zz-meridian 0.18.0 → 0.19.0

package/dist/adopt.js

@@ -8,12 +8,12 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { VERSION, brandArgs, effectiveBrand, inside, installSkill, jsoncExtras, packageManager, payloadBytes, payloadFiles, readJsonc, readPayload, relativeImports, run, runTool, sha256, writeIn, writeManifest, } from './files.js';
+import { VERSION, brandArgs, effectiveBrand, inside, installArgs, installSkill, jsoncExtras, packageManager, payloadBytes, payloadFiles, readJsonc, readPayload, relativeImports, run, runTool, sha256, writeIn, writeManifest, } from './files.js';
 import { BRIEF_TEMPLATE, managedBlock, upsertManagedBlock } from './context.js';
 import { FIXED, adoptSetOf, managedPaths } from './ownership.js';
 /** The template's dependencies a dashboard built from these files needs. */
 const DEPS = ['next', 'react', 'react-dom', 'radix-ui', 'lucide-react', 'clsx', 'tailwind-merge', 'react-markdown', 'remark-gfm', 'ai', '@ai-sdk/react', 'zod'];
-const DEV_DEPS = ['typescript', '@types/node', '@types/react', '@types/react-dom', 'tailwindcss', '@tailwindcss/postcss', 'eslint', 'eslint-config-next', 'vitest', '@vitejs/plugin-react', 'jsdom', '@testing-library/react', '@testing-library/jest-dom'];
+const DEV_DEPS = ['typescript', '@types/node', '@types/react', '@types/react-dom', 'tailwindcss', '@tailwindcss/postcss', 'eslint', 'eslint-config-next', 'vitest', '@vitejs/plugin-react', 'jsdom', '@testing-library/react', '@testing-library/dom', '@testing-library/jest-dom'];
 const SCRIPTS = ['typecheck', 'test', 'tokens', 'check', 'contrast', 'gate', 'audit', 'verify', 'brand', 'shot', 'interactions', 'keyboard', 'vitals'];
 const major = (spec) => Number(/(\d+)/.exec(spec)?.[1] ?? NaN);
 const TS = /\.(ts|tsx)$/;
@@ -356,7 +356,7 @@ Rename or move them, then run adopt again.`);
     let typed = 'not run (--no-install)';
     if (o.install) {
         say(`\nInstalling with ${pm}…`);
-        if (run(pm, ['install'], root).status !== 0)
+        if (run(pm, installArgs(pm), root).status !== 0)
             return fail(`${pm} install failed (above). Fix it, then run ${pm} install and ${pm} run typecheck.`);
         // Route types first (LayoutProps, PageProps), as the gate does.
         runTool(root, 'next/dist/bin/next', ['typegen']);

package/dist/files.js

@@ -77,6 +77,11 @@ export function packageManager(root) {
         return 'bun';
     return 'npm';
 }
+/**
+ * The install that follows Meridian's own edit to package.json. pnpm freezes the lockfile where `CI` is set and refuses
+ * the edit it was run to take in, so it is asked to write the lockfile; the other managers write it as they are.
+ */
+export const installArgs = (pm) => (pm === 'pnpm' ? ['install', '--no-frozen-lockfile'] : ['install']);
 /** A tool in the project's node_modules, run as `node <its script>`: no shell and no .cmd shim on any platform. */
 export function runTool(root, entry, args, quiet = true) {
     return spawnSync(process.execPath, [path.join(root, 'node_modules', entry), ...args], { cwd: root, encoding: 'utf8', stdio: quiet ? 'pipe' : 'inherit' });

package/dist/migrations.js

@@ -462,6 +462,14 @@ export const RELEASE_MIGRATIONS = [
         instructions: 'Bring `tests/verify-suite-outcome.test.ts` over from the release as it has it. A file of your own that calls `finalOutcome` passes the tiers, `finalOutcome({ full, timed }, notRun)`, where it passed whether the run was full (`finalOutcome(true, notRun)`): `references/validation.md` describes the tiers, `pnpm verify`, `--full` and `--timed`.',
         checks: ['gate'],
     },
+    {
+        id: 'no-data-mark',
+        since: '0.19.0',
+        applies: (root) => matching(root, (rel, src) => importsOf(rel, src).some(({ from }) => from === 'src/components/charts/column-chart') && /\.bg-fill-track['"]\)\)\.not\.toBeNull\(\)/.test(src)),
+        summary: 'A Column chart\'s period with no data draws a dashed hairline on the baseline, where it drew a `fill-track` track the height of the scale.',
+        instructions: 'Bring `tests/column-chart-no-data.test.tsx` over from the release as it has it. Since 0.19.0 `src/components/charts/column-chart/index.tsx` draws no column for a `null` period: its box has no height, a dashed hairline (`data-no-data-mark`) keeps the slot, and the word stands over it, because the track was the tallest mark on the chart. A test of your own that finds `.bg-fill-track` or `[data-track]` in a no-data column finds `[data-no-data-mark]` instead.',
+        checks: ['gate'],
+    },
 ];
 /**
  * A test of the rail that stands over a fake `ResizeObserver` answering `observe` with nothing (0.16.2). The lookbehind

package/dist/ownership.js

@@ -7,7 +7,7 @@ export const FIXED = [...LIB, 'src/lib/assistant/prompt.ts', 'src/views/console-
 /** The one rule, a plain-English line per clause. `references/ownership.md` renders it, so the guidance cannot drift. */
 export const OWNERSHIP = [
     'Managed: the payload files under `tokens/`, `src/styles/` and `src/components/`, except each component\'s `README.md` and `preview.tsx`.',
-    'Managed: the distributed scripts under `scripts/`, except `scripts/verify.config.ts`, the first-load baseline `optional:scripts/verify.baseline.json` and a team-local `optional:scripts/check.local.ts`.',
+    'Managed: the distributed scripts under `scripts/`, except `scripts/verify.config.ts`, the size baseline `optional:scripts/verify.baseline.json` (first-load JS and the HTML of each page) and a team-local `optional:scripts/check.local.ts`.',
     'Managed: the library helpers `src/lib/cn.ts`, `src/lib/format.ts`, `src/lib/format-date.ts`, `src/lib/period.ts`, `src/lib/color.ts`, `src/lib/host.ts`, `src/lib/preferences.ts`, `src/lib/csv.ts`, `src/lib/safe-markdown.ts`, `src/lib/logo.ts`, `src/lib/collection.ts`, `src/lib/explore.ts`, `src/lib/live.ts`, `src/lib/shared-context.ts`, `src/lib/agent-guidance.ts`, `src/lib/insight.ts` and `src/lib/facts.ts`, and the assistant prompt `src/lib/assistant/prompt.ts`.',
     'Managed: `src/views/console-chrome.tsx` and `tests/setup.ts`.',
     'Managed: `optional:scripts/package.json`, only when the adopt or create that set the project up generated it for this project shape.',

package/dist/reconcile.js

@@ -3,7 +3,7 @@
 import { builtinModules } from 'node:module';
 import { upsertManagedBlock } from './context.js';
 /** Adopt's dev dependencies and scripts, which `update` also needs. They mirror `DEV_DEPS` and `SCRIPTS` in adopt.ts. */
-export const TOOLCHAIN = ['typescript', '@types/node', '@types/react', '@types/react-dom', 'tailwindcss', '@tailwindcss/postcss', 'eslint', 'eslint-config-next', 'vitest', '@vitejs/plugin-react', 'jsdom', '@testing-library/react', '@testing-library/jest-dom'];
+export const TOOLCHAIN = ['typescript', '@types/node', '@types/react', '@types/react-dom', 'tailwindcss', '@tailwindcss/postcss', 'eslint', 'eslint-config-next', 'vitest', '@vitejs/plugin-react', 'jsdom', '@testing-library/react', '@testing-library/dom', '@testing-library/jest-dom'];
 export const MERIDIAN_SCRIPTS = ['typecheck', 'test', 'tokens', 'check', 'contrast', 'gate', 'audit', 'verify', 'brand', 'shot', 'interactions', 'keyboard', 'vitals'];
 const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 /**

package/dist/session.js

@@ -7,7 +7,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { managedBlock } from './context.js';
-import { inside, packageManager, run as spawn, sha256 } from './files.js';
+import { inside, installArgs, packageManager, run as spawn, sha256 } from './files.js';
 import { aliasesOf, canonicalImports } from './imports.js';
 import { changedPaths, takeInventory } from './inventory.js';
 import { renderMergeReport } from './merge-report.js';
@@ -273,7 +273,7 @@ function install(ctx, session, j, pm) {
     if (before.exists && !fs.existsSync(backup))
         writeAtomic(backup, fs.readFileSync(inside(root, lock)));
     const t0 = performance.now();
-    const r = ctx.run(pm, ['install'], root);
+    const r = ctx.run(pm, installArgs(pm), root);
     const ms = performance.now() - t0;
     writeAtomic(path.join(session, 'evidence', '0-install.log'), r.output);
     j.validation = [{ command: `${pm} install`, exitCode: r.status, evidenceFile: 'evidence/0-install.log' }, ...j.validation.filter((v) => !isInstall(v))];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zz-meridian",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Bring ZZ Meridian, a dashboard design system, into a Next.js project, or start a new dashboard on it. Copies the files in; nothing depends on this package at runtime.",
   "license": "MIT",
   "type": "module",

package/payload/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 Every release of ZZ Meridian, newest first. Versions follow semver: a removed or renamed token, prop or card is major; a new card, token or variant is minor; a corrected value is a patch. Each entry says what breaks and what to do instead.
 
+## [0.19.0] · 2026-10-19
+
+### Breaking
+
+- **Every page's HTML is held to its own baseline, and measured gzipped** ([#57](https://github.com/zhixuan312/zz-meridian/issues/57), [#56](https://github.com/zhixuan312/zz-meridian/issues/56)). `scripts/sizes.ts` measures a page's HTML as a person downloads it, the complete streamed response gzipped, where it measured the uncompressed bytes of the routes in `budgets.htmlKb` only. `node scripts/sizes.ts --write-baseline --base <url>`, against the running build, records the HTML of every page (no API, no dynamic segment, not the not-found screen) beside the first-load figures in `scripts/verify.baseline.json`, and `pnpm verify` holds each to `budgets.htmlGrowthPct` (5%) over its own figure, as first-load JS is held. A growth you accept is recorded once, with the same command, rather than by editing numbers. `budgets.htmlKb` stays as an optional absolute cap, now in gzipped KiB: a cap set on uncompressed bytes is several times too loose, so lower it to the gzipped figure `pnpm verify` prints, or remove it and rely on the baseline. Until the baseline holds `html`, the HTML line is a warning, and `pnpm verify --full` refuses, naming the command. Under `partialPrefetching` Next.js writes each shell's static trees into a page's HTML twice; gzipped, the second copy costs a few KiB rather than tens, so the figure follows the page.
+
+### New
+
+- **A stacked Column chart's part can take a categorical slot** ([#61](https://github.com/zhixuan312/zz-meridian/issues/61)). `ColumnPart.color` (1 to 6) draws the part in `series-<n>`, as `TrendSeries.color` does, for parts that are identities, such as teams, or for two or more usual outcomes, which one neutral would make one. A part with no slot, Other among them, is neutral, and status colours stay out of such a chart: coral and saffron read as a warning beside a real one. `docs/data-display.md`'s Parts of one whole says when to use it.
+- **`DataTable` takes `retrying`** ([#59](https://github.com/zhixuan312/zz-meridian/issues/59)): its error state's Retry is busy while the person's retry is on its way. Pass it for their own press only.
+- **`ActivityEvent.href`** ([#63](https://github.com/zhixuan312/zz-meridian/issues/63)) links an event's object to its record, with the arrow that says it stays in the product.
+- **`Rail` takes `declared`**, every destination the product declares; `ConsoleRail` passes it from the whole navigation.
+
+### Fixed
+
+- **A busy Button keeps its focus** ([#58](https://github.com/zhixuan312/zz-meridian/issues/58)). It was `disabled`, so a focused button that turned busy from anything but its own press, a Retry whose read a live hint or a poll started, lost focus to the page and the next Tab began again at the top. It is `aria-disabled` now, stays in the tab order, and drops a press while busy, a submit's included; `aria-busy` and the spinner are unchanged. A test of yours that expects a busy button to be `disabled` expects `aria-disabled="true"`.
+- **A Column chart's period with no data is no longer its tallest mark** ([#60](https://github.com/zhixuan312/zz-meridian/issues/60)). It drew a `fill-track` track the height of the scale, which in light theme read as the biggest period. It draws no column now, a dashed hairline just above the baseline, and its word ("No data") stands over it where a value would. The hairline carries `data-no-data-mark` where the track carried `data-track`. `npx zz-meridian@latest update` lists `migration:no-data-mark` for a project whose copy of `tests/column-chart-no-data.test.tsx` still expects the track: bring the release's over.
+- **The rail lights nothing for an address under a destination the person does not hold** ([#62](https://github.com/zhixuan312/zz-meridian/issues/62)). It lit the longest destination they held, so someone refused `/admin/audit` saw `/admin` lit. The current page is found among every declared destination and lit only when their rail holds it. A product that passed `current=''` to work around it can stop.
+- **A Button's class list is 178 bytes, not 394** ([#56](https://github.com/zhixuan312/zz-meridian/issues/56)): the frame every button shares is the `.btn` class in `src/styles/base.css`, so a table of row actions does not repeat it on every instance.
+
+## [0.18.1] · 2026-10-19
+
+### Changed
+
+- **Next.js 16.4.2**, from 16.3.8. 16.4.1 carries fixes for two critical advisories, remote code execution through a `use cache` function that returns a typed array (GHSA-673q-mjm6-r5xr) and through the Image Optimization API with SVG files (GHSA-2464-fhr4-w9xw), and a high one, denial of service through Server Actions (GHSA-p3m5-59mp-jv5r); 16.3 has no release that carries them. `npx zz-meridian@latest update` raises `next` and `eslint-config-next` to `16.4.2` in a project's `package.json`; run your package manager's install after it.
+- **The other dependencies, within their majors**: React 19.3.1, `ai` 7.0.143 with `@ai-sdk/react` 4.0.147, `@ai-sdk/anthropic` 4.0.82 and `@ai-sdk/openai-compatible` 3.0.71, `radix-ui` 1.8.1, `lucide-react` 1.59.0, `zod` 4.6.7, and for development `vitest` 5.0.5, `jsdom` 30.1.3 and `@vitejs/plugin-react` 6.1.2.
+- **`@testing-library/jest-dom` 7**, which needs `@testing-library/dom` as a dependency of the project's own. `adopt` and `update` add `@testing-library/dom` `^10.4.2` to `devDependencies`; `update` raises jest-dom to 7 where Meridian wrote it and asks you to where you chose your own. The matchers are unchanged.
+- TypeScript stays at 5.9 and ESLint at 9: `typescript-eslint` supports TypeScript below 6.1, and `eslint-plugin-react`, `eslint-plugin-import` and `eslint-plugin-jsx-a11y`, which `eslint-config-next` installs, do not yet declare ESLint 10.
+
+### Fixed
+
+- **`update` and `adopt` install where `CI` is set.** Both change `package.json` and then run the project's install, and pnpm freezes the lockfile where `CI` is set, so an update that raised a dependency failed with `ERR_PNPM_OUTDATED_LOCKFILE` in CI or under an agent that sets it. With pnpm they now run `pnpm install --no-frozen-lockfile`; npm, yarn and bun run `install` as before.
+- **A client navigation no longer reads the new page's collections again** ([#54](https://github.com/zhixuan312/zz-meridian/issues/54)). 0.18.0 sent the revisions a page was served only on the tab's first stream, so a press in the rail to a page that follows other collections reopened the stream without them, and every collection that page follows was read by its server and again by the stream's resync. `src/lib/live.ts` now sends them on every open that follows a change of the names, and only a reopen after a gap (an error, a tab shown again, the poll's retry) resyncs every name. A created project takes the fix with `npx zz-meridian@latest update`.
+
 ## [0.18.0] · 2026-10-19
 
 ### Breaking

package/payload/docs/data-display.md

@@ -36,7 +36,7 @@ Two measures of different size are two charts on one Meridian, not one chart wit
 - **Magnitude**: one hue, light to dark, built from the accent and the surface (the heatmap).
 - **Magnitude by rank**: a Heatmap's step is a cell's share of the largest cell (`max`) unless one outlier would leave every other cell at the lowest step. Then it is ranked (`scale="quantile"`): the cells above zero take five steps of equal count. A step no longer says how much, so the legend's upper end reads the value the top step starts at ("900 or more") in place of "More", and the readout and the hidden table give each cell's exact value.
 - **State**: positive, warning, critical, always with a word or an icon.
-- **Parts of one whole**: one hue. The parts share the accent, mixed into the surface, deepest at the bottom and paler upward (the stacked Trend chart and the stacked Column chart take the same mix), with a 1px hairline of the card between neighbours and at most four parts, the fourth being Other. When the parts are outcomes they carry a tone instead: the usual outcome is neutral (`chart-neutral-strong`), one that needs somebody is warning or critical, the accent never stands beside a tone, and the positive colour is never the usual case.
+- **Parts of one whole**: one hue. The parts share the accent, mixed into the surface, deepest at the bottom and paler upward (the stacked Trend chart and the stacked Column chart take the same mix), with a 1px hairline of the card between neighbours and at most four parts, the fourth being Other. When the parts are outcomes they carry a tone instead: the usual outcome is neutral (`chart-neutral-strong`), one that needs somebody is warning or critical, the accent never stands beside a tone, and the positive colour is never the usual case. Parts that are identities (teams), or two or more usual outcomes that one neutral would make one, take the categorical slots instead, in order (`series-1` onward, as Identity above), and a part with no slot is neutral. Status colours stay out of such a chart, as the accent stays out of a toned one, since coral and saffron read as a warning beside a real one: a chart with an outcome that needs somebody is a toned chart.
 
 Text never wears a series colour; values and labels stay in ink.
 
@@ -68,7 +68,7 @@ A period still in progress is counted in no total, change or finding. A figure f
 - The figure is set tight (the hero figure at `tracking-display`, a card's figure at -0.03em); its unit steps down to half size in `ink-3`; money steps its cents down; compact counts keep their decimal (`2.9M`).
 - Tabular figures where numbers stack or change in place (tables, axes, readouts, and a tile's or the Featured metric's figure, which changes as the Meridian moves); proportional for a standalone figure that stays put.
 - A missing value is a dash, never zero. Every figure names its period and unit somewhere visible.
-- A period with no data is a gap in a chart, never a zero and never left out: a `null` keeps its place on the time axis. A Trend chart's and a Sparkline's line breaks at it; a Column chart's column keeps its slot as the empty track and reads "No data" (or the product's word, `noData`) at rest, pointed at and in the table, and the scale leaves it out.
+- A period with no data is a gap in a chart, never a zero and never left out: a `null` keeps its place on the time axis. A Trend chart's and a Sparkline's line breaks at it; a Column chart's column keeps its slot with a dashed hairline on the baseline, never a mark that stands up from it, and reads "No data" (or the product's word, `noData`) at rest, pointed at and in the table, and the scale leaves it out.
 - A Heatmap of hours names the timezone its hours are cut in, in its readout, its announcement and its table: UTC unless the product passes `timezone`. A product that cuts its days at local midnight cuts its hours there too and names the zone, so a local Monday stays in Monday's row. The template's Usage passes the product's reporting timezone, `app.timezone`, as its Heatmap's `timezone` and names it in its cards and its context, so a product that sets that zone keeps its hours cut in it.
 - A delta's arrow carries direction; its colour carries the judgement, which depends on the measure (latency down is good).
 - A change says what it is against, in words beside it: "vs previous period" unless the caller says otherwise ("vs the week before"). The Featured metric and the Metric tile take the words as `compare`. On a wall of compact tiles the card that holds the wall says it once, and a tile draws the change's figure alone.

package/payload/docs/distribution.md

@@ -75,7 +75,7 @@ Then, in this order:
    the accent and the contrast gate. Then it writes Meridian's managed block into their `AGENTS.md`, and `docs/brief.md`
    when they have none.
 5. Installs the skill and writes the manifest.
-6. Runs their package manager's install, `next typegen` and `tsc --noEmit`, and prints the result and the next step:
+6. Runs their package manager's install (pnpm with `--no-frozen-lockfile`, since adopt has just changed `package.json`), `next typegen` and `tsc --noEmit`, and prints the result and the next step:
    the skill's Route A from step 2, with the template to read from at the same version.
 
 Three things make the copy safe in someone else's project. Meridian's own files import each other by relative path,
@@ -107,7 +107,8 @@ three edits named below. It needs a project that adopted or created Meridian 0.3
 2. **Update.** `npx zz-meridian@latest update` from a clean git tree (or with `--allow-dirty`). It writes the plan first
    (`.meridian/update/<version>/state.json`, the journal, `MERGE.md`, an empty `resolutions.json`, the `base/`, `ours/`
    and `new/` copies of every staged file, and a `backup/` preimage of every path it changes), then applies the safe
-   changes, then runs the install. Applied: untouched replacements, additions and untouched removals. Staged: every
+   changes, then runs the install (pnpm with `--no-frozen-lockfile`, which CI would otherwise refuse after the edit to
+   `package.json`). Applied: untouched replacements, additions and untouched removals. Staged: every
    managed file the team changed or deleted, or collided with. The only team files it edits are `package.json` (missing
    dependencies and scripts, older ones of the same major, and entries still exactly as the earlier release wrote them;
    the framework `next`, `react` and `react-dom` is always among them), the managed block in `AGENTS.md`, and the
@@ -147,10 +148,10 @@ Two environment variables exist for the updater's own tests and are used only wh
 reports as `migration:<id>` because it cannot make them. An entry applies when the project's recorded version is older
 than its `since` and the target is not, and its `applies(root)` returns the paths that still have the old shape, or
 null. It only reads, and only team-owned files (the ownership rule's managed paths are skipped); a file it cannot read is
-absent. A project already on the new shape gets no line. Every entry carries `gate` and `build` as its checks (`verify-modes`, `agent-reads-section`, `nav-needs`, `agent-reads-own-group`, `agent-does-here-section`, `marker-measured-on-observe`, `view-page-matched-as-next`, `journey-moved`, `today-in-timezone` and `verify-tiers`, `gate` alone), and its
+absent. A project already on the new shape gets no line. Every entry carries `gate` and `build` as its checks (`verify-modes`, `agent-reads-section`, `nav-needs`, `agent-reads-own-group`, `agent-does-here-section`, `marker-measured-on-observe`, `view-page-matched-as-next`, `journey-moved`, `today-in-timezone`, `verify-tiers` and `no-data-mark`, `gate` alone), and its
 instructions name the section of a reference (`cache.md`, `live.md`, `validation.md`, `agents.md`, `customize.md`), of the Start guide or of `docs/assistant.md` to follow.
 
-Fifteen arrived after 0.5.0 and are resolved as the skill's `references/update.md` says: `share-view-context` and `agent-reads-section` (0.9.0), `assistant-view-tools` (0.10.0), `nav-needs` (0.13.0), `agent-reads-own-group` (0.15.0), `refusal-declared`, `managed-exports-removed`, `view-tool-page-explore`, `agent-does-here-section` and `sample-pages-renamed` (0.16.0), `marker-measured-on-observe` (0.16.2), `view-page-matched-as-next`, `journey-moved` and `today-in-timezone` (0.16.3), and `verify-tiers` (0.17.0). The ten of 0.5.0 are:
+Sixteen arrived after 0.5.0 and are resolved as the skill's `references/update.md` says: `share-view-context` and `agent-reads-section` (0.9.0), `assistant-view-tools` (0.10.0), `nav-needs` (0.13.0), `agent-reads-own-group` (0.15.0), `refusal-declared`, `managed-exports-removed`, `view-tool-page-explore`, `agent-does-here-section` and `sample-pages-renamed` (0.16.0), `marker-measured-on-observe` (0.16.2), `view-page-matched-as-next`, `journey-moved` and `today-in-timezone` (0.16.3), `verify-tiers` (0.17.0), and `no-data-mark` (0.19.0). The ten of 0.5.0 are:
 
 | Id | Reported when a team-owned file still has | Completion step |
 |----|-------------------------------------------|-----------------|

package/payload/docs/testing.md

@@ -125,7 +125,7 @@ Every check Meridian runs has one row, named by a key: a gate step, a group of t
 | `verify/build` | large | functional | change | no | `pnpm verify` | 9.6 s at 40d29c7 | One production build. |
 | `verify/route policy` | large | non-functional | change | no | `pnpm verify` | 0.1 s at 40d29c7 | Every route is declared static or dynamic as its policy says. |
 | `verify/first-load` | large | non-functional | change | no | `pnpm verify` | 0.3 s at 40d29c7 | The first-load size of each route is within its budget. |
-| `verify/html` | large | non-functional | change | no | `pnpm verify` | 0.3 s at 40d29c7 | The served HTML of each route is within its size check. |
+| `verify/html` | large | non-functional | change | no | `pnpm verify` | 1.5 s at dbf4106 | Every page's served HTML, gzipped, is within `htmlGrowthPct` of its own baseline figure and under any `htmlKb` cap. |
 | `verify/navigation` | large | functional | change | no | `pnpm verify` | 92.5 s at 269d307 | From a press in the rail, each route's shell, data and first interaction arrive, on desktop and through the phone drawer, judged on function only, never on time; up to three routes, every rail route under `--full` or `--timed`. |
 | `verify/timing` | large | performance | timed | yes | `pnpm verify --timed` | 88.2 s at fa5bbff | The same navigation of every rail route, with each shell, data and interaction time judged against its budget. |
 | `verify/personas` | large | functional | on request | no | `pnpm verify --as viewer` | 937.8 s at fa5bbff (the five personas) | Signed in as each named persona, the rail shows the routes that persona may open and a denied route draws its refusal. |

package/payload/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zz-meridian-template",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "private": true,
   "license": "MIT",
   "description": "ZZ Meridian: a dashboard design system and starter. Six layers, from DTCG tokens through four layers of React components to product workspaces, and a Design Atlas, in a light and a dark theme.",
@@ -30,34 +30,35 @@
     "keyboard": "node scripts/keyboard.ts"
   },
   "dependencies": {
-    "@ai-sdk/anthropic": "4.0.71",
-    "@ai-sdk/openai-compatible": "3.0.62",
-    "@ai-sdk/react": "4.0.130",
-    "ai": "7.0.127",
+    "@ai-sdk/anthropic": "4.0.82",
+    "@ai-sdk/openai-compatible": "3.0.71",
+    "@ai-sdk/react": "4.0.147",
+    "ai": "7.0.143",
     "clsx": "^2.1.1",
-    "lucide-react": "^1.50.0",
-    "next": "16.3.8",
-    "radix-ui": "^1.6.7",
-    "react": "19.3.0",
-    "react-dom": "19.3.0",
+    "lucide-react": "^1.59.0",
+    "next": "16.4.2",
+    "radix-ui": "^1.8.1",
+    "react": "19.3.1",
+    "react-dom": "19.3.1",
     "react-markdown": "^10.1.0",
     "remark-gfm": "^4.0.1",
     "tailwind-merge": "^3.7.0",
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4.3.3",
-    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/dom": "^10.4.2",
+    "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",
     "@types/node": "^24",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
+    "@vitejs/plugin-react": "^6.1.2",
     "eslint": "^9.39.5",
-    "eslint-config-next": "16.3.8",
-    "jsdom": "^30.1.1",
+    "eslint-config-next": "16.4.2",
+    "jsdom": "^30.1.3",
     "tailwindcss": "^4.3.3",
     "typescript": "5.9.3",
-    "vitest": "^5.0.3"
+    "vitest": "^5.0.5"
   }
 }