bsmnt 0.14.0 → 0.15.0

package/src/agent-skills/launch-ready/references/launch.md

@@ -0,0 +1,44 @@
+# On the real domain
+
+These only fail in production, so check them against the deployed URL.
+
+## LAUNCH-01 · Forms deliver on production
+
+**Must not ship** · only if the site has forms
+
+Submit each form on production and confirm the submission arrives. The usual
+failure: the form's API key is set for Preview but not for Production, so the
+form works on every preview and silently drops submissions after launch.
+
+## LAUNCH-02 · CMS publishing updates production
+
+**Must not ship** · only if the site uses a CMS
+
+Publish a small change in the CMS and confirm production shows it. The
+revalidation webhook points at the production URL and carries its secret.
+
+## LAUNCH-03 · One host
+
+**Fix before launch**
+
+Pick the apex domain or `www`. In Vercel's domain settings, the other
+redirects to it permanently.
+
+**Check:**
+
+```bash
+curl -sI https://<other-host>/ | grep -i '^location'
+```
+
+It points at the chosen host.
+
+## LAUNCH-04 · Old URLs redirect on a relaunch
+
+**Fix before launch** · only if *Replaces an existing site: yes*
+
+Every old URL with traffic or backlinks redirects to its new equivalent
+through `redirects()` in `next.config.ts`. Ask the user for the old site's URL
+list: its sitemap, or its top pages in analytics.
+
+**Check:** request a sample of old URLs. Each returns `308` to a page that
+returns `200`.

package/src/agent-skills/launch-ready/references/metadata.md

@@ -0,0 +1,83 @@
+# Metadata
+
+## META-01 · Every page has a real title
+
+**Must not ship**
+
+Each route exports `metadata` or `generateMetadata` with its own title. If
+`app/layout.tsx` still has the `"Basement Starter"` default and its
+`"%s - Basement Starter"` template, replace both with the site's name.
+
+**Check:**
+
+```bash
+curl -s localhost:3000/<route> | grep -o '<title>[^<]*'
+```
+
+## META-02 · Metadata is in the server HTML
+
+**Must not ship**
+
+Set titles, descriptions and share tags through the Metadata API, never with
+`document.title` or a client effect. Crawlers and link previews don't run
+JavaScript.
+
+**Check:** the tags appear in `curl -s localhost:3000/<route>`, not only in
+the browser's DOM.
+
+## META-03 · The share image loads
+
+**Must not ship**
+
+A declared `og:image` is absolute and returns an image.
+
+If the layout or `generatePageMetadata` defaults to `/opengraph-image.jpg`,
+add that file: no template ships it. Until `public/opengraph-image.jpg`
+exists, every share card is broken, and so is the Organization JSON-LD logo,
+which uses the same path.
+
+**Check:**
+
+```bash
+img=$(curl -s localhost:3000/ | grep -o 'property="og:image" content="[^"]*' | cut -d'"' -f4)
+curl -so /dev/null -w '%{http_code} %{content_type}\n' "$img"
+```
+
+Expect `200 image/...`.
+
+## META-04 · No `localhost` URLs in production
+
+**Must not ship**
+
+`metadataBase`, canonicals and share URLs read `NEXT_PUBLIC_BASE_URL`, then
+the Vercel deployment URL, and fall back to `http://localhost:3000` off Vercel.
+Set it for the Production environment.
+
+**Check:**
+
+```bash
+curl -s https://<production>/ | grep -c 'localhost:3000'
+```
+
+Expect `0`.
+
+## META-05 · Titles are unique
+
+**Fix before launch**
+
+Distinct pages have distinct titles. Variants that canonicalize to one page
+are exempt.
+
+## META-06 · Public pages have a description
+
+**Fix before launch**
+
+Slack, LinkedIn and iMessage show the description as the preview text. If the
+layout's default reads `package.json`'s `description`, write a real one there.
+
+## META-07 · `<html lang>` matches the content
+
+**Fix before launch**
+
+The starter sets `lang="en"`. Change it when the site isn't English, and set
+it per locale on a multilingual site.

package/src/agent-skills/launch-ready/references/performance.md

@@ -0,0 +1,36 @@
+# Performance
+
+## PERF-01 · The LCP image isn't lazy
+
+**Fix before launch**
+
+The largest image in the first screen (usually the hero) passes `priority` to
+`@/components/ui/image`. Everything below the fold stays lazy, which is the
+default.
+
+## PERF-02 · Image `sizes` match the layout
+
+**Fix before launch**
+
+`sizes` describes the width the image renders at. Without it, the image
+component falls back to `100vw` and the browser downloads the largest
+variant, which is only right for full-width images. Build `sizes` with
+`buildImageSizes` or `buildGridImageSizes` from `lib/utils/image-sizes.ts`.
+
+The `no-fill-without-sizes` lint rule catches `fill` with no `sizes`. It can't
+tell whether the value is correct.
+
+## PERF-03 · Responses are compressed
+
+**Fix before launch** · only when hosted outside Vercel
+
+Vercel compresses responses by default. Another host has to serve HTML, JS
+and CSS with gzip or brotli.
+
+**Check:**
+
+```bash
+curl -sI -H 'Accept-Encoding: gzip, br' https://<production>/ | grep -i content-encoding
+```
+
+Expect `gzip` or `br`.

package/src/agent-skills/launch-ready/references/routing.md

@@ -0,0 +1,47 @@
+# Routing
+
+## ROUTE-01 · Missing pages return 404
+
+**Must not ship**
+
+When a dynamic or CMS route has no data, call `notFound()` before any
+`<Suspense>`. Once a response starts streaming, its status is already 200.
+Next can't change it then, and injects a `noindex` tag instead.
+
+```tsx
+export default async function Page({ params }: PageProps<"/blog/[slug]">) {
+  const { slug } = await params
+  const post = await getPost(slug)
+  if (!post) notFound()
+  return <Post post={post} />
+}
+```
+
+**Check:**
+
+```bash
+curl -so /dev/null -w '%{http_code}\n' localhost:3000/does-not-exist
+```
+
+Expect `404`. Repeat under each dynamic segment, such as `/blog/does-not-exist`.
+
+**Not this:** redirecting unknown paths to `/`. That's still a missing page
+answering 200.
+
+## ROUTE-02 · No internal link is broken
+
+**Must not ship**
+
+Every internal link resolves to a page that returns 200. A control that only
+runs JavaScript is a `<button>`, not `<a href="#">`. An `#id` that exists on the
+page, or a "back to top" link, is fine.
+
+**Check:** list each route's links and request them.
+
+```bash
+curl -s localhost:3000/ | grep -o 'href="/[^"#]*"' | cut -d'"' -f2 | sort -u |
+  while read -r p; do printf '%s %s\n' "$(curl -so /dev/null -w '%{http_code}' "localhost:3000$p")" "$p"; done
+```
+
+Every line starts with `200`. A broken link in the nav or footer breaks on every
+page, so check those first.

package/src/agent-skills/launch-ready/references/security.md

@@ -0,0 +1,39 @@
+# Security and hygiene
+
+## SEC-01 · `NEXT_PUBLIC_` holds only public keys
+
+**Must not ship**
+
+Anything prefixed `NEXT_PUBLIC_` ships in the browser bundle, readable by
+anyone. Only keys designed to be public belong there: a Sanity project ID, a
+Stripe `pk_` key, an analytics site ID. Read every other secret on the server.
+
+**Check:**
+
+```bash
+grep -rhoE 'NEXT_PUBLIC_[A-Z0-9_]+' app components lib | sort -u
+```
+
+Confirm each name on the list is meant to be public.
+
+## SEC-02 · Tracking matches the consent decision
+
+**Fix before launch** · only if consent is required
+
+No analytics or ad script runs, and no tracking cookie is set, before the
+visitor answers the consent banner. The `ketch-consent-check` skill covers
+gating a script behind Ketch, when the project has it.
+
+**Check (browser):** in a fresh private window, before you answer the banner,
+DevTools → Application → Cookies lists no tracking cookies.
+
+## SEC-03 · No first-party console errors
+
+**Fix before launch**
+
+The console shows no errors from the site's own code on load, and no
+hydration mismatches. A mismatch means the server and the client rendered
+different content. Errors from third-party scripts are out of scope.
+
+**Check (browser):** load each route with DevTools open, then read the
+console.

package/src/modules/features/cms/sanity/files/app/layout.tsx

@@ -9,13 +9,13 @@ import { fontsVariable } from "@/lib/styles/fonts";
 import AppData from "@/package.json";
 import "@/lib/styles/css/index.css";
 import { cn } from "@/lib/styles/cn";
+import { getBaseUrl } from "@/lib/utils/url";
 
 const APP_NAME = AppData.name;
 const APP_DEFAULT_TITLE = "Basement Starter";
 const APP_TITLE_TEMPLATE = "%s - Basement Starter";
 const APP_DESCRIPTION = AppData.description;
-const APP_BASE_URL =
-	process.env.NEXT_PUBLIC_BASE_URL ?? "http://localhost:3000";
+const APP_BASE_URL = getBaseUrl();
 
 const geist = Geist({
 	subsets: ["latin"],

package/src/modules/features/cms/sanity/files/lib/utils/metadata.ts

@@ -1,4 +1,5 @@
 import type { Metadata } from "next";
+import { getBaseUrl } from "@/lib/utils/url";
 
 /**
  * Metadata Generation Utilities
@@ -26,8 +27,7 @@ interface GenerateMetadataOptions {
 	authors?: string[];
 }
 
-const APP_BASE_URL =
-	process.env.NEXT_PUBLIC_BASE_URL ?? "http://localhost:3000";
+const APP_BASE_URL = getBaseUrl();
 
 /**
  * Generate complete metadata object for pages

package/src/modules/features/cms/sanity/files/lib/utils/url.ts

@@ -3,15 +3,18 @@
  *
  * Priority:
  * 1. NEXT_PUBLIC_BASE_URL  - explicit override (custom domains)
- * 2. VERCEL_PROJECT_PRODUCTION_URL - auto-set by Vercel (production domain)
- * 3. VERCEL_URL - auto-set by Vercel (preview/branch deploys)
+ * 2. VERCEL_PROJECT_PRODUCTION_URL - auto-set by Vercel, on production deployments only
+ * 3. VERCEL_URL - the deployment's own URL, so previews never emit production URLs
  * 4. localhost fallback
  */
 export function getBaseUrl(): string {
 	if (process.env.NEXT_PUBLIC_BASE_URL) {
 		return process.env.NEXT_PUBLIC_BASE_URL;
 	}
-	if (process.env.VERCEL_PROJECT_PRODUCTION_URL) {
+	if (
+		process.env.VERCEL_ENV === "production" &&
+		process.env.VERCEL_PROJECT_PRODUCTION_URL
+	) {
 		return `https://${process.env.VERCEL_PROJECT_PRODUCTION_URL}`;
 	}
 	if (process.env.VERCEL_URL) return `https://${process.env.VERCEL_URL}`;

package/src/modules/features/cms/sanity-pagebuilder/files/components/sanity/rich-text.tsx

@@ -80,7 +80,9 @@ export const RichText = ({ content }: RichTextProps) => {
 					externalLink: LinkMark,
 				},
 				block: {
-					h1: ({ children }) => <h1 className="h1">{children}</h1>,
+					// The h1 style is retired: the page owns its H1, so legacy content
+					// drops a level.
+					h1: ({ children }) => <h2 className="h2">{children}</h2>,
 					h2: ({ children }) => <h2 className="h2">{children}</h2>,
 					h3: ({ children }) => <h3 className="h3">{children}</h3>,
 					h4: ({ children }) => <h4 className="h4">{children}</h4>,