@se-studio/skills 1.5.8 → 1.5.10

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @se-studio/skills
 
+## 1.5.10
+
+### Patch Changes
+
+- Document lockfile sync enforcement (scripts, CI snippet, deps-update and smoke-test skill updates).
+- 2359f69: Add `site-workflows-stale-files-cleanup` skill and `references/stale-files-cleanup/` for repository hygiene audits on SE Studio marketing sites.
+
 ## 1.5.8
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.5.8",
+  "version": "1.5.10",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/references/agent-session/projects.registry.json

@@ -13,13 +13,7 @@
       "branch": "dev",
       "type": "core",
       "validate": "pnpm validate",
-      "exampleApps": [
-        "example-om1",
-        "example-se2026",
-        "example-brightline",
-        "example-brightlifekids",
-        "example-empty"
-      ]
+      "exampleApps": ["example-empty", "cms-edit-host"]
     },
     {
       "key": "se2026",

package/references/contentful-cms-cms-guidelines/README.md

@@ -70,7 +70,7 @@ Invoke the skill with:
 **Example: merge only**
 
 ```bash
-cms-merge-guidelines --app-dir apps/example-om1
+cms-merge-guidelines --app-dir apps/example-empty
 ```
 
 ---

package/references/contentful-cms-cms-guidelines/variant-loop.md

@@ -51,7 +51,7 @@ or manually follow the steps below.
 ## Cursor agent task
 
 **Assign this task to a Cursor subagent.** Provide:
-- `apps/example-brightline/src/project/components/<TypeName>.tsx` (component source)
+- `<app-dir>/src/project/components/<TypeName>.tsx` (e.g. `apps/example-empty` or a customer app path)
 - `generated/cms-discovery/field-list.json` (field metadata including enum values)
 - `generated/cms-discovery/theme-context.md` (palette + typography — authoritative colour names)
 - `scripts/guidelines/variant-proposal-prompt.md` (variant proposal instructions)
@@ -121,7 +121,7 @@ Example for Hero:
 ### 2 — Capture screenshots
 
 ```bash
-# From apps/example-brightline
+# From the target app directory (e.g. apps/example-empty)
 node scripts/guidelines/capture-screenshots.mjs --variants /tmp/hero-variants.json
 ```
 

package/references/lockfile-sync/README.md

@@ -0,0 +1,54 @@
+# Lockfile sync enforcement
+
+Keep `pnpm-lock.yaml` aligned with every `package.json` and `pnpm-workspace.yaml` change.
+
+## Layers
+
+| Layer | What it catches |
+|-------|-----------------|
+| **Pre-commit** | Manifest changed without staged lockfile; default frozen install drift |
+| **CI validate** | Frozen install on integration branch (`develop` / `dev`) and PRs |
+| **CI hoisted job** | cms-edit Vercel path (`--config.node-linker=hoisted`) — platform optional deps |
+| **Vercel installCommand** | `--frozen-lockfile` on marketing sites; hoisted + frozen on cms-edit host |
+
+## Scripts (copy from se-core-product `scripts/`)
+
+- `check-lockfile-sync.sh` — full (`default` + `hoisted`) or `--quick` (default only)
+- `pre-commit-lockfile.sh` — wire into `.husky/pre-commit` before lint-staged
+
+## CI snippet
+
+See [`validate-workflow-snippet.yml`](validate-workflow-snippet.yml). Customer monorepos should:
+
+1. Run validate on **`develop`** (or your integration branch), not only `main`.
+2. Add a parallel `lockfile-hoisted` job when `cms-edit/host/.npmrc` has `node-linker=hoisted`.
+
+## Vercel
+
+| Project type | installCommand |
+|--------------|----------------|
+| Marketing app (monorepo root install) | `cd ../.. && pnpm install --frozen-lockfile` |
+| cms-edit host | `cd ../.. && pnpm install --frozen-lockfile --config.node-linker=hoisted` |
+
+## After dependency changes
+
+```bash
+pnpm install                    # repo root — never pnpm install -r for lockfile refresh
+git add package.json pnpm-lock.yaml pnpm-workspace.yaml
+```
+
+Use `pnpm install --no-frozen-lockfile` only when intentionally repairing the lockfile.
+
+## Rollout status (customer repos)
+
+Apply the full stack when touching deps or CI in each repo:
+
+| Repo | Pre-commit | CI develop/dev | CI hoisted | Vercel frozen (marketing) |
+|------|------------|----------------|------------|---------------------------|
+| brightline-sites | yes | yes | yes | yes |
+| pedestal-sites | — | partial | — | no |
+| om1-website | — | — | — | — |
+| se-website-2026 | — | — | — | — |
+| pointme | — | — | — | — |
+
+Update this table as repos adopt the pattern.

package/references/lockfile-sync/validate-workflow-snippet.yml

@@ -0,0 +1,32 @@
+# Append to .github/workflows/validate.yml (or equivalent CI workflow).
+# Run on the integration branch (develop / dev), not only main.
+
+on:
+  push:
+    branches: [main, develop] # or [main, dev] for se-core-product consumers
+  pull_request:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm validate
+
+  # Required when cms-edit/host (or apps/cms-edit-host) uses node-linker=hoisted.
+  lockfile-hoisted:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --config.node-linker=hoisted

package/skills/contentful-cms-generate-cms-guidelines/SKILL.md

@@ -48,7 +48,7 @@ Guidelines are only meaningful when the showcase is populated with realistic dat
 
 | Input | Description |
 |---|---|
-| **App directory** | Repo-relative path, e.g. `apps/example-om1` or `apps/example-se2026` |
+| **App directory** | Repo-relative path, e.g. `apps/example-empty` in this monorepo, or an app path in a customer repo (see `docs/RELATED_PROJECTS.md`) |
 | **Mode** | `full` \| `single` \| `merge-only` |
 | **Type name** | Required for `single` mode — the exact type name from discovery, e.g. `"Hero"` or `"Cards Grid"` |
 | **Discovery URL** | `http://localhost:<PORT>/api/cms/discovery/` — `<PORT>` from the running dev server (`pnpm dev`) |

package/skills/performance-audit/SKILL.md

@@ -94,7 +94,7 @@ mkdir -p scripts
 cp node_modules/@se-studio/skills/skills/performance-audit/lighthouse.ts scripts/lighthouse.ts
 ```
 
-Or copy from `apps/example-se2026/scripts/lighthouse.ts` in the se-core-product monorepo if you have it available.
+Or copy from a customer site repo if available (e.g. `se-website-2026/scripts/lighthouse.ts`). This monorepo only ships `apps/example-empty`.
 
 **Customise `PAGES` for the project** — edit the `PAGES` array near the top of the script. Choose representative pages: homepage, a list/index page, and a detail page. Use the sitemap to identify good candidates:
 

package/skills/se-marketing-sites-cms-routes-and-appshared/SKILL.md

@@ -5,7 +5,7 @@ description: "Guide for the (cms-routes) route group and appShared pattern. Use
 
 # CMS Routes and appShared Pattern
 
-Reference apps: **example-se2026**, **example-brightline**, **example-om1**. (example-om1 uses `resources/`, `team/`, `topics/` instead of `articles/`, `people/`, `tags/`.)
+Reference app: **example-empty** (this monorepo). Customer sites with fuller route sets: see `docs/RELATED_PROJECTS.md` (e.g. OM1 uses `resources/`, `team/`, `topics/` instead of `articles/`, `people/`, `tags/`).
 
 ## Route Group: (cms-routes)
 

package/skills/se-marketing-sites-create-page/SKILL.md

@@ -7,7 +7,7 @@ description: "Guide for creating new Next.js App Router pages and dynamic routes
 
 This guide explains how to create new pages and handle routing in the SE Core Product Next.js framework. The system uses Next.js App Router with Contentful-driven dynamic routing.
 
-Reference apps: **example-se2026**, **example-brightline**, **example-om1**.
+Reference app: **example-empty** (this monorepo). Customer implementations: see `docs/RELATED_PROJECTS.md`.
 
 ## Page Architecture
 

package/skills/se-marketing-sites-lib-cms-structure/SKILL.md

@@ -5,7 +5,7 @@ description: "Guide for the lib directory structure in SE Core Product CMS apps.
 
 # Lib Directory Structure
 
-Reference apps: **example-se2026**, **example-brightline**, **example-om1**.
+Reference app: **example-empty** (this monorepo). Customer implementations: see `docs/RELATED_PROJECTS.md`.
 
 ## File Responsibilities
 

package/skills/se-marketing-sites-smoke-test-setup/SKILL.md

@@ -52,6 +52,8 @@ Example `package.json` entries:
 }
 ```
 
+**Lockfile CI** — before deployment smoke, ensure `.github/workflows/validate.yml` runs `pnpm install --frozen-lockfile` on the integration branch (`develop` / `dev`) and PRs, plus a parallel `lockfile-hoisted` job when cms-edit uses `node-linker=hoisted`. Copy scripts and workflow snippet from [`references/lockfile-sync/`](../../references/lockfile-sync/README.md). Marketing `vercel.json` install commands must use `--frozen-lockfile`.
+
 **Vercel Deployment Check (live URL)** — GitHub Action on `vercel.deployment.ready` tests `client_payload.url` before production domains alias. Workflow must live on the repo **default branch**. Register the status `name` in Vercel → Settings → Build and Deployment → Deployment Checks.
 
 Filter on `client_payload.environment == 'production'` when Deployment Checks target production only. Vercel also dispatches for preview and custom environments (`preview`, `develop`, etc.); skip those to avoid duplicate CI runs. Use `workflow_dispatch` without an environment filter for manual smoke against any URL.

package/skills/site-workflows-deps-update/SKILL.md

@@ -37,6 +37,8 @@ pnpm install --frozen-lockfile --config.node-linker=hoisted
 
 Run that locally **before push** whenever `package.json`, lockfile, or overrides change. A mismatch surfaces as `ERR_PNPM_OUTDATED_LOCKFILE` (manifest vs lockfile specifiers).
 
+**Lockfile enforcement stack** — copy `scripts/check-lockfile-sync.sh` and `scripts/pre-commit-lockfile.sh` from se-core-product; wire pre-commit before lint-staged; add CI jobs from [`references/lockfile-sync/`](../../references/lockfile-sync/README.md). Marketing Vercel projects: `installCommand` must include `--frozen-lockfile`. Integration branch (`develop` / `dev`) must be in CI `push.branches`, not only `main`.
+
 ---
 
 ## Projects
@@ -234,6 +236,17 @@ After a successful update, you may add the patches check to the root `validate`
 
 This is optional follow-up — the skill workflow always runs the check regardless.
 
+## Optional: lockfile enforcement rollout
+
+When updating deps in a customer repo, adopt the full lockfile stack if missing:
+
+1. Copy `scripts/check-lockfile-sync.sh` and `scripts/pre-commit-lockfile.sh` from se-core-product.
+2. Add `bash scripts/pre-commit-lockfile.sh` to `.husky/pre-commit` (before lint-staged).
+3. Extend `.github/workflows/validate.yml`: integration branch in `push.branches`, parallel `lockfile-hoisted` job when cms-edit uses hoisted linker.
+4. Set marketing `vercel.json` `installCommand` to `cd ../.. && pnpm install --frozen-lockfile`.
+
+See [`references/lockfile-sync/README.md`](../../references/lockfile-sync/README.md) for the rollout table and workflow snippet.
+
 ---
 
 ## Troubleshooting