bsmnt 0.7.1 → 0.10.0

package/src/templates/next-pagebuilder/app/(content)/[[...slug]]/page.tsx

@@ -14,7 +14,7 @@ import { checkRedirect } from "@/lib/utils/check-redirect"
 import { generateSanityMetadata } from "@/lib/utils/metadata"
 import { getSlugTag } from "@/lib/utils/slug-tag"
 
-const getPageDocument = async (slug: string | null, stega = true) =>
+const getPageDocument = async (slug: string | null, stega?: boolean) =>
   fetchSanity<PAGE_QUERY_RESULT>({
     query: PAGE_QUERY,
     params: { slug },
@@ -22,12 +22,18 @@ const getPageDocument = async (slug: string | null, stega = true) =>
     stega,
   })
 
-const toPath = (segments?: string[]) =>
-  segments?.filter(Boolean).join("/") || null
+const isValidSegment = (segment: string) =>
+  segment.length > 0 && segment !== "." && segment !== ".."
+
+const toPath = (segments?: string[]) => {
+  if (!segments?.length) return null
+  if (!segments.every(isValidSegment)) return null
+  return segments.join("/")
+}
 
 const getResolvedPage = async (
   path: string | null,
-  stega = true
+  stega?: boolean
 ): Promise<NonNullable<PAGE_QUERY_RESULT> | null> => {
   const { data: page } = await getPageDocument(path, stega)
   return (page as NonNullable<PAGE_QUERY_RESULT> | null) ?? null
@@ -35,18 +41,21 @@ const getResolvedPage = async (
 
 type SearchParams = Promise<{ [key: string]: string | string[] | undefined }>
 
+const HOMEPAGE_PARAM: { slug: string[] } = { slug: [] }
+
 export const generateStaticParams = async () => {
-  if (!client) return [{ slug: [] }]
+  if (!client) return [HOMEPAGE_PARAM]
 
   const slugs =
     await client.fetch<ALL_PAGE_SLUGS_QUERY_RESULT>(ALL_PAGE_SLUGS_QUERY)
 
-  if (!slugs?.length) return [{ slug: [] }]
-
-  return (slugs ?? []).flatMap((page) => {
-    if (!page.slug) return []
-    return page.slug === "/" ? { slug: [] } : { slug: page.slug.split("/") }
-  })
+  return [
+    HOMEPAGE_PARAM,
+    ...(slugs ?? []).flatMap((page) => {
+      if (!page.slug || page.slug === "/") return []
+      return { slug: page.slug.split("/") }
+    }),
+  ]
 }
 
 type Props = { params: Promise<{ slug?: string[] }> }
@@ -54,6 +63,9 @@ type Props = { params: Promise<{ slug?: string[] }> }
 export const generateMetadata = async ({ params }: Props) => {
   const { slug } = await params
   const path = toPath(slug)
+
+  if (slug?.length && path === null) return {}
+
   const page = await getResolvedPage(path, false)
 
   return page
@@ -70,6 +82,9 @@ export default async function CatchAllPage({
   const { slug } = await params
 
   const path = toPath(slug)
+
+  if (slug?.length && path === null) notFound()
+
   const page = await getResolvedPage(path)
 
   if (!page) {

package/src/templates/next-pagebuilder/app/actions/unlock-gated-content.ts

@@ -0,0 +1,39 @@
+"use server"
+
+import { fetchSanity } from "@/lib/integrations/sanity/live"
+import { GATED_CONTENT_QUERY } from "@/lib/integrations/sanity/queries"
+import type { GATED_CONTENT_QUERY_RESULT } from "@/lib/integrations/sanity/sanity.types"
+
+export type GatedContentPayload = NonNullable<GATED_CONTENT_QUERY_RESULT>
+
+export type UnlockResult =
+  | { ok: true; payload: GatedContentPayload }
+  | { ok: false; error: string }
+
+type UnlockInput = { documentId: string; email: string }
+
+export async function unlockGatedContent({
+  documentId,
+  email,
+}: UnlockInput): Promise<UnlockResult> {
+  if (!documentId) return { ok: false, error: "Missing content id." }
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+    return { ok: false, error: "Enter a valid email address." }
+  }
+
+  // Lead-capture seam: forward `email` to your CRM / email provider here.
+  // This is not access control — the payload is withheld from the page until
+  // this action runs, but anyone who submits the form receives it.
+
+  const { data } = await fetchSanity<GATED_CONTENT_QUERY_RESULT>({
+    query: GATED_CONTENT_QUERY,
+    params: { id: documentId },
+    // stega must stay off: it injects invisible characters into strings, which
+    // would corrupt the asset URLs returned for download/playback.
+    stega: false,
+  })
+
+  if (!data) return { ok: false, error: "Content not found." }
+
+  return { ok: true, payload: data }
+}

package/src/templates/next-pagebuilder/app/robots.ts

@@ -1,6 +1,5 @@
 import type { MetadataRoute } from "next"
-
-const APP_BASE_URL = process.env.NEXT_PUBLIC_BASE_URL ?? "http://localhost:3000"
+import { getBaseUrl } from "@/lib/utils/base-url"
 
 export default function robots(): MetadataRoute.Robots {
   return {
@@ -9,6 +8,6 @@ export default function robots(): MetadataRoute.Robots {
       allow: "/",
       disallow: [],
     },
-    sitemap: `${APP_BASE_URL}/sitemap.xml`,
+    sitemap: `${getBaseUrl()}/sitemap.xml`,
   }
 }

package/src/templates/next-pagebuilder/app/sitemap.xml/route.ts

@@ -51,8 +51,11 @@ const renderSitemap = (entries: SitemapEntry[]) =>
     "</urlset>",
   ].join("\n")
 
-const getSitemapResponse = (entries: SitemapEntry[]) =>
-  new NextResponse(renderSitemap(entries))
+const getSitemapResponse = (entries: SitemapEntry[], status = 200) =>
+  new NextResponse(renderSitemap(entries), {
+    status,
+    headers: { "Content-Type": "application/xml; charset=utf-8" },
+  })
 
 export const GET = async () => {
   const baseUrl = getSitemapBaseUrl()
@@ -75,6 +78,6 @@ export const GET = async () => {
     )
   } catch (error) {
     console.error("Error generating sitemap.xml:", error)
-    return getSitemapResponse([homepageEntry])
+    return getSitemapResponse([homepageEntry], 503)
   }
 }

package/src/templates/next-pagebuilder/components/page-builder/components/content-collection/skeleton.tsx

@@ -0,0 +1,53 @@
+const FEATURED_PLACEHOLDERS = ["featured-1", "featured-2"]
+const CARD_PLACEHOLDERS = [
+  "card-1",
+  "card-2",
+  "card-3",
+  "card-4",
+  "card-5",
+  "card-6",
+]
+const CHIP_PLACEHOLDERS = ["chip-1", "chip-2", "chip-3", "chip-4"]
+
+function CardPlaceholder() {
+  return (
+    <li className="flex flex-col gap-3">
+      <div className="aspect-16/9 w-full rounded-lg bg-black/10" />
+      <div className="flex flex-col gap-2">
+        <div className="h-3 w-16 rounded bg-black/10" />
+        <div className="h-5 w-4/5 rounded bg-black/10" />
+        <div className="h-4 w-1/2 rounded bg-black/10" />
+      </div>
+    </li>
+  )
+}
+
+export function ContentCollectionSkeleton() {
+  return (
+    <section
+      className="flex animate-pulse flex-col gap-8 py-8"
+      aria-hidden="true"
+    >
+      <div className="flex flex-col gap-4 rounded-[1.5rem] border border-black/10 bg-black/[0.02] p-4 sm:p-5">
+        <div className="flex flex-wrap gap-2">
+          {CHIP_PLACEHOLDERS.map((key) => (
+            <div className="h-9 w-28 rounded-full bg-black/10" key={key} />
+          ))}
+        </div>
+        <div className="h-4 w-40 rounded bg-black/10" />
+      </div>
+
+      <ul className="grid grid-cols-1 gap-8 md:grid-cols-2">
+        {FEATURED_PLACEHOLDERS.map((key) => (
+          <CardPlaceholder key={key} />
+        ))}
+      </ul>
+
+      <ul className="grid grid-cols-2 gap-8 md:grid-cols-2 lg:grid-cols-3">
+        {CARD_PLACEHOLDERS.map((key) => (
+          <CardPlaceholder key={key} />
+        ))}
+      </ul>
+    </section>
+  )
+}

package/src/templates/next-pagebuilder/components/page-builder/components/gated-content/index.tsx

@@ -0,0 +1,169 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import {
+  type GatedContentPayload,
+  unlockGatedContent,
+} from "@/app/actions/unlock-gated-content"
+import type { PageBuilderBlock } from "@/components/page-builder/types"
+import { RichText } from "@/components/sanity/rich-text"
+import { Link } from "@/components/ui/link"
+
+type GatedContentBlock = Extract<PageBuilderBlock, { _type: "gatedContent" }>
+
+type GatedContentProps = {
+  block: GatedContentBlock
+}
+
+type GateState = "locked" | "loading" | "unlocked"
+
+const STORAGE_PREFIX = "gated-content:"
+
+export function GatedContent({ block }: GatedContentProps) {
+  const storageKey = `${STORAGE_PREFIX}${block._id}`
+  const [state, setState] = useState<GateState>("locked")
+  const [payload, setPayload] = useState<GatedContentPayload | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [justUnlocked, setJustUnlocked] = useState(false)
+
+  // The payload is withheld from the page query, so it never reaches the client
+  // until this action runs. We remember the submitted email so a returning
+  // visitor re-fetches without seeing the form again.
+  const unlock = async (email: string, persist: boolean) => {
+    setState("loading")
+    setError(null)
+
+    const result = await unlockGatedContent({ documentId: block._id, email })
+
+    if (!result.ok) {
+      setError(result.error)
+      setState("locked")
+      if (!persist) window.localStorage.removeItem(storageKey)
+      return
+    }
+
+    setPayload(result.payload)
+    setState("unlocked")
+    if (persist) {
+      window.localStorage.setItem(storageKey, email)
+      setJustUnlocked(true)
+    }
+  }
+
+  // biome-ignore lint/correctness/useExhaustiveDependencies: re-fetch only when the block changes; unlock closes over stable values
+  useEffect(() => {
+    const savedEmail = window.localStorage.getItem(storageKey)
+    if (savedEmail) void unlock(savedEmail, false)
+  }, [storageKey])
+
+  const handleSubmit = (event: React.FormEvent<HTMLFormElement>) => {
+    event.preventDefault()
+    const email =
+      new FormData(event.currentTarget).get("email")?.toString() ?? ""
+    void unlock(email, true)
+  }
+
+  return (
+    <section className="py-8 md:py-12">
+      {block.teaserHeading ? (
+        <h2 className="mb-4 font-semibold text-2xl tracking-tight md:text-4xl">
+          {block.teaserHeading}
+        </h2>
+      ) : null}
+
+      {block.teaserBody ? (
+        <div className="max-w-[62ch] space-y-4 text-base/7 text-current/80 md:text-lg/8">
+          <RichText content={block.teaserBody} />
+        </div>
+      ) : null}
+
+      {state === "unlocked" && payload ? (
+        <div className="mt-8">
+          {justUnlocked && block.successMessage ? (
+            <p className="mb-6 rounded-lg bg-black/[0.04] px-4 py-3 text-current/72 text-sm">
+              {block.successMessage}
+            </p>
+          ) : null}
+          <GatedReveal payload={payload} />
+        </div>
+      ) : (
+        <form
+          onSubmit={handleSubmit}
+          className="mt-8 flex max-w-md flex-col gap-4 rounded-[1.5rem] border border-black/10 bg-black/[0.02] p-6"
+        >
+          {block.gateHeadline ? (
+            <h3 className="font-semibold text-lg">{block.gateHeadline}</h3>
+          ) : null}
+          {block.gateDescription ? (
+            <p className="text-current/72 text-sm">{block.gateDescription}</p>
+          ) : null}
+          <input
+            type="email"
+            name="email"
+            required
+            placeholder="you@example.com"
+            className="rounded-lg border border-black/10 bg-white px-4 py-2.5 text-sm outline-none focus:border-black/40"
+          />
+          {error ? <p className="text-red-600 text-sm">{error}</p> : null}
+          <button
+            type="submit"
+            disabled={state === "loading"}
+            className="rounded-lg bg-black px-4 py-2.5 font-medium text-sm text-white transition-colors hover:bg-black/80 disabled:opacity-60"
+          >
+            {state === "loading" ? "Unlocking…" : block.submitLabel || "Unlock"}
+          </button>
+        </form>
+      )}
+    </section>
+  )
+}
+
+function GatedReveal({ payload }: { payload: GatedContentPayload }) {
+  if (payload.kind === "richText" && payload.content) {
+    return (
+      <div className="max-w-[62ch] space-y-4 text-base/7 text-current/80 md:text-lg/8">
+        <RichText content={payload.content} />
+      </div>
+    )
+  }
+
+  if (payload.kind === "file" && payload.file?.url) {
+    return (
+      <Link
+        href={payload.file.url}
+        download
+        className="inline-flex items-center gap-2 rounded-lg bg-black px-4 py-2.5 font-medium text-sm text-white transition-colors hover:bg-black/80"
+      >
+        Download {payload.file.originalFilename ?? "file"}
+      </Link>
+    )
+  }
+
+  if (payload.kind === "video") {
+    if (payload.video.url) {
+      return (
+        <div className="aspect-video w-full max-w-3xl overflow-hidden rounded-lg">
+          <iframe
+            src={payload.video.url}
+            title="Gated video"
+            allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
+            allowFullScreen
+            className="h-full w-full border-0"
+          />
+        </div>
+      )
+    }
+    if (payload.video.file?.url) {
+      return (
+        // biome-ignore lint/a11y/useMediaCaption: editor-supplied video without a caption track
+        <video
+          controls
+          src={payload.video.file.url}
+          className="w-full max-w-3xl rounded-lg"
+        />
+      )
+    }
+  }
+
+  return null
+}

package/src/templates/next-pagebuilder/components/page-builder/renderer.tsx

@@ -1,7 +1,10 @@
+import { Suspense } from "react"
 import { ArticleContent } from "./components/article-content"
 import { ContentCollection } from "./components/content-collection"
+import { ContentCollectionSkeleton } from "./components/content-collection/skeleton"
 import type { ContentCollectionSearchParams } from "./components/content-collection/types"
 import { Description } from "./components/description"
+import { GatedContent } from "./components/gated-content"
 import { Hero } from "./components/hero"
 import type { PageBuilderBlock, PageBuilderBlocks } from "./types"
 
@@ -35,13 +38,19 @@ function PageBuilderNode({
 }) {
   switch (block._type) {
     case "blogCollection":
-      return <ContentCollection block={block} searchParams={searchParams} />
+      return (
+        <Suspense fallback={<ContentCollectionSkeleton />}>
+          <ContentCollection block={block} searchParams={searchParams} />
+        </Suspense>
+      )
     case "blogContent":
       return <ArticleContent block={block} />
     case "hero":
       return <Hero block={block} />
     case "description":
       return <Description block={block} />
+    case "gatedContent":
+      return <GatedContent block={block} />
     default:
       return null
   }

package/src/templates/next-pagebuilder/knip.json

@@ -22,11 +22,13 @@
     "rxjs",
     "gsap",
     "@gsap/react",
-    "motion"
+    "motion",
+    "detect-gpu",
+    "lodash-es",
+    "@types/lodash-es",
+    "react-device-detect",
+    "zustand"
   ],
-  "ignoreBinaries": [
-    "gh",
-    "op",
-    "vercel"
-  ]
+  "ignoreBinaries": ["gh", "op", "vercel"],
+  "ignoreFiles": [".agents/**", ".claude/**", "hooks/**"]
 }

package/src/templates/next-pagebuilder/lefthook.yml

@@ -14,11 +14,6 @@ pre-commit:
       run: bunx tsgo --noEmit --incremental false
       stage_fixed: false
 
-pre-push:
-  commands:
-    knip:
-      run: bun run knip
-
 post-merge:
   commands:
     install-deps:

package/src/templates/next-pagebuilder/lib/integrations/sanity/sanity.types.ts

@@ -50,6 +50,13 @@ export type SanityImageAssetReference = {
   [internalGroqTypeReferenceTo]?: "sanity.imageAsset"
 }
 
+export type SanityFileAssetReference = {
+  _ref: string
+  _type: "reference"
+  _weak?: boolean
+  [internalGroqTypeReferenceTo]?: "sanity.fileAsset"
+}
+
 export type StructuredData = {
   _id: string
   _type: "structuredData"
@@ -307,6 +314,33 @@ export type BlogCollection = {
   subtitle?: string
 }
 
+export type GatedContent = {
+  _id: string
+  _type: "gatedContent"
+  _createdAt: string
+  _updatedAt: string
+  _rev: string
+  internalTitle?: string
+  teaserHeading?: string
+  teaserBody?: RichText
+  gateType?: "form"
+  gateHeadline?: string
+  gateDescription?: string
+  submitLabel?: string
+  successMessage?: string
+  kind?: "richText" | "file" | "video"
+  content?: RichText
+  file?: {
+    asset?: SanityFileAssetReference
+    _type: "file"
+  }
+  videoUrl?: string
+  videoFile?: {
+    asset?: SanityFileAssetReference
+    _type: "file"
+  }
+}
+
 export type NavItem = {
   _type: "navItem"
   title?: string
@@ -475,6 +509,13 @@ export type BlogCollectionReference = {
   [internalGroqTypeReferenceTo]?: "blogCollection"
 }
 
+export type GatedContentReference = {
+  _ref: string
+  _type: "reference"
+  _weak?: boolean
+  [internalGroqTypeReferenceTo]?: "gatedContent"
+}
+
 export type PageBuilder = Array<
   | ({
       _key: string
@@ -488,6 +529,9 @@ export type PageBuilder = Array<
   | ({
       _key: string
     } & BlogCollectionReference)
+  | ({
+      _key: string
+    } & GatedContentReference)
 >
 
 export type Metadata = {
@@ -699,6 +743,7 @@ export type AllSanitySchemaTypes =
   | Slug
   | Redirect
   | SanityImageAssetReference
+  | SanityFileAssetReference
   | StructuredData
   | SanityImageCrop
   | SanityImageHotspot
@@ -715,6 +760,7 @@ export type AllSanitySchemaTypes =
   | RichText
   | Author
   | BlogCollection
+  | GatedContent
   | NavItem
   | NavMegaMenu
   | NavColumn
@@ -730,6 +776,7 @@ export type AllSanitySchemaTypes =
   | DescriptionReference
   | BlogContentReference
   | BlogCollectionReference
+  | GatedContentReference
   | PageBuilder
   | Metadata
   | ExternalLink
@@ -768,6 +815,20 @@ export type PAGE_QUERY_RESULT = {
         _rev: string
         subtitle?: string
       }
+    | {
+        _key: string
+        _id: string
+        _type: "gatedContent"
+        internalTitle: string | null
+        teaserHeading: string | null
+        teaserBody: RichText | null
+        gateType: string | null
+        gateHeadline: string | null
+        gateDescription: string | null
+        submitLabel: string | null
+        successMessage: string | null
+        kind: "richText" | "file" | "video" | null
+      }
     | {
         _key: string
         _id: string
@@ -897,6 +958,26 @@ export type PAGE_QUERY_RESULT = {
   _updatedAt: string
 } | null
 
+// Source: queries.ts
+// Variable: GATED_CONTENT_QUERY
+export type GATED_CONTENT_QUERY_RESULT = {
+  kind: "richText" | "file" | "video" | null
+  content: RichText | null
+  file: {
+    url: string | null
+    originalFilename: string | null
+    mimeType: string | null
+    size: number | null
+  } | null
+  video: {
+    url: string | null
+    file: {
+      url: string | null
+      mimeType: string | null
+    } | null
+  }
+} | null
+
 // Source: queries.ts
 // Variable: PAGE_METADATA_QUERY
 // Query: *[    _type == "page" &&    (      ($slug == null && !defined(pageFolder._ref) && (!defined(slug.current) || slug.current == "" || slug.current == "/")) ||        select(    defined(pageFolder->parentFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->slug.current) && defined(pageFolder->slug.current) && (!defined(slug.current) || slug.current == "" || slug.current == "/") => pageFolder->parentFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->slug.current + "/" + pageFolder->slug.current,    defined(pageFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->slug.current) && defined(pageFolder->slug.current) && (!defined(slug.current) || slug.current == "" || slug.current == "/") => pageFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->slug.current + "/" + pageFolder->slug.current,    defined(pageFolder->parentFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->slug.current) && defined(pageFolder->slug.current) && (!defined(slug.current) || slug.current == "" || slug.current == "/") => pageFolder->parentFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->slug.current + "/" + pageFolder->slug.current,    defined(pageFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->slug.current) && defined(pageFolder->slug.current) && (!defined(slug.current) || slug.current == "" || slug.current == "/") => pageFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->slug.current + "/" + pageFolder->slug.current,    defined(pageFolder->parentFolder->slug.current) && defined(pageFolder->slug.current) && (!defined(slug.current) || slug.current == "" || slug.current == "/") => pageFolder->parentFolder->slug.current + "/" + pageFolder->slug.current,    defined(pageFolder->slug.current) && (!defined(slug.current) || slug.current == "" || slug.current == "/") => pageFolder->slug.current,    defined(pageFolder->parentFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->slug.current) && defined(pageFolder->slug.current) && defined(slug.current) && slug.current != "" && slug.current != "/" => pageFolder->parentFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->slug.current + "/" + pageFolder->slug.current + "/" + slug.current,    defined(pageFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->slug.current) && defined(pageFolder->slug.current) && defined(slug.current) && slug.current != "" && slug.current != "/" => pageFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->slug.current + "/" + pageFolder->slug.current + "/" + slug.current,    defined(pageFolder->parentFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->slug.current) && defined(pageFolder->slug.current) && defined(slug.current) && slug.current != "" && slug.current != "/" => pageFolder->parentFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->slug.current + "/" + pageFolder->slug.current + "/" + slug.current,    defined(pageFolder->parentFolder->parentFolder->slug.current) && defined(pageFolder->parentFolder->slug.current) && defined(pageFolder->slug.current) && defined(slug.current) && slug.current != "" && slug.current != "/" => pageFolder->parentFolder->parentFolder->slug.current + "/" + pageFolder->parentFolder->slug.current + "/" + pageFolder->slug.current + "/" + slug.current,    defined(pageFolder->parentFolder->slug.current) && defined(pageFolder->slug.current) && defined(slug.current) && slug.current != "" && slug.current != "/" => pageFolder->parentFolder->slug.current + "/" + pageFolder->slug.current + "/" + slug.current,    defined(pageFolder->slug.current) && defined(slug.current) && slug.current != "" && slug.current != "/" => pageFolder->slug.current + "/" + slug.current,    slug.current  ) == $slug    )  ][0] {      _id,  title,  metadata,  _updatedAt  }

package/src/templates/next-pagebuilder/next.config.ts

@@ -68,7 +68,6 @@ const nextConfig: NextConfig = {
     browserToTerminal: true,
   },
   experimental: {
-    prefetchInlining: true,
     optimizePackageImports: [
       "@react-three/drei",
       "@react-three/fiber",
@@ -94,7 +93,8 @@ const nextConfig: NextConfig = {
   },
   headers: async () => [
     {
-      source: "/(.*)",
+      // Excludes /studio* — must stay mutually exclusive with the rule below.
+      source: "/((?!studio(?:/|$)).*)",
       headers: [
         {
           key: "X-Content-Type-Options",
@@ -126,6 +126,37 @@ const nextConfig: NextConfig = {
         },
       ],
     },
+    {
+      // X-Frame-Options can't allow a third-party origin, and Next can't unset
+      // it from another rule — the iframe needs it absent, not overridden.
+      source: "/studio/:path*",
+      headers: [
+        {
+          key: "X-Content-Type-Options",
+          value: "nosniff",
+        },
+        {
+          key: "Content-Security-Policy",
+          value: "frame-ancestors 'self' https://*.sanity.io;",
+        },
+        {
+          key: "X-XSS-Protection",
+          value: "1; mode=block",
+        },
+        {
+          key: "X-DNS-Prefetch-Control",
+          value: "on",
+        },
+        {
+          key: "Strict-Transport-Security",
+          value: "max-age=63072000; includeSubDomains; preload",
+        },
+        {
+          key: "Permissions-Policy",
+          value: "camera=(), microphone=(), geolocation=()",
+        },
+      ],
+    },
   ],
 }
 

package/src/templates/next-pagebuilder/package.json

@@ -28,9 +28,9 @@
   },
   "dependencies": {
     "class-variance-authority": "^0.7.1",
-    "next": "^16",
-    "react": "^19",
-    "react-dom": "^19",
+    "next": "^16.3.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "react-use": "^17.6.0",
     "tailwind-merge": "^3.5.0",
     "zod": "^4.3.6"
@@ -38,7 +38,7 @@
   "devDependencies": {
     "@biomejs/biome": "^2.4.14",
     "@csstools/postcss-global-data": "^4.0.0",
-    "@next/bundle-analyzer": "^16.2.1",
+    "@next/bundle-analyzer": "^16.3.0",
     "@svgr/webpack": "^8.1.0",
     "@tailwindcss/postcss": "^4.2.2",
     "@types/bun": "^1.3.11",