zz-meridian 0.5.0 → 0.6.1

package/dist/adopt.js

@@ -8,7 +8,7 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { PAYLOAD, VERSION, brandArgs, effectiveBrand, inside, installSkill, packageManager, payloadFiles, readJsonc, readPayload, relativeImports, run, runTool, sha256, writeIn, writeManifest, } from './files.js';
+import { VERSION, brandArgs, effectiveBrand, inside, installSkill, packageManager, payloadBytes, payloadFiles, readJsonc, readPayload, relativeImports, run, runTool, sha256, writeIn, writeManifest, } from './files.js';
 import { BRIEF_TEMPLATE, managedBlock, upsertManagedBlock } from './context.js';
 import { FIXED, adoptSetOf, managedPaths } from './ownership.js';
 /** The template's dependencies a dashboard built from these files needs. */
@@ -161,7 +161,7 @@ https://github.com/zhixuan312/zz-meridian/blob/master/skills/zz-meridian/referen
         owned.push(rel);
     };
     for (const rel of set) {
-        const raw = fs.readFileSync(path.join(PAYLOAD, rel));
+        const raw = payloadBytes(rel);
         own(rel, TS.test(rel) ? exactImports(rel, raw.toString('utf8'), known) : raw);
     }
     own('src/app.config.ts', exactImports('src/app.config.ts', appConfig(routes(root, dir)), known));

package/dist/create.js

@@ -7,7 +7,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { managedPaths } from './ownership.js';
 import { BRIEF_TEMPLATE, managedBlock, upsertManagedBlock } from './context.js';
-import { PAYLOAD, VERSION, brandArgs, effectiveBrand, hasCommand, inside, installSkill, payloadFiles, run, sha256, writeIn, writeManifest } from './files.js';
+import { VERSION, brandArgs, effectiveBrand, hasCommand, inside, installSkill, payloadBytes, payloadFiles, run, sha256, writeIn, writeManifest } from './files.js';
 export function create(o) {
     const root = path.resolve(o.dir);
     if (fs.existsSync(root) && fs.readdirSync(root).length)
@@ -22,7 +22,7 @@ export function create(o) {
     for (const rel of payloadFiles()) {
         if (rel.startsWith('skills/'))
             continue;
-        writeIn(root, rel, fs.readFileSync(path.join(PAYLOAD, rel)));
+        writeIn(root, rel, payloadBytes(rel));
     }
     const name = brand.name ?? path.basename(root).replace(/[-_]+/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
     brand = effectiveBrand({ ...brand, name });

package/dist/files.js

@@ -10,7 +10,16 @@ import { fileURLToPath } from 'node:url';
 /** The template snapshot this package carries, built from `git ls-files` at the release commit. */
 export const PAYLOAD = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'payload');
 export const VERSION = JSON.parse(fs.readFileSync(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8')).version;
-/** Every file under a payload folder, as posix paths relative to the payload. Symbolic links are never followed. */
+/**
+ * npm renames a `.gitignore` inside an installed package to `.npmignore`, so the payload carries the template's as
+ * `gitignore`. `shippedPath` is the name a project path ships under; `projectPath` reads one back, and also reads a
+ * `.gitignore` as itself, which is how releases before 0.6.1 carry it.
+ */
+export const shippedPath = (rel) => (rel === '.gitignore' ? 'gitignore' : rel);
+export const projectPath = (rel) => (rel === 'gitignore' ? '.gitignore' : rel);
+/** A payload file's bytes, by its project path. */
+export const payloadBytes = (rel) => fs.readFileSync(path.join(PAYLOAD, shippedPath(rel)));
+/** Every file under a payload folder, as project paths. Symbolic links are never followed. */
 export function payloadFiles(dir = '') {
     const out = [];
     const walk = (rel) => {
@@ -21,14 +30,14 @@ export function payloadFiles(dir = '') {
             if (e.isDirectory())
                 walk(p);
             else if (e.isFile())
-                out.push(p);
+                out.push(projectPath(p));
         }
     };
     if (fs.existsSync(path.join(PAYLOAD, dir)))
         walk(dir);
     return out.sort();
 }
-export const readPayload = (rel) => fs.readFileSync(path.join(PAYLOAD, rel), 'utf8');
+export const readPayload = (rel) => payloadBytes(rel).toString('utf8');
 /**
  * A path inside `root`; anything that would resolve outside it is refused: `..`, an absolute path, or a symbolic link
  * on the way (a linked folder or file could carry a write somewhere else).
@@ -132,7 +141,7 @@ export function installSkill(root, record) {
     for (const base of ['.agents/skills/zz-meridian', '.claude/skills/zz-meridian']) {
         for (const f of files) {
             const rel = `${base}/${f.slice('skills/zz-meridian/'.length)}`;
-            const content = fs.readFileSync(path.join(PAYLOAD, f));
+            const content = payloadBytes(f);
             writeIn(root, rel, content);
             if (record)
                 record[rel] = sha256(content);

package/dist/reconcile.js

@@ -6,10 +6,13 @@ import { upsertManagedBlock } from './context.js';
 export const TOOLCHAIN = ['typescript', '@types/node', '@types/react', '@types/react-dom', 'tailwindcss', '@tailwindcss/postcss', 'eslint', 'eslint-config-next', 'vitest', '@vitejs/plugin-react', 'jsdom', '@testing-library/react', '@testing-library/jest-dom'];
 export const MERIDIAN_SCRIPTS = ['typecheck', 'test', 'tokens', 'check', 'contrast', 'gate', 'audit', 'verify', 'brand', 'shot', 'interactions', 'keyboard', 'vitals'];
 const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
-/** The minimum version of `x.y.z`, `^x.y.z`, `~x.y.z` or `>=x.y.z`; null for anything else. */
+/**
+ * The minimum version of `x.y.z`, `^x.y.z`, `~x.y.z` or `>=x.y.z`, where a missing minor or patch is 0 (`^24` is
+ * 24.0.0, `~5.9` is 5.9.0); null for anything else.
+ */
 function minimum(spec) {
-    const m = typeof spec === 'string' ? /^(?:\^|~|>=)?(\d+)\.(\d+)\.(\d+)$/.exec(spec.trim()) : null;
-    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+    const m = typeof spec === 'string' ? /^(?:\^|~|>=)?(\d+)(?:\.(\d+)(?:\.(\d+))?)?$/.exec(spec.trim()) : null;
+    return m ? [Number(m[1]), Number(m[2] ?? 0), Number(m[3] ?? 0)] : null;
 }
 const compare = (a, b) => a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
 const file = (id, summary, instructions, path) => ({ id, summary, paths: [path], instructions, checks: [] });

package/dist/replay.js

@@ -7,7 +7,7 @@ import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { brandArgs, inside, run, sha256 } from './files.js';
+import { brandArgs, inside, projectPath, run, sha256 } from './files.js';
 /** The package folder of the running CLI: the parent of its `dist/`. */
 export const runningRelease = () => path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 /** A command's failure as one message: the cause, then everything it printed. */
@@ -165,7 +165,7 @@ function replayTree(pkgRoot, route, brand, scratch, moduleType) {
 export function replay(pkgRoot, route, brand, scratch, moduleType = false) {
     return replayTree(pkgRoot, route, brand, scratch, moduleType).hashes;
 }
-/** Every regular file under `<release>/payload` as posix paths, symbolic links never followed. */
+/** Every regular file under `<release>/payload` as posix project paths, symbolic links never followed. */
 export function payloadList(release) {
     const base = path.join(release, 'payload');
     const out = [];
@@ -175,7 +175,7 @@ export function payloadList(release) {
             if (e.isDirectory())
                 walk(p);
             else if (e.isFile())
-                out.push(p);
+                out.push(projectPath(p));
         }
     };
     if (fs.existsSync(base))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zz-meridian",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Bring ZZ Meridian, a dashboard design system, into a Next.js project, or start a new dashboard on it. Copies the files in; nothing depends on this package at runtime.",
   "license": "MIT",
   "type": "module",

package/payload/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 Every release of ZZ Meridian, newest first. Versions follow semver: a removed or renamed token, prop or card is major; a new card, token or variant is minor; a corrected value is a patch. Each entry says what breaks and what to do instead.
 
+## [0.6.1] · 2026-10-06
+
+### Fixed
+
+- **A created project has its `.gitignore`.** npm renames a `.gitignore` inside an installed package to `.npmignore`, so every project made with `create` since 0.3.0 had a `.npmignore` and no `.gitignore`, and `git add` took in `node_modules`, `.next` and `.env.local`. The package now carries the template's as `payload/gitignore`, and `create` writes it as `.gitignore`. In a project created before 0.6.1, run `git mv .npmignore .gitignore`, then `git rm -r --cached node_modules .next` for whatever was committed; `update` leaves the file alone, since it is the team's.
+- **`update` runs from the registry.** It compares the running package with the published one, and npm's rename made the two differ, so `npx zz-meridian@<version> update` refused itself with "the running package differs from zz-meridian@<version> on the registry" since 0.5.0. 0.6.0 is on npm with this defect and has no tag or GitHub Release: update with 0.6.1.
+- **A gate step whose tool is not installed says so.** `scripts/gate.ts` printed a `TypeError` in place of the missing command.
+
+## [0.6.0] · 2026-10-06
+
+### Changed
+
+- **An API key is shown in full once, when it is created.** The keys collection stores each key's `hint` (its prefix and last four characters, `zzm_live_…f601`) and `secretHash` (the secret's SHA-256), never the secret. `createKey` returns the new key with its `secret` for the creation banner, and the table lists every key by its hint, with no Reveal or Copy. Breaking: `ApiKey` has `hint` and `secretHash` in place of `secret`, and `KeysView`'s `createKey` returns `ApiKey & { secret: string }`. A created project's own keys page and fixtures keep the old shape until the team takes the release's versions.
+- **Links are never underlined.** Hover is a colour change and focus is the focus ring every control has. `.link` (accent ink in a sentence) turns `ink` on hover; `.row-link` (a destination in a list) takes `accent-ink`; a Data table's linked row takes the `fill-hover` tint and its title keeps its colour. Before, both classes drew a 1px line across the link's box, which under a link holding a second line read as a rule across its whole width.
+- **Replay sends a failed request again.** On a 5xx or 429 request's page, Replay calls `replayRequest` (`app/(dashboard)/requests/[id]/actions.ts`): it authorizes the write, creates a new request with the same method, route, customer, region and model and a `replayOf` naming the original, and refreshes the request reads. A toast names the new request with Open, and its page links back. It used to toast "Replay queued" and send nothing. The requests collection allows `create` as a page-only operation, so the assistant cannot replay. `arrayCollection` takes `derive`, which works out a row's `derived` fields on every create and change. The request page no longer shows a fixed "API key" it did not know. Breaking: `RequestView` takes `replay`.
+- **A form in an open sheet says why it failed inside the sheet.** A refused invitation reopens the Members sheet with what was typed and a critical Banner, "Invitation not sent", with the reason. A refused key reads "Key not created" at the top of the Create a key sheet. Neither sends a toast over the sheet's own buttons. Refused changes made from a table row still toast.
+
+### Fixed
+
+- **`update` reads a dependency written as `^24` (or `~5.9`) as a version.** It used to call any range without a minor and patch "a specification Meridian cannot compare". Every created project carries `"@types/node": "^24"`, so each update asked the team to replace `^24` with "at least ^24" before it could complete. A missing minor or patch now counts as 0.
+
+### Release
+
+- **The release's timed default verify allows 180 s on the shared GitHub 4-CPU runner.** The same commit measured 111 s on one runner CPU and 152 s on another, so 120 s stopped a release on the draw of the machine. The default verify must still pass in full; 120 s remains the target on an adopter's own machine. The stakeholder's decision.
+
 ## [0.5.0] · 2026-10-06
 
 ### Added

package/payload/app/(dashboard)/keys/README.md

@@ -10,7 +10,7 @@ Status: beta
 |---|---|---|---|
 | Masthead | PageFrame: kicker, "API keys", one sentence, Create key (primary) | One band | Stacked |
 | 1 | Banner (accent), only right after a key is created: "Copy {name} now", the full key in a Copy field, dismissable | Full width | Full width |
-| 2 | Data table: Name with its environment, Key (masked Copy field, from 768px), Scopes (two and "+N", from 1280px), Created by (from 1024px), Created, Last used, and Revoke | Columns | Cards: name and environment, "Created …" and "Used …", Revoke |
+| 2 | Data table: Name with its environment, Key (its hint, `zzm_live_…f601`, in mono, from 768px), Scopes (two and "+N", from 1280px), Created by (from 1024px), Created, Last used, and Revoke | Columns | Cards: name and environment, "Created …" and "Used …", Revoke |
 | Sheet | Create a key: Name (required), Environment (Live or Test), Scopes (checkboxes); Cancel and Create key | From the right, 440px | From the bottom |
 | Dialog | Revoke: "Revoke {name}?", what fails and that it cannot be undone, when it was last used; Cancel and Revoke key (danger) | Centred | Bottom sheet |
 
@@ -22,13 +22,14 @@ Status: beta
 | Default | The collection's keys, in its order |
 | Just created | The accent Banner with the only full view of the secret; a toast "Key created" |
 | Name missing | The Name field's error: "Name the key after what uses it" |
+| Not created | A critical Banner at the top of the open sheet, "Key not created", with the server's reason; the sheet keeps what was typed |
 | Revoked | The row leaves; a toast "Key revoked" |
 | No keys | The first-run empty state with Create key |
 | Never used | "Never" in `ink-3` |
 
 ## Data
 
-The keys come from `collections.keys` (`src/data/collections.ts`), read on every request. Create and Revoke are server actions (`actions.ts`) that call `keys.create` and `keys.remove`, then the view refreshes the route; a rejected action shows a critical toast and changes nothing. The secret is generated on the server and shown once, in the banner. A secret is always masked in the table; Copy copies the real value without revealing it.
+The keys come from `collections.keys` (`src/data/collections.ts`), read on every request. Create and Revoke are server actions (`actions.ts`) that call `keys.create` and `keys.remove`, then the view refreshes the route. A rejected create is said inside the sheet; a rejected revoke shows a critical toast and puts the row back. The secret is generated on the server and returned once, to the banner, which is the only place it is ever shown. The collection stores the key's hint (its prefix and last four characters) and the secret's SHA-256, never the secret, so the table shows the hint and nothing in the browser or the cache can reveal or copy a listed key. To replace a key, create a new one and revoke the old.
 
 ## Embed view
 

package/payload/app/(dashboard)/keys/actions.ts

@@ -1,6 +1,6 @@
 'use server';
 
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { updateTag } from 'next/cache';
 import { z } from 'zod';
 import { app } from '@/app.config';
@@ -16,14 +16,20 @@ const draft = z.object({
   scopes: z.array(z.enum(SCOPES), { error: 'Choose only the scopes a key can carry.' }).min(1, 'Give the key at least one scope.'),
 });
 
-/** Creates a key and returns it: the only moment its full secret leaves the server for a banner. */
-export async function createKey(input: z.input<typeof draft>): Promise<ApiKey> {
+/**
+ * Creates a key and returns it with its full secret: the only moment the secret exists outside the caller's own copy.
+ * What is stored is the key's hint (its prefix and last four characters) and the secret's SHA-256, never the secret.
+ */
+export async function createKey(input: z.input<typeof draft>): Promise<ApiKey & { secret: string }> {
   const { name, env, scopes } = draft.parse(input);
   const scope = await resolveAccess();
   if (!(await can(scope, 'keys', 'create'))) throw new AccessDenied();
-  const key = await collectionFor(scope, 'keys').create!({ name, env, scopes, owner: app.user.name, created: clock().toISOString(), lastUsed: null, secret: `zzm_${env}_${randomBytes(16).toString('hex')}` });
+  const secret = `zzm_${env}_${randomBytes(16).toString('hex')}`;
+  const hint = `zzm_${env}_…${secret.slice(-4)}`;
+  const secretHash = createHash('sha256').update(secret).digest('hex');
+  const key = await collectionFor(scope, 'keys').create!({ name, env, scopes, owner: app.user.name, created: clock().toISOString(), lastUsed: null, hint, secretHash });
   updateTag(collectionTag(scope.tenantId, 'keys'));
-  return key;
+  return { ...(key as ApiKey), secret };
 }
 
 export async function revokeKey(id: string): Promise<void> {

package/payload/app/(dashboard)/members/README.md

@@ -25,7 +25,7 @@ The row menu holds Suspend (Reactivate on a suspended member) and Remove.
 | Suspended | The status Badge in `warning` |
 | Name or email missing | The field's error under it; nothing is sent |
 | Changed | The page refreshes from the collection and a toast confirms: "Member suspended", "Member reactivated", "Member removed", "Invitation sent to {email}" |
-| Rejected | A critical toast with the reason; the table does not change |
+| Rejected | The table goes back to what it was. A refused invitation reopens the sheet with what was typed and a critical Banner, "Invitation not sent", with the reason; a refused status change or removal shows a critical toast with the reason |
 | No members | The first-run empty state with Invite member |
 
 ## Data

package/payload/app/(dashboard)/requests/[id]/README.md

@@ -9,7 +9,7 @@ Status: beta
 | Row | Pattern | Console | Mobile |
 |---|---|---|---|
 | Masthead | Detail head: "← Requests", the ID in mono with its status Badge, facts (method and route, latency, customer, when), More actions, Copy as cURL, and Replay as the primary when the request failed (5xx or 429) | One band | Facts wrap; actions on their own row |
-| 1 | Row `2/3`: Request facts (Key value, two columns: received, endpoint, latency, response size, customer linking to their requests, region, API key, cost, and model and tokens only on the routes that call a model; the ID and status are in the head, not repeated) · Trace (one bar per phase on a shared scale: gateway, auth, queue, the route's own work, the response) | Side by side | Stacked |
+| 1 | Row `2/3`: Request facts (Key value, two columns: received, endpoint, latency, response size, customer linking to their requests, region, the request it replays when it is a replay, cost, and model and tokens only on the routes that call a model; the ID and status are in the head, not repeated) · Trace (one bar per phase on a shared scale: gateway, auth, queue, the route's own work, the response) | Side by side | Stacked |
 | 2 | Request body and Response body side by side, each a card with a code block (wrapping, never scrolling sideways) and Copy | 1/2 + 1/2 | Stacked |
 
 ## States
@@ -19,13 +19,15 @@ Status: beta
 | Loading | `loading.tsx`: the facts beside the trace, then two body cards, as skeletons. The id is read inside that boundary |
 | Success | Status `neutral`; the route's own phase (Model, Search, Storage or Parse) in the accent; no primary action |
 | Rate limited, rejected, not found | Status `warning`; the trace ends at the limit, the validation or the lookup phase, in `critical`; tokens and cost read "None, refused"; the response is a short error body |
-| No request body (GET, DELETE) | The Request body card says "No body: a GET carries everything it needs in its address." in a dashed frame; Copy as cURL sends no `-d`; Replay says it runs again without "with the same body" |
+| No request body (GET, DELETE) | The Request body card says "No body: a GET carries everything it needs in its address." in a dashed frame; Copy as cURL sends no `-d` |
 | Failed | Status `critical`; the route's own phase and the error phase in `critical`; Replay is the primary |
+| Replayed | A toast "Replayed: 200 OK" (or 201) naming the new request, with Open; the new request leads the list and its page shows "Replay of" linking back |
+| Replay refused | A critical toast "Not replayed" with the reason; nothing is written |
 | Unknown ID | The page renders the console's Not found screen itself (`MissingPage`, see `app/not-found/README.md`), with `noindex`, rather than throwing `notFound()`, so the screen is in the first HTML |
 
 ## Data
 
-The request from the `requests` collection (`src/data/collections.ts`), queried by id; its trace and payloads from `traceOf()` and `payloadsOf()` in `src/system/fixtures/sample-records.ts`. Phases add up to the request's latency; the axis shows 0, half and the total.
+The request from the `requests` collection (`src/data/collections.ts`), queried by id. Replay is the page's Server Action (`actions.ts`, `replayRequest`): it authorizes, reads the request, and creates a new one with the same method, route, customer, region and model, naming the one it replays, then refreshes the tenant's request reads. A product calls its gateway there with the stored request; the sample's gateway answers a replay of a 5xx or a 429, the only requests that offer Replay, with the route's success. Its its trace and payloads from `traceOf()` and `payloadsOf()` in `src/system/fixtures/sample-records.ts`. Phases add up to the request's latency; the axis shows 0, half and the total.
 
 ## Embed view
 

package/payload/app/(dashboard)/requests/[id]/actions.ts

@@ -0,0 +1,34 @@
+'use server';
+
+import { updateTag } from 'next/cache';
+import { clock } from '@/data/collections';
+import { can, collectionFor, resolveAccess, Unauthenticated } from '@/data/access';
+import { collectionTag } from '@/data/read';
+import type { RequestRow } from '@/data/sample';
+
+export type ReplayResult = { ok: true; id: string; status: number } | { ok: false; error: string };
+
+/**
+ * Sends a logged request again: the same method, route, customer, region and model, as a new request that names the one
+ * it replays. A product calls its gateway here with the stored request; the sample's gateway answers a replay of a
+ * temporary failure (a 5xx or a 429, the only requests that offer Replay) with the route's success. Authorized like any
+ * write, then the tenant's request reads are refreshed.
+ */
+export async function replayRequest(id: string): Promise<ReplayResult> {
+  try {
+    const scope = await resolveAccess();
+    if (!(await can(scope, 'requests', 'create'))) return { ok: false, error: 'You do not have permission to replay requests.' };
+    const requests = collectionFor(scope, 'requests');
+    const original = (await requests.query({ where: [{ field: 'id', op: 'eq', value: id }] })).rows[0] as RequestRow | undefined;
+    if (!original) return { ok: false, error: `No request with id ${id}.` };
+    const status = original.method === 'POST' ? 201 : 200;
+    const replay = await requests.create!({
+      at: clock().toISOString(), method: original.method, route: original.route, status, latency: original.latency,
+      customer: original.customer, region: original.region, bytes: original.bytes, model: original.model, replayOf: original.id,
+    });
+    updateTag(collectionTag(scope.tenantId, 'requests'));
+    return { ok: true, id: String(replay.id), status };
+  } catch (e) {
+    return { ok: false, error: e instanceof Unauthenticated ? 'Sign in again to replay this request.' : e instanceof Error ? e.message : 'The request was not replayed.' };
+  }
+}

package/payload/app/(dashboard)/requests/[id]/page.tsx

@@ -2,6 +2,7 @@ import { read } from '@/data/read';
 import { FEATURED_REQUEST_IDS, traceOf, payloadsOf, type RequestRow } from '@/data/sample';
 import { MissingPage } from '@/views/missing-page';
 import { RequestView } from '@/views/request';
+import { replayRequest } from './actions';
 
 export function generateStaticParams() {
   return FEATURED_REQUEST_IDS.map((id) => ({ id }));
@@ -22,5 +23,5 @@ export default async function RequestPage({ params }: { params: Promise<{ id: st
   const { request: r, observedAt } = await byId(id);
   // Rendered here rather than thrown, so the screen is in the first HTML (see MissingPage).
   if (!r) return <MissingPage />;
-  return <RequestView request={r} trace={traceOf(r)} payloads={payloadsOf(r)} now={observedAt} />;
+  return <RequestView request={r} trace={traceOf(r)} payloads={payloadsOf(r)} now={observedAt} replay={replayRequest} />;
 }

package/payload/app/system/(atlas)/page.tsx

@@ -129,7 +129,7 @@ export default function AtlasHome() {
             <p className="t-kicker">{release.version} · {release.date}</p>
             <p className="t-small mt-4 max-w-[48ch] text-ink-2">{release.summary}</p>
             {changelog ? (
-              <Link href={changelog} className="mt-6 inline-flex items-center gap-1.5 text-sm font-medium text-accent-ink hover:underline">
+              <Link href={changelog} className="mt-6 inline-flex items-center gap-1.5 text-sm font-medium text-accent-ink hover:text-ink">
                 Full changelog <ArrowRight className="size-3.5" />
               </Link>
             ) : null}

package/payload/decisions/0010-the-adopter-contract.md

@@ -94,7 +94,7 @@ this is the reason they agree.
 - HTML caps are `/requests` 150 KiB and `/health` 100 KiB. The stakeholder set them after measurement showed no variant
   kept the page title instant within 130 KiB.
 - Weekly is weekly, release is release, and nothing runs twice. The release gates, each once, on the default verify
-  from a clean `.next` on the GitHub-hosted ubuntu-24.04 4-CPU runner (at most 120 s, with its browser smoke; the gate
+  from a clean `.next` on the GitHub-hosted ubuntu-24.04 4-CPU runner (at most 120 s, raised to 180 s in 0.6.0 because the runner's CPU varies, with its browser smoke; the gate
   and its unit tests run inside it) and on the consumer smoke from the tarball: adopt, create with its default verify,
   and all four published origins updated through finalize. After publishing it checks the registry serves the tested
   tarball (equal sha256) with provenance, and tags last. A weekly workflow runs `verify --full --perf` (the perf part a

package/payload/docs/assistant.md

@@ -93,7 +93,7 @@ Add it to `collections`. For a real store, write the same `Collection` yourself:
 
 Two fields on a collection keep the assistant in bounds:
 
-- `pageOnly`: operations only a page may perform. The assistant never gets a tool for them. In the sample, creating an API key is `pageOnly`, because the secret is shown once, on the page.
+- `pageOnly`: operations only a page may perform. The assistant never gets a tool for them. In the sample, creating an API key is `pageOnly`, because the secret is shown once, on the page, and so is replaying a request, a person's action on its page.
 - `hidden`: fields only a page may see. They are left out of every tool's input and of every query result. The sample hides a key's `secret`.
 
 Per collection the assistant gets `query_<name>`, and `create_<name>`, `update_<name>` and `remove_<name>` for what is allowed and not `pageOnly`. A query takes `where` conditions (`eq`, `ne`, `gt`, `lt`, `contains`, `in`), a `sort` and a `limit`. A field the collection does not have, or hides, is rejected, and a field with no value matches only `ne`. `arrayCollection` parses what is created or changed with the collection's `fields`, so the schema is where a record's rules live (the sample's members need a name and a valid email).

package/payload/docs/benchmark.md

@@ -11,7 +11,7 @@ Meridian held to the bar of award-winning sites (Awwwards, Webby, FWA) and of th
 | Visual hierarchy | Strong | One protagonist per page. Hierarchy ratio (largest text over median) on analytical pages: Overview 6×, Health 6.5×, Requests 4.6×, Analytics 4.6×; standalone screens 7.2–7.8× |
 | Colour | Strong | A night-sky neutral leaning indigo; one accent that is two numbers (hue, chroma), four presets; status trio reserved; six categorical chart slots validated for colour-vision deficiency (worst adjacent ΔE 10.2 light, 8.7 dark). 328 contrast pairs pass in every theme and accent |
 | Motion | Good | Three jobs (arrive, answer, float), four durations, three curves; data arrives once (a line draws, an area reveals, bars grow); nothing loops but a live dot and a skeleton; reduced motion shows the final state at once |
-| Micro-interaction | Good | The rail's pill springs between items; the Segmented thumb slides; a lit edge fades in under the pointer; an underline draws in on row links; the Meridian cursor answers pointer, touch and arrow keys with a readout on every chart and tile. Every control on every page is pressed by `scripts/interactions.ts`, with taps at 390px; none does nothing |
+| Micro-interaction | Good | The rail's pill springs between items; the Segmented thumb slides; a lit edge fades in under the pointer; a linked row takes a hover fill and a link changes colour, never underlined; the Meridian cursor answers pointer, touch and arrow keys with a readout on every chart and tile. Every control on every page is pressed by `scripts/interactions.ts`, with taps at 390px; none does nothing |
 | Responsive | Strong | Zero sideways scroll, zero clipped text and no table wider than its card at 390–1440px on every page (the last was missed until 2026-10-03: see below); tables become card lists under 768px; phone tiles put the sparkline beside the figure; dialogs become bottom sheets |
 | Originality | Strong | The Meridian (one time cursor shared by every chart, tile and the model); three surfaces including MCP Apps with a working host simulator; two operators with consent, provenance and handoff built into components |
 

package/payload/docs/distribution.md

@@ -150,8 +150,7 @@ For 0.5.0 they are:
 | `live-provider` | `src/data/collections.ts` without `src/data/live-actions.ts`, or a dashboard layout with neither `LiveProvider` nor `ConsoleLive` | `live.md`, "The live starters" and "Refreshing": add the five files and the provider |
 | `authorized-endpoints` | `app/api/assistant/route.ts`, or an `actions.ts` Server Action file, without a `resolveAccess` call | `cache.md`, "The assistant route": call `resolveAccess()` first and bring `tools.ts` and `respond.ts` over |
 
-The consumer smoke (`--update`) resolves the nine that touch source on all four published origins, a project adopted and a project created
-with 0.3.0 and with 0.4.0, as `references/update.md` tells an agent: a created origin, whose files are the template's,
+The consumer smoke (`--update`) updates a project adopted and a project created with each published release from 0.3.0 on. It resolves the nine migrations that touch source on the 0.3.0 and 0.4.0 origins, as `references/update.md` tells an agent: a created origin, whose files are the template's,
 takes the release's versions of the affected team-owned files and the files that arrived with them; an adopted origin,
 whose pages are the team's own, makes the minimal edit the instruction names. It then records the resolutions and
 finalizes, so the gate and the build run on the result, and checks the team's own files kept their bytes. A 0.4.0
@@ -204,7 +203,8 @@ Modelled on the release pipeline of the owner's earlier packages, one package in
    `cli/package.json`'s and the tag must be unused.
 2. **Gates** (ubuntu-24.04, 4 CPUs, the reference profile), each run once: the package's own tests (`tests/cli-*`, which
    no adopted or created project has); the template's default `verify` from a clean `.next` through
-   `cli/scripts/release-check.ts`, within 120 s and with its browser smoke (the gate and the template's unit tests run
+   `cli/scripts/release-check.ts`, within 180 s on the shared runner (whose CPU varies: one commit measured 111 s on one
+   and 152 s on another) and with its browser smoke (the gate and the template's unit tests run
    inside it); and the consumer smoke from the built tarball (step 4). The full, perf and recovery suites are never
    run here: they run weekly (below).
 3. **Pack and assert, before anything is irreversible**: `npm pack` in `cli/`, then on the tarball: the bin has its
@@ -214,7 +214,8 @@ Modelled on the release pipeline of the owner's earlier packages, one package in
    - `adopt` into `cli/test/fixture-next-app` (a minimal App Router app with one page and its own stylesheet), then
      install, `tsc --noEmit` and `next build`, all green. This is the test that keeps the Route A list complete.
    - `create` into a clean folder, then its default `pnpm verify`. The smoke quotes the coverage line.
-   - `update` from all four published origins (0.3.0 and 0.4.0, adopted and created) through finalize, as above.
+   - `update` from every published origin since 0.3.0 (adopted and created) through finalize, as above. A 0.5.0 origin
+     reports no migration; a created one with nothing to resolve completes in the update itself.
 5. **Publish** the tarball with `npm` 11.5.1 or newer through trusted publishing (OIDC), with `--provenance`. `pnpm
    publish` does not perform the OIDC exchange.
 6. **The registry's package**: `npx zz-meridian@<version> --version` answers the version, the registry's tarball has the

package/payload/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zz-meridian-template",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "private": true,
   "license": "MIT",
   "description": "ZZ Meridian: a dashboard design system and starter. DTCG tokens, five layers of React components and a Design Atlas, in a light and a dark theme.",

package/payload/scripts/gate.ts

@@ -36,7 +36,8 @@ for (const [name, [cmd, ...args]] of STEPS) {
   const ok = r.status === 0;
   console.log(`${ok ? 'ok  ' : 'FAIL'} ${name} (${((Date.now() - t) / 1000).toFixed(1)}s)`);
   if (!ok) {
-    console.log((r.stdout + r.stderr).trim().split('\n').slice(-40).join('\n'));
+    // A tool that could not start (not installed) has no output, only the error.
+    console.log(`${r.stdout ?? ''}${r.stderr ?? ''}${r.error ? `${cmd}: ${r.error.message}` : ''}`.trim().split('\n').slice(-40).join('\n'));
     process.exit(1);
   }
 }

package/payload/skills/zz-meridian/references/cache.md

@@ -141,7 +141,7 @@ const DEMO: AccessScope = { tenantId: 'demo', subjectId: 'owner', authorizationK
 const DEMO_COLLECTIONS: Record<string, { collection: AnyCollection; ops: readonly Operation[] }> = {
   members: { collection: members, ops: ['read', 'create', 'update', 'remove'] },
   keys: { collection: keys, ops: ['read', 'create', 'remove'] },
-  requests: { collection: requests, ops: ['read'] },
+  requests: { collection: requests, ops: ['read', 'create'] },
 };
 
 export const { resolveAccess, collectionFor, can } = accessFrom({

package/payload/src/components/charts/timeline/README.md

@@ -33,7 +33,7 @@ Leave `from` and `to` out and the span is the items' own extent. A roadmap usual
 | State | Spec |
 |---|---|
 | Rest | as above |
-| Linked | an item with `href` makes its label a link (`row-link`: an underline draws in on hover) |
+| Linked | an item with `href` makes its label a link (`row-link`: it takes the accent on hover, with no underline) |
 | Outside the span | a bar is clipped to the span and the side that continues is squared off (`rounded-l-none` when it started before `from`, `rounded-r-none` when it ends after `to`), so work that runs past the window does not read as work that began at its edge; Today is drawn only when it falls inside |
 
 ## Behaviour

package/payload/src/components/charts/timeline/index.tsx

@@ -115,7 +115,7 @@ export function Timeline({
                 <Fragment key={it.id}>
                   {/* The label is the item's one link: visible, focusable, and read with the table's dates. */}
                   {it.href ? (
-                    <Link href={it.href} title={it.label} className="row-link self-center truncate py-2 pr-3 text-ink-2">{it.label}</Link>
+                    <Link href={it.href} title={it.label} className="row-link self-center truncate py-2 pr-3 text-ink-2 hover:text-accent-ink">{it.label}</Link>
                   ) : (
                     <span aria-hidden className="self-center truncate py-2 pr-3 text-ink-2" title={it.label}>{it.label}</span>
                   )}

package/payload/src/components/patterns/data-table/README.md

@@ -10,7 +10,7 @@ Status: beta
 2. **Title** (optional): `title`, `description` and `actions` as a Card header, when the table is one card among others on a page; a hairline under it when no toolbar follows.
 3. **Toolbar** (optional): a band above the table, `card-pad` horizontal and 14px vertical padding, a `line` divider under it from 768px. It holds a Filter bar.
 4. **Header row**: Table header cells, `surface-sunk`, 36px, `text-xs` 500 `ink-3`. A sortable head is a button with the sort arrow in `accent-ink`.
-5. **Rows**: `row-height` 52px (38px compact), a `line` divider between rows. The title column (`mobile: 'title'`, or the first) is a `.row-link` when the row opens a record.
+5. **Rows**: `row-height` 52px (38px compact), a `line` divider between rows. The title column (`mobile: 'title'`, or the first) is the row's link when the row opens a record. The whole row takes the `fill-hover` tint on hover; the title keeps its colour and is never underlined.
 6. **Selection column** (optional): 40px with a Checkbox; the head's checkbox selects the page and shows indeterminate when part of it is chosen.
 7. **Footer**: Pagination, under a `line` divider, shown only when the rows do not fit on one page.
 8. **Cards, not a second list** (under 768px): the same table's rows lay out as cards — the title and the status on one line, two or three facts under it in `text-xs` `ink-3`, separated by dots. It is the SAME tree: the row becomes a six-column grid and each cell says which part of the card it is (`data-mobile`), so nothing is built twice and no device downloads a tree it cannot show.
@@ -34,7 +34,7 @@ Row height and card padding come from the density: comfortable 52px and 24px, co
 | State | What shows |
 |---|---|
 | Rest | Rows; numeric columns right-aligned in tabular figures |
-| Hover (a linked row) | Row fill `fill-hover` over `dur-hover`; the title's underline draws in |
+| Hover (a linked row) | Row fill `fill-hover` over `dur-hover`; nothing else changes |
 | Selected | Row fill `accent-tint`; the checkbox in `accent` |
 | Focus | The link or the checkbox shows the 2px `accent` ring |
 | Loading | `aria-busy`; up to eight skeleton rows shaped like real ones (a wide bar in the grow column, short bars elsewhere, right-aligned bars in numeric columns) — the same eight rows on a phone, laid out as cards |

package/payload/src/components/patterns/data-table/index.tsx

@@ -294,7 +294,7 @@ export function DataTable<R>({
                       const role = roleOf(c);
                       // The title is the row's link wherever it is shown, phone included: the whole card takes the
                       // pointer too (the row's own click), but the link is what a keyboard and a screen reader follow.
-                      const content = c === titleColumn && href ? <Link href={href} className="row-link">{c.cell(r)}</Link> : c.cell(r);
+                      const content = c === titleColumn && href ? <Link href={href}>{c.cell(r)}</Link> : c.cell(r);
                       return (
                         <td key={c.key} data-mobile={role} data-num={c.numeric ? 'num' : c.align === 'right' ? 'true' : undefined} className={cellClass(c) || undefined}>
                           {/* A phone may want other words for the same cell — "Used 1 min ago", not "1 min ago" — so

package/payload/src/components/patterns/filter-bar/index.tsx

@@ -124,7 +124,7 @@ export function FilterBar({
           <span>
             <span className="font-medium text-ink">Set by {setBy}</span> · these filters came from the assistant
           </span>
-          {onClear ? <button type="button" onClick={onClear} className="hit font-medium text-accent-ink hover:underline">Clear</button> : null}
+          {onClear ? <button type="button" onClick={onClear} className="hit font-medium text-accent-ink hover:text-ink">Clear</button> : null}
         </p>
       ) : null}
     </div>

package/payload/src/components/patterns/prose/README.md

@@ -12,7 +12,7 @@ Status: beta
 4. **Code**: inline on `surface-sunk` with a `line` border; a fenced block on `surface-sunk`, `radius-lg`, wrapping instead of scrolling.
 5. **Tables**: inside a `line`-bordered frame, a `surface-sunk` header row, `text-sm` cells.
 6. **Quote**: a 2px `accent` rule on the left, `ink` text.
-7. **Links**: `.link`, in `accent-ink`, underlined on hover; a link out of the product sends no referrer.
+7. **Links**: `.link`, in `accent-ink`, turning `ink` on hover, never underlined; a link out of the product sends no referrer.
 
 ## Composition
 

package/payload/src/components/patterns/shell-tools/index.tsx

@@ -58,7 +58,7 @@ export function AlertsPanel({ alerts, now, read = new Set(), onOpen, onMarkAll }
         <p className="text-sm font-semibold">Alerts</p>
         {unread ? <span className="t-caption">{unread} new</span> : null}
         {unread && onMarkAll ? (
-          <button type="button" onClick={onMarkAll} className="hit ml-auto rounded-xs text-xs font-medium text-accent-ink hover:underline">
+          <button type="button" onClick={onMarkAll} className="hit ml-auto rounded-xs text-xs font-medium text-accent-ink hover:text-ink">
             Mark all read
           </button>
         ) : null}

package/payload/src/components/ui/breadcrumb/README.md

@@ -6,7 +6,7 @@ Status: beta
 
 ## Anatomy
 
-1. **Ancestor**: a link, `ink-2`; its underline draws in on hover and it turns `ink`.
+1. **Ancestor**: a link, `ink-2`; it turns `ink` on hover, with no underline.
 2. **Separator**: a 12px chevron in `ink-3`, decorative.
 3. **Current page**: `ink`, medium, `aria-current="page"`.
 4. **Fold** (more than four levels): a 24px ellipsis button that opens a Menu of the hidden levels.
@@ -27,7 +27,7 @@ Status: beta
 | State | Ancestor |
 |---|---|
 | Rest | `ink-2` |
-| Hover | `ink`, underline draws over `dur-hover` |
+| Hover | `ink` over `dur-hover` |
 | Focus | 2px `accent` outline |
 
 ## Behaviour

package/payload/src/components/ui/card/preview.tsx

@@ -25,7 +25,7 @@ export default function CardPreview() {
               <p className="t-caption mt-2">Resets on 1 November</p>
             </CardBody>
             <CardFooter>
-              <a className="row-link inline-flex items-center gap-1 font-medium text-ink" href="#">Billing <ArrowUpRight className="size-3.5" /></a>
+              <a className="row-link inline-flex items-center gap-1 font-medium text-ink hover:text-accent-ink" href="#">Billing <ArrowUpRight className="size-3.5" /></a>
             </CardFooter>
           </Card>
         </Plane>

package/payload/src/components/ui/copy-field/README.md

@@ -58,6 +58,7 @@ Label the field with what it is: "API key", "Webhook signing secret".
 ## Do and do not
 
 - Do mask every secret by default.
+- Do not list a stored secret at all. An API key is shown in full once, when it is created; afterwards the page shows its hint (the prefix and the last four characters) as plain text, and the server never sends the secret again.
 - Do not offer Copy for something that is not meant to be pasted elsewhere.
 
 ## Implementation

package/payload/src/components/ui/toast/README.md

@@ -63,7 +63,7 @@ When an agent's approved proposal applies, the toast names the agent: "Rate limi
 ## Do and do not
 
 - Do offer Undo instead of a confirmation dialog when an action can be reversed.
-- Do not use a toast for an error the person must act on; use a Banner or the field's error.
+- Do not use a toast for an error the person must act on; use a Banner or the field's error. A form in an open sheet or dialog that fails shows its error inside the form, at the top, and keeps what was typed: a toast would land on the form's own actions.
 
 ## Implementation
 

package/payload/src/components/ui/toast/index.tsx

@@ -54,7 +54,7 @@ export function ToastView({
         {description ? <p className="mt-0.5 text-xs text-ink-2">{description}</p> : null}
       </div>
       {action ? (
-        <button type="button" className="press hit shrink-0 rounded-xs text-sm font-medium text-accent-ink hover:underline" onClick={action.onClick}>
+        <button type="button" className="press hit shrink-0 rounded-xs text-sm font-medium text-accent-ink hover:text-ink" onClick={action.onClick}>
           {action.label}
         </button>
       ) : null}

package/payload/src/data/access.ts

@@ -63,7 +63,7 @@ const DEMO: AccessScope = { tenantId: 'demo', subjectId: 'owner', authorizationK
 const DEMO_COLLECTIONS: Record<string, { collection: AnyCollection; ops: readonly Operation[] }> = {
   members: { collection: members, ops: ['read', 'create', 'update', 'remove'] },
   keys: { collection: keys, ops: ['read', 'create', 'remove'] },
-  requests: { collection: requests, ops: ['read'] },
+  requests: { collection: requests, ops: ['read', 'create'] },
 };
 
 export const { resolveAccess, collectionFor, can } = accessFrom({