@se-studio/skills 1.7.2 → 1.7.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @se-studio/skills
 
+## 1.7.4
+
+### Patch Changes
+
+- All marketing sites are on Next 16.3: drop the PointMe 15.5 deps exception, require `supportedArchitectures` in new-project bootstrap, and point agents at version-matched `nextjs-agent-rules` instead of the Next 15 `agents-md` docs dump.
+
+## 1.7.3
+
+### Patch Changes
+
+- Document `supportedArchitectures` so macOS lockfiles include linux-x64/glibc optional natives for hoisted frozen cms-edit installs.
+
 ## 1.7.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.7.2",
+  "version": "1.7.4",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/references/agent-session/customer-agents-block.md

@@ -1,3 +1,7 @@
+## Next.js docs (version-matched)
+
+This site runs **Next.js 16.3**. Before writing Next.js code, read the relevant guide in `node_modules/next/dist/docs/` (in monorepos, resolve from the app that depends on `next`). Keep the managed `<!-- BEGIN:nextjs-agent-rules -->` block in `AGENTS.md`. Do **not** use `npx @next/codemod agents-md`, `.next-docs`, or `NEXT-AGENTS-MD-START` (Next 15 index: Pages Router, `middleware.ts`). Ignore `vercel-react-native-skills` if the vercel-labs pack installed it.
+
 ## Agent session workflow
 
 **Load skill `site-workflows-agent-session` at the start of every coding session.**

package/references/lockfile-sync/README.md

@@ -30,6 +30,17 @@ See [`validate-workflow-snippet.yml`](validate-workflow-snippet.yml). Customer m
 | Marketing app (monorepo root install) | `cd ../.. && pnpm install --frozen-lockfile` |
 | cms-edit host | `cd ../.. && pnpm install --frozen-lockfile --config.node-linker=hoisted` |
 
+## Linux optional natives (`supportedArchitectures`)
+
+cms-edit Vercel and `check-lockfile-sync.sh` (full) run `pnpm install --frozen-lockfile --config.node-linker=hoisted`. That path requires lockfile snapshots for **linux-x64/glibc** optional binaries even when you generate the lockfile on macOS.
+
+Every consumer `pnpm-workspace.yaml` must include `supportedArchitectures` (current + linux, current + x64, current + glibc). Canonical copy: skill `site-workflows-deps-update` Step 3. After adding it, run `pnpm install` (not frozen) so the lockfile gains those snapshots, then verify:
+
+```bash
+pnpm install --frozen-lockfile --config.node-linker=hoisted
+pnpm install   # restore isolated linker for local workspace packages
+```
+
 ## After dependency changes
 
 ```bash
@@ -43,13 +54,13 @@ Use `pnpm install --no-frozen-lockfile` only when intentionally repairing the lo
 
 Apply the full stack when touching deps or CI in each repo:
 
-| Repo | Pre-commit | CI develop/dev | CI hoisted | Vercel frozen (marketing) |
-|------|------------|----------------|------------|---------------------------|
-| brightline-sites | yes | yes | yes | yes |
-| pedestal-sites | — | partial | — | no |
-| om1-website | — | — | — | — |
-| se-website-2026 | yes | yes | yes | yes |
-| pointme | — | — | — | — |
-| hsd (`develop-hsd-website`; prod human-only: `production-hsd-website`) | yes | yes (develop) | n/a | yes |
+| Repo | Pre-commit | CI integration branch | CI hoisted | Vercel frozen (marketing) | Vercel cms-edit hoisted |
+|------|------------|----------------------|------------|---------------------------|-------------------------|
+| brightline-sites | yes | develop | yes | yes | yes |
+| pedestal-sites | yes | develop | yes | yes | yes |
+| om1-website | yes | develop | yes | yes | yes |
+| se-website-2026 | yes | develop | yes | yes | yes |
+| pointme | yes | develop | yes | yes | yes |
+| hsd (`develop-hsd-website`; prod human-only: `production-hsd-website`) | yes | develop (+ `extended-port`) | yes | yes | yes |
 
-Update this table as repos adopt the pattern.
+Update this table as repos adopt the pattern. Every cms-edit host `pnpm-workspace.yaml` must include `supportedArchitectures` (current + linux, x64, glibc).

package/skills/site-workflows-deps-update/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: site-workflows-deps-update
-description: "Update npm dependencies to latest across se-core-product and consumer SE Studio sites, one repo at a time. Pins Next.js 16.3 and Node 24, updates pnpm to latest 11.x, enforces no pnpm patches everywhere. Validates, commits, and pushes to dev/develop. PointMe stays on Next 15.5 until its dedicated upgrade. Use when asked to update outdated packages or bump dependencies."
+description: "Update npm dependencies to latest across se-core-product and consumer SE Studio sites, one repo at a time. Pins Next.js 16.3 and Node 24, updates pnpm to latest 11.x, enforces no pnpm patches everywhere. Validates, commits, and pushes to dev/develop. Use when asked to update outdated packages or bump dependencies."
 ---
 
 # SE dependency update (one project at a time)
@@ -11,7 +11,7 @@ Update npm dependencies to **latest** in se-core-product and consumer repos that
 
 **Default:** Process **one repo per invocation**. At the end, summarize changes and offer the next project.
 
-**Never:** push to `main`/`master`/`production` or any production branch; promote from production checkouts (e.g. HSD `production-hsd-website`); bump Next to 17; bump Node to 25+; use `pnpm patch` / `patchedDependencies` / `patches/`; bypass or remove `minimumReleaseAge`; **hand-edit `package.json` dependency versions** (use `pnpm update` instead). Production promotion is **human-only** for all customer sites. **PointMe:** keep `overrides.next` on `^15.5.x` until the Next 16 site wave — do not pull it to 16 during a routine deps update.
+**Never:** push to `main`/`master`/`production` or any production branch; promote from production checkouts (e.g. HSD `production-hsd-website`); bump Next to 17; bump Node to 25+; use `pnpm patch` / `patchedDependencies` / `patches/`; bypass or remove `minimumReleaseAge`; **hand-edit `package.json` dependency versions** (use `pnpm update` instead). Production promotion is **human-only** for all customer sites. All marketing sites pin `overrides.next` to `^16.3.x`.
 
 ---
 
@@ -105,15 +105,42 @@ overrides:
   '@types/node': ^24.13.2
 ```
 
+Every repo that runs **hoisted frozen install** (cms-edit host on Vercel, `check-lockfile-sync.sh` hoisted job) **must** also record Linux optional natives in the lockfile. Generate the lockfile on macOS with:
+
+```yaml
+# Record linux-x64/glibc optional natives (cms-edit Vercel + hoisted frozen install).
+supportedArchitectures:
+  os:
+    - current
+    - linux
+  cpu:
+    - current
+    - x64
+  libc:
+    - current
+    - glibc
+```
+
+Without this, isolated `pnpm install` on darwin can omit snapshots such as `@rollup/rollup-linux-x64-gnu`. Hoisted `--frozen-lockfile` then fails even though default-linker install succeeded. Vitest/Rollup sites (Brightline) hit this first; Sharp and other optional natives fail the same way on Vercel linux.
+
 - **`minimumReleaseAge: 1440`** — do not install packages published in the last 24 hours (supply-chain guard).
 - **`@se-studio/*` exclude** — our own packages may update immediately after npm publish.
 - **Keep repo-specific additional excludes** when present (e.g. vitest pins in se-core-product, `@emnapi/runtime` in se-website-2026, PointMe `mapbox-gl` / `react-day-picker` overrides).
-- **PointMe exception:** leave `next: ^15.5.x` until that site’s Next 16 wave.
+- **PointMe:** keep extra overrides (`mapbox-gl`, `react-day-picker`, `caniuse-lite`) — still pin `next: ^16.3.x` like every other site.
 
 `pnpm update -r --latest` would bump `next` past the supported 16.3 line and `@types/node` → 26 without the overrides block. The overrides prevent that.
 
 **Never bypass `minimumReleaseAge`** during dependency updates. Do not remove the block, comment it out, or use undocumented pnpm flags. If a non-`@se-studio` package was published within 24 hours, it stays at the current version until it ages out — note that in the report and re-run later if needed.
 
+### Next.js 16 agent docs (do not use the Next 15 dump)
+
+Marketing sites run **Next.js 16.3**. Version-matched docs live in each app’s `node_modules/next/dist/docs/` (the `next` package may not be visible from a monorepo root).
+
+- **Keep** the managed `<!-- BEGIN:nextjs-agent-rules -->` block that `next dev` writes in `AGENTS.md`.
+- **Do not** run `npx @next/codemod agents-md` or restore `NEXT-AGENTS-MD-START` / `.next-docs` — that index is Next 15 (Pages Router, `middleware.ts`, upgrade guides only through v15).
+- Cursor’s Vercel plugin **`nextjs`** skill is fine for App Router patterns; it is not a substitute for `node_modules/next/dist/docs/`.
+- After `npx skills add vercel-labs/agent-skills`, **delete `vercel-react-native-skills`** — these are web sites. Do not treat React Native skills as Next guidance.
+
 ---
 
 ## Step 4 — Update pnpm (all repos)
@@ -218,7 +245,7 @@ Include in the summary:
 
 - Major dependency bumps (from the Step 1 audit diff)
 - pnpm version: before → after
-- Confirmed pins: Next 16.3.x (PointMe: Next 15.5.x until its upgrade), Node 24, `@types/node` ^24
+- Confirmed pins: Next 16.3.x, Node 24, `@types/node` ^24
 - Confirmed `minimumReleaseAge: 1440` and `@se-studio/*` exclude present
 - Packages still outdated because they are inside the 24-hour release window (if any)
 - Patches check bootstrapped (yes/no)
@@ -256,6 +283,7 @@ See [`references/lockfile-sync/README.md`](../../references/lockfile-sync/README
 | Issue | Action |
 |-------|--------|
 | `ERR_PNPM_OUTDATED_LOCKFILE` on frozen/hoisted install | `package.json` and `pnpm-workspace.yaml` overrides out of sync with lockfile — re-run `pnpm update` for the package and align `overrides` |
+| `ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY` (`rollup-linux-*`, Sharp, etc.) on hoisted frozen install | Missing `supportedArchitectures` (current + linux, x64, glibc) — add the Step 3 block, run `pnpm install`, then re-verify hoisted |
 | `next` or `@types/node` still outdated to wrong major | Re-run overrides + safety re-pin; check `pnpm-workspace.yaml` overrides |
 | Non-`@se-studio` package still outdated after update | Likely within 24h of npm publish — wait and re-run; **do not** bypass `minimumReleaseAge` |
 | `corepack use` fails | Run `corepack enable` once, retry |

package/skills/site-workflows-new-project/SKILL.md

@@ -40,6 +40,36 @@ After cleanup, `pnpm validate` must pass before continuing.
 
 ---
 
+## Step 2b — Workspace install policy (`pnpm-workspace.yaml`)
+
+Merge these into the existing file (do not wipe `packages`, `allowBuilds`, or other keys). Canonical copy: skill `site-workflows-deps-update` Step 3.
+
+```yaml
+# Record linux-x64/glibc optional natives (cms-edit Vercel + hoisted frozen install).
+supportedArchitectures:
+  os:
+    - current
+    - linux
+  cpu:
+    - current
+    - x64
+  libc:
+    - current
+    - glibc
+
+minimumReleaseAge: 1440
+minimumReleaseAgeExclude:
+  - '@se-studio/*'
+
+overrides:
+  next: ^16.3.1
+  '@types/node': ^24.13.2
+```
+
+Then `pnpm install` (not frozen) so the lockfile records linux optional snapshots. Confirm `AGENTS.md` uses `nextjs-agent-rules` (Next 16 `node_modules/next/dist/docs/`), not `NEXT-AGENTS-MD-START` / `.next-docs`.
+
+---
+
 ## Step 3 — Update project identity in `src/lib/constants.ts`
 
 Read `src/lib/constants.ts` and update:
@@ -84,6 +114,8 @@ This version has breaking changes — APIs, conventions, and file structure may
 
 This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
 
+Do **not** replace this with `npx @next/codemod agents-md` (Next 15 `.next-docs` index).
+
 <!-- END:nextjs-agent-rules -->
 
 <!-- BEGIN:se-studio-package-rules -->