gate', 'audit', 'verify', 'brand', 'shot', 'interactions', 'keyboard', 'vitals'];
 const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 /**

package/dist/session.js

@@ -7,7 +7,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { managedBlock } from './context.js';
-import { inside, packageManager, run as spawn, sha256 } from './files.js';
+import { inside, installArgs, packageManager, run as spawn, sha256 } from './files.js';
 import { aliasesOf, canonicalImports } from './imports.js';
 import { changedPaths, takeInventory } from './inventory.js';
 import { renderMergeReport } from './merge-report.js';
@@ -273,7 +273,7 @@ function install(ctx, session, j, pm) {
     if (before.exists && !fs.existsSync(backup))
         writeAtomic(backup, fs.readFileSync(inside(root, lock)));
     const t0 = performance.now();
-    const r = ctx.run(pm, ['install'], root);
+    const r = ctx.run(pm, installArgs(pm), root);
     const ms = performance.now() - t0;
     writeAtomic(path.join(session, 'evidence', '0-install.log'), r.output);
     j.validation = [{ command: `${pm} install`, exitCode: r.status, evidenceFile: 'evidence/0-install.log' }, ...j.validation.filter((v) => !isInstall(v))];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zz-meridian",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "Bring ZZ Meridian, a dashboard design system, into a Next.js project, or start a new dashboard on it. Copies the files in; nothing depends on this package at runtime.",
   "license": "MIT",
   "type": "module",

package/payload/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 Every release of ZZ Meridian, newest first. Versions follow semver: a removed or renamed token, prop or card is major; a new card, token or variant is minor; a corrected value is a patch. Each entry says what breaks and what to do instead.
 
+## [0.18.1] · 2026-10-19
+
+### Changed
+
+- **Next.js 16.4.2**, from 16.3.8. 16.4.1 carries fixes for two critical advisories, remote code execution through a `use cache` function that returns a typed array (GHSA-673q-mjm6-r5xr) and through the Image Optimization API with SVG files (GHSA-2464-fhr4-w9xw), and a high one, denial of service through Server Actions (GHSA-p3m5-59mp-jv5r); 16.3 has no release that carries them. `npx zz-meridian@latest update` raises `next` and `eslint-config-next` to `16.4.2` in a project's `package.json`; run your package manager's install after it.
+- **The other dependencies, within their majors**: React 19.3.1, `ai` 7.0.143 with `@ai-sdk/react` 4.0.147, `@ai-sdk/anthropic` 4.0.82 and `@ai-sdk/openai-compatible` 3.0.71, `radix-ui` 1.8.1, `lucide-react` 1.59.0, `zod` 4.6.7, and for development `vitest` 5.0.5, `jsdom` 30.1.3 and `@vitejs/plugin-react` 6.1.2.
+- **`@testing-library/jest-dom` 7**, which needs `@testing-library/dom` as a dependency of the project's own. `adopt` and `update` add `@testing-library/dom` `^10.4.2` to `devDependencies`; `update` raises jest-dom to 7 where Meridian wrote it and asks you to where you chose your own. The matchers are unchanged.
+- TypeScript stays at 5.9 and ESLint at 9: `typescript-eslint` supports TypeScript below 6.1, and `eslint-plugin-react`, `eslint-plugin-import` and `eslint-plugin-jsx-a11y`, which `eslint-config-next` installs, do not yet declare ESLint 10.
+
+### Fixed
+
+- **`update` and `adopt` install where `CI` is set.** Both change `package.json` and then run the project's install, and pnpm freezes the lockfile where `CI` is set, so an update that raised a dependency failed with `ERR_PNPM_OUTDATED_LOCKFILE` in CI or under an agent that sets it. With pnpm they now run `pnpm install --no-frozen-lockfile`; npm, yarn and bun run `install` as before.
+- **A client navigation no longer reads the new page's collections again** ([#54](https://github.com/zhixuan312/zz-meridian/issues/54)). 0.18.0 sent the revisions a page was served only on the tab's first stream, so a press in the rail to a page that follows other collections reopened the stream without them, and every collection that page follows was read by its server and again by the stream's resync. `src/lib/live.ts` now sends them on every open that follows a change of the names, and only a reopen after a gap (an error, a tab shown again, the poll's retry) resyncs every name. A created project takes the fix with `npx zz-meridian@latest update`.
+
 ## [0.18.0] · 2026-10-19
 
 ### Breaking

package/payload/docs/distribution.md

@@ -75,7 +75,7 @@ Then, in this order:
    the accent and the contrast gate. Then it writes Meridian's managed block into their `AGENTS.md`, and `docs/brief.md`
    when they have none.
 5. Installs the skill and writes the manifest.
-6. Runs their package manager's install, `next typegen` and `tsc --noEmit`, and prints the result and the next step:
+6. Runs their package manager's install (pnpm with `--no-frozen-lockfile`, since adopt has just changed `package.json`), `next typegen` and `tsc --noEmit`, and prints the result and the next step:
    the skill's Route A from step 2, with the template to read from at the same version.
 
 Three things make the copy safe in someone else's project. Meridian's own files import each other by relative path,
@@ -107,7 +107,8 @@ three edits named below. It needs a project that adopted or created Meridian 0.3
 2. **Update.** `npx zz-meridian@latest update` from a clean git tree (or with `--allow-dirty`). It writes the plan first
    (`.meridian/update/<version>/state.json`, the journal, `MERGE.md`, an empty `resolutions.json`, the `base/`, `ours/`
    and `new/` copies of every staged file, and a `backup/` preimage of every path it changes), then applies the safe
-   changes, then runs the install. Applied: untouched replacements, additions and untouched removals. Staged: every
+   changes, then runs the install (pnpm with `--no-frozen-lockfile`, which CI would otherwise refuse after the edit to
+   `package.json`). Applied: untouched replacements, additions and untouched removals. Staged: every
    managed file the team changed or deleted, or collided with. The only team files it edits are `package.json` (missing
    dependencies and scripts, older ones of the same major, and entries still exactly as the earlier release wrote them;
    the framework `next`, `react` and `react-dom` is always among them), the managed block in `AGENTS.md`, and the

package/payload/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zz-meridian-template",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "private": true,
   "license": "MIT",
   "description": "ZZ Meridian: a dashboard design system and starter. Six layers, from DTCG tokens through four layers of React components to product workspaces, and a Design Atlas, in a light and a dark theme.",
@@ -30,34 +30,35 @@
     "keyboard": "node scripts/keyboard.ts"
   },
   "dependencies": {
-    "@ai-sdk/anthropic": "4.0.71",
-    "@ai-sdk/openai-compatible": "3.0.62",
-    "@ai-sdk/react": "4.0.130",
-    "ai": "7.0.127",
+    "@ai-sdk/anthropic": "4.0.82",
+    "@ai-sdk/openai-compatible": "3.0.71",
+    "@ai-sdk/react": "4.0.147",
+    "ai": "7.0.143",
     "clsx": "^2.1.1",
-    "lucide-react": "^1.50.0",
-    "next": "16.3.8",
-    "radix-ui": "^1.6.7",
-    "react": "19.3.0",
-    "react-dom": "19.3.0",
+    "lucide-react": "^1.59.0",
+    "next": "16.4.2",
+    "radix-ui": "^1.8.1",
+    "react": "19.3.1",
+    "react-dom": "19.3.1",
     "react-markdown": "^10.1.0",
     "remark-gfm": "^4.0.1",
     "tailwind-merge": "^3.7.0",
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4.3.3",
-    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/dom": "^10.4.2",
+    "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",
     "@types/node": "^24",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
+    "@vitejs/plugin-react": "^6.1.2",
     "eslint": "^9.39.5",
-    "eslint-config-next": "16.3.8",
-    "jsdom": "^30.1.1",
+    "eslint-config-next": "16.4.2",
+    "jsdom": "^30.1.3",
     "tailwindcss": "^4.3.3",
     "typescript": "5.9.3",
-    "vitest": "^5.0.3"
+    "vitest": "^5.0.5"
   }
 }