@se-studio/skills 1.6.9 → 1.7.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @se-studio/skills
 
+## 1.7.0
+
+### Minor Changes
+
+- 8e94be2: Support Next.js 16.3 while remaining compatible with Next.js 15.5 (peer `>=15.5.0 <17`). CMS webhooks call `revalidateTag(tag, { expire: 0 })` so published content is not served stale. Template apps use `proxy.ts` on Next 16. Not-found metadata uses `title.absolute` so layout `title.template` does not produce duplicated site names.
+
+## 1.6.10
+
+### Patch Changes
+
+- 41cfadb: Allow agents to merge customer production only for cms-edit-only diffs (host package / editor-pack), one site at a time with a live health check.
+
 ## 1.6.9
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.6.9",
+  "version": "1.7.0",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/references/agent-session/cms-edit-prod-merge.md

@@ -0,0 +1,35 @@
+# cms-edit-only production merge
+
+The **only** agent exception to “no production git”. Marketing site source, core `main`, and Vercel CLI deploys stay human-only.
+
+## When it applies
+
+All of the following must be true:
+
+1. The user asked to ship **hosted cms-edit** (host package bump, editor-pack-only, or continue a cms-edit host rollout).
+2. Any required `@se-studio/contentful-cms` version is **already on npm**.
+3. The merge is **customer** `develop` → that site’s production branch (`main`, HSD **`production`**). Never `se-core-product` `main`.
+4. `git diff --name-only origin/<productionBranch>...origin/develop` is **only**:
+   - `cms-edit/**`
+   - root `package.json` and/or `pnpm-lock.yaml` (and `pnpm-workspace.yaml` only if it already listed the package)
+5. Those package/lock changes are **only** `@se-studio/contentful-cms` (plus lockfile transitives). No `src/`, `apps/` marketing, smoke, server-config, or other dependency bumps.
+6. Merge **one customer repo at a time**. Wait for that repo’s cms-edit Vercel **production** deployment **Ready**. Then check live `https://<host>/api/health`: `ok`, `cmsEdit.version` matches npm, `redis` and `oauth` checks ok. Probe `/.well-known/oauth-authorization-server` (200). **Stop at the first failure.**
+
+## How to merge
+
+From the **develop** checkout (not `productionPath`):
+
+```bash
+git fetch origin
+git diff --name-only origin/<productionBranch>...origin/develop   # must pass the path gate
+gh pr create --base <productionBranch> --head develop --title "cms-edit: <version or editor-pack>"
+# or ff-only merge via gh
+```
+
+Do **not** use HSD `production-hsd-website` (or any `productionPath`) as the working tree. Do **not** run `pnpm cms-edit:deploy`, `vercel deploy`, or `./scripts/deploy-cms-edit-host.sh`.
+
+## After a successful host
+
+Reconnect Grok `/mcps` → `i` is an editor step if OAuth tokens were dead — not a substitute for the health check.
+
+If the diff is not cms-edit-only, **stop and hand off** — no production merge.

package/references/agent-session/customer-agents-block.md

@@ -6,9 +6,8 @@ Default mode for this repo: **site-first**.
 
 ### Branch policy
 
-- Agents may commit and push **`develop`** and **`feature/*`** only.
-- **Never** push to `main`, `master`, `production`, or any production branch — **human-only** for all customer sites.
-- Do **not** ship from a production checkout (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`). Use the develop checkout only.
+- Agents may commit and push **`develop`** and **`feature/*`**. Customer production (`main`, HSD `production`) only when the **cms-edit-only** gate passes (`se-core-product` `packages/skills/references/agent-session/cms-edit-prod-merge.md`).
+- **Never** merge marketing `src/` to production. **Never** ship from a production checkout (e.g. HSD `production-hsd-website`). Use the develop checkout only.
 - Prefer **draft PRs** to `develop` over direct pushes when `gh` is available.
 
 ### Core vs customer placement
@@ -56,4 +55,4 @@ Never hand-edit `package.json` dependency versions.
 
 ### Production handoff
 
-When ready for production, agents **stop** and deliver a handoff note — they do not merge to `main` / `production` or promote Vercel/Netlify. Production promotion is always **human-only**. See skill Step 8.
+When **marketing** work is ready, agents **stop** and hand off. **cms-edit-only** host rollouts may merge `develop` → production one site at a time (health-check, stop at first failure). No `vercel deploy`. See skill Step 7–8 and `cms-edit-prod-merge.md`.

package/references/deps-update/projects.registry.json

@@ -1,7 +1,7 @@
 {
   "canonicalPatchesScript": "~/source/se/se-core-product/scripts/check-no-pnpm-patches.mjs",
   "pinOverrides": {
-    "next": "^15.5.21",
+    "next": "^16.3.1",
     "@types/node": "^24.13.3"
   },
   "pnpm": {

package/skills/se-marketing-sites-create-page/SKILL.md

@@ -121,7 +121,7 @@ If a route needs a different layout (e.g. no header/footer), create `layout.tsx`
 
 ## A/B Test Variant Route (`page-test`)
 
-When A/B testing is enabled, variant pages are served through a `/page-test/[...slugs]` route that the middleware rewrites to. This route **must** use:
+When A/B testing is enabled, variant pages are served through a `/page-test/[...slugs]` route that the proxy (Next 16) or middleware (Next 15) rewrites to. This route **must** use:
 
 - **`generatePageTestMetadata`** (not `generatePageMetadata`) so that `robots`/`indexed` comes from the **canonical/control** page — variant entries are intentionally `indexed: false` in Contentful.
 - **`generatePageTest`** (not `generatePage`) so breadcrumbs, `model.href`, and JSON-LD use the **control/canonical** path while variant **content** still renders.

package/skills/se-marketing-sites-redirects/SKILL.md

@@ -11,7 +11,7 @@ This skill adds the ability for **non-technical content editors** to manage redi
 - Editors create `redirect` entries (they can **pick** existing Pages/Articles/etc. via the single From/To internal pickers or type raw paths).
 - On publish, a Contentful webhook calls your Vercel **Deploy Hook**.
 - The next build fetches the current redirects (via the normal CDA helpers), runs `buildRedirectMap`, and writes a tiny static file.
-- Your `middleware.ts` imports that file and does the redirect **synchronously with zero runtime cost**.
+- Your `proxy.ts` (Next 16) or `middleware.ts` (Next 15) imports that file and does the redirect **synchronously with zero runtime cost**.
 - Propagation time = normal Vercel build (usually 1–3 minutes). Robust, no extra tokens or Edge Config required.
 
 A faster "seconds" path (Edge Config) is explicitly **not** included in v1 per product direction — the model and helpers are forward-compatible if you add it later.
@@ -133,19 +133,19 @@ Wire it into the build:
 
 (You can also call it from a `next.config.ts` `webpack` hook or a turbo pipeline step — whatever is consistent with how you generate the A/B static data.)
 
-### 4.2 Static middleware (zero runtime work)
+### 4.2 Static proxy (zero runtime work)
 
-Create `middleware.ts` at the root of your Next app (alongside `next.config.ts`):
+On Next 16 create `src/proxy.ts` (Next 15: `src/middleware.ts` + `export function middleware`). Canonical template: `apps/example-empty/src/proxy.ts`.
 
 ```ts
 import { NextResponse, type NextRequest } from 'next/server';
-import { redirects } from './src/generated/redirects'; // the file we just generated
+import { redirects } from '@/generated/redirects';
 
 // If you also use A/B testing static middleware, import and compose here.
 import { createStaticAbTestMiddleware } from '@se-studio/ab-testing/middleware';
-// import { testsByPath } from './src/generated/abTests';
+// import { testsByPath } from '@/generated/abTests';
 
-export async function middleware(request: NextRequest) {
+export async function proxy(request: NextRequest) {
   const { pathname } = request.nextUrl;
 
   // 1. Redirects first (cheap object lookup)
@@ -177,7 +177,7 @@ export const config = {
 };
 ```
 
-If you already have a `middleware.ts` for A/B or other things, just add the redirect check at the very top (before any other logic).
+If you already have a `proxy.ts` (or Next 15 `middleware.ts`) for A/B or other things, just add the redirect check at the very top (before any other logic).
 
 ### 4.2.1 Redirects and sitemaps
 

package/skills/se-marketing-sites-smoke-test-setup/SKILL.md

@@ -370,7 +370,7 @@ Restricts request-time Next.js APIs in:
 
 Banned: `next/headers` (headers, cookies, draftMode), `connection` from `next/server`, `unstable_noStore` from `next/cache`. `unstable_cache` and other `next/cache` exports remain allowed.
 
-Dynamic by design (no restriction): `(cms-dev)`, `preview`, `api`, `middleware.ts`.
+Dynamic by design (no restriction): `(cms-dev)`, `preview`, `api`, `proxy.ts` (Next 16) / `middleware.ts` (Next 15).
 
 Lint is necessary but not sufficient — route policy + production smoke still required.
 

package/skills/site-workflows-agent-session/SKILL.md

@@ -5,7 +5,7 @@ description: "Start and manage agent work sessions across se-core-product and cu
 
 # Agent session workflow
 
-Orchestrates **where** to work, **where code belongs**, and **how to isolate parallel features**. **Humans only** merge/promote to `main` / production (all customer sites + core) — agents stop at handoff.
+Orchestrates **where** to work, **where code belongs**, and **how to isolate parallel features**. **Humans only** merge marketing production and core `main` — except **cms-edit-only** customer merges (reference `cms-edit-prod-merge.md`).
 
 **Registry:** [`packages/skills/references/agent-session/projects.registry.json`](../../references/agent-session/projects.registry.json) — repo paths, `worktreesRoot`, `productionPath` / `productionBranch`, integration branches, hosted MCP keys.
 
@@ -57,12 +57,12 @@ feature/<scope>/<short-slug>
 
 Integration branches (agents push feature branches here via PR or merge — **never production**):
 
-| Repo type | Integration branch | Production (human-only) |
-|-----------|-------------------|-------------------------|
-| `se-core-product` | `dev` | `main` |
-| Customer sites | `develop` (or registry override) | Usually `main`; HSD uses branch **`production`** and checkout `productionPath` |
+| Repo type | Integration branch | Production |
+|-----------|-------------------|------------|
+| `se-core-product` | `dev` | `main` — **never** agent |
+| Customer sites | `develop` (or registry override) | Usually `main`; HSD **`production`**. Marketing: human-only. **cms-edit-only:** agents may merge — see below |
 
-**Never** push, merge, or promote registry `productionBranch` / work in `productionPath`. Agent work uses `path` (develop checkout) only.
+**Never** work in `productionPath`. Agent work uses `path` (develop checkout) only.
 
 ---
 
@@ -253,8 +253,9 @@ Agents may push to:
 
 - `dev` / `develop` (via feature branch merge or direct if user prefers)
 - `feature/*` branches
+- Customer production (`main`, HSD `production`) **only** when the [cms-edit-only gate](../../references/agent-session/cms-edit-prod-merge.md) passes
 
-Agents must **never** push to `main`, `master`, `production`, or any registry `productionBranch`. Agents must **never** ship from a registry `productionPath` (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`).
+Agents must **never** push **se-core-product** `main`, or customer production when the diff is not cms-edit-only. Agents must **never** ship from a registry `productionPath` (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`).
 
 **Preferred:** open a **draft PR** targeting the integration branch:
 
@@ -268,7 +269,7 @@ If `gh` is unavailable or user prefers direct push, push `feature/*` and note in
 
 ## Step 8 — Handoff (production-ready)
 
-When work is ready for human review / production promotion, **stop** — do not merge to `main`, `production`, or any production branch. **Production promotion is human-only** for core and every customer site.
+When **marketing** work is ready for production, **stop** — do not merge to `main` / `production`. **Exception:** cms-edit-only (Step 7 + [`cms-edit-prod-merge.md`](../../references/agent-session/cms-edit-prod-merge.md)) — merge one customer repo at a time, wait for cms-edit host Ready, verify `/api/health`, stop at the first failure.
 
 1. Set manifest `status: ready_for_review`
 2. Deliver handoff using template below
@@ -300,9 +301,9 @@ When work is ready for human review / production promotion, **stop** — do not
 2. <customer pnpm update @se-studio/...>
 3. <customer PR>
 
-### Production (human-only)
-Ready for you to merge to production (`main` or site `productionBranch`) / promote Vercel.
-Agent will not push production or use productionPath checkouts.
+### Production
+Marketing: human-only (`main` or site `productionBranch`).
+cms-edit-only: agent may merge per `cms-edit-prod-merge.md` (not `productionPath`, not `vercel deploy`).
 ```
 
 ---
@@ -341,7 +342,7 @@ Agent must load this skill, write manifest (with `worktree` path), run placement
 
 ## Quick reference — project keys
 
-| key | Integration | Production (human-only) | Type |
+| key | Integration | Production | Type |
 |-----|-------------|-------------------------|------|
 | `se-core-product` | `dev` | `main` | core monorepo |
 | `se2026` | `develop` | `main` | customer |

package/skills/site-workflows-deps-update/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: site-workflows-deps-update
-description: "Update npm dependencies to latest across se-core-product and consumer SE Studio sites, one repo at a time. Pins Next.js 15 and Node 24, updates pnpm to latest 11.x, enforces no pnpm patches everywhere. Validates, commits, and pushes to dev/develop. Use when asked to update outdated packages or bump dependencies."
+description: "Update npm dependencies to latest across se-core-product and consumer SE Studio sites, one repo at a time. Pins Next.js 16.3 and Node 24, updates pnpm to latest 11.x, enforces no pnpm patches everywhere. Validates, commits, and pushes to dev/develop. PointMe stays on Next 15.5 until its dedicated upgrade. Use when asked to update outdated packages or bump dependencies."
 ---
 
 # SE dependency update (one project at a time)
@@ -11,7 +11,7 @@ Update npm dependencies to **latest** in se-core-product and consumer repos that
 
 **Default:** Process **one repo per invocation**. At the end, summarize changes and offer the next project.
 
-**Never:** push to `main`/`master`/`production` or any production branch; promote from production checkouts (e.g. HSD `production-hsd-website`); bump Next to 16; bump Node to 25+; use `pnpm patch` / `patchedDependencies` / `patches/`; bypass or remove `minimumReleaseAge`; **hand-edit `package.json` dependency versions** (use `pnpm update` instead). Production promotion is **human-only** for all customer sites.
+**Never:** push to `main`/`master`/`production` or any production branch; promote from production checkouts (e.g. HSD `production-hsd-website`); bump Next to 17; bump Node to 25+; use `pnpm patch` / `patchedDependencies` / `patches/`; bypass or remove `minimumReleaseAge`; **hand-edit `package.json` dependency versions** (use `pnpm update` instead). Production promotion is **human-only** for all customer sites. **PointMe:** keep `overrides.next` on `^15.5.x` until the Next 16 site wave — do not pull it to 16 during a routine deps update.
 
 ---
 
@@ -101,15 +101,16 @@ minimumReleaseAgeExclude:
   - '@se-studio/*'
 
 overrides:
-  next: ^15.5.19
+  next: ^16.3.1
   '@types/node': ^24.13.2
 ```
 
 - **`minimumReleaseAge: 1440`** — do not install packages published in the last 24 hours (supply-chain guard).
 - **`@se-studio/*` exclude** — our own packages may update immediately after npm publish.
 - **Keep repo-specific additional excludes** when present (e.g. vitest pins in se-core-product, `@emnapi/runtime` in se-website-2026, PointMe `mapbox-gl` / `react-day-picker` overrides).
+- **PointMe exception:** leave `next: ^15.5.x` until that site’s Next 16 wave.
 
-`pnpm update -r --latest` would bump `next` → 16 and `@types/node` → 26 without the overrides block. The overrides prevent that.
+`pnpm update -r --latest` would bump `next` past the supported 16.3 line and `@types/node` → 26 without the overrides block. The overrides prevent that.
 
 **Never bypass `minimumReleaseAge`** during dependency updates. Do not remove the block, comment it out, or use undocumented pnpm flags. If a non-`@se-studio` package was published within 24 hours, it stays at the current version until it ages out — note that in the report and re-run later if needed.
 
@@ -162,7 +163,7 @@ pnpm update -r \
 Safety re-pin after update:
 
 ```bash
-pnpm update -r next@^15 @types/node@^24
+pnpm update -r next@^16.3.1 @types/node@^24
 pnpm install
 ```
 
@@ -217,7 +218,7 @@ Include in the summary:
 
 - Major dependency bumps (from the Step 1 audit diff)
 - pnpm version: before → after
-- Confirmed pins: Next 15.x, Node 24, `@types/node` ^24
+- Confirmed pins: Next 16.3.x (PointMe: Next 15.5.x until its upgrade), Node 24, `@types/node` ^24
 - Confirmed `minimumReleaseAge: 1440` and `@se-studio/*` exclude present
 - Packages still outdated because they are inside the 24-hour release window (if any)
 - Patches check bootstrapped (yes/no)

package/skills/site-workflows-new-project/SKILL.md

@@ -76,14 +76,24 @@ Write `AGENTS.md` at the project root. Fill in the user's email address (from me
 Include the **agent session workflow block** from [`packages/skills/references/agent-session/customer-agents-block.md`](../../references/agent-session/customer-agents-block.md) (branch policy, placement, parallel features, handoff).
 
 ```markdown
-# Next.js: ALWAYS read docs before coding
+<!-- BEGIN:nextjs-agent-rules -->
 
-Before any Next.js work, find and read the relevant doc in `node_modules/next/dist/docs/`. Your training data is outdated — the docs are the source of truth.
+# This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->
+
+<!-- BEGIN:se-studio-package-rules -->
 
 # @se-studio packages: ALWAYS read docs before coding
 
 Before using any `@se-studio/*` package, read the relevant `node_modules/@se-studio/<package>/docs/llms.md`.
 
+<!-- END:se-studio-package-rules -->
+
 # userEmail
 The user's email address is [USER_EMAIL].
 
@@ -116,7 +126,7 @@ One feature = one `feature/<scope>/<slug>` branch. **Git worktree required** for
 
 ### Production handoff
 
-Agents stop at handoff — they do not merge to `main` / production or promote production deploys. Human-only. See skill `site-workflows-agent-session` Step 8.
+Agents stop at handoff for **marketing** production. cms-edit-only host merges: see `site-workflows-agent-session` and `cms-edit-prod-merge.md`.
 
 ## CMS editing (cms-edit)
 

package/skills/site-workflows-stale-files-cleanup/SKILL.md

@@ -19,7 +19,7 @@ Remove **dead weight** from an SE Studio site repo without changing product beha
 
 **Default:** Plan mode first — present a classified audit table before deleting anything.
 
-**Never:** push to `main`/`master`/`production` or promote production (human-only for all customer sites); delete `docs/cms-editor/` or committed `cms-edit/*/editor-pack/` without explicit user request; fix Dependabot alerts unless the user asks.
+**Never:** push marketing production or use production checkouts (cms-edit-only gate is in `cms-edit-prod-merge.md`); delete `docs/cms-editor/` or committed `cms-edit/*/editor-pack/` without explicit user request; fix Dependabot alerts unless the user asks.
 
 ---
 
@@ -153,7 +153,7 @@ pnpm validate   # or repo-specific validate from AGENTS.md
 
 Commit on integration branch only. Suggested message: `chore: remove stale scripts, docs, and tooling`.
 
-Hand off production promotion to the human — never push `main` / `production` or use production checkouts to ship.
+Hand off **marketing** production. Do not use production checkouts. cms-edit-only: `cms-edit-prod-merge.md`.
 
 ---