diff --git a/.changeset/add-plugin-content-schema-extension.md b/.changeset/add-plugin-content-schema-extension.md
new file mode 100644
index 00000000..36573fd7
--- /dev/null
+++ b/.changeset/add-plugin-content-schema-extension.md
@@ -0,0 +1,7 @@
+---
+"@stackwright/types": minor
+---
+
+Add `contentItemSchemas` and `knownContentTypeKeys` to `PrebuildPlugin` interface.
+Add `buildExtendedPageContentSchema()` function for merging OSS and plugin content schemas.
+Add `ValidatePageContentOptions` to `validatePageContent()` for plugin-aware validation.
diff --git a/.changeset/add-pro-content-normalization.md b/.changeset/add-pro-content-normalization.md
new file mode 100644
index 00000000..8e63d51e
--- /dev/null
+++ b/.changeset/add-pro-content-normalization.md
@@ -0,0 +1,6 @@
+---
+"@stackwright/build-scripts": minor
+---
+
+Add content format normalization (mapping-key YAML format → type-field format) to prebuild pipeline.
+Plugin `contentItemSchemas` and `knownContentTypeKeys` are now applied during page validation.
diff --git a/.changeset/dependabot-batch-updates.md b/.changeset/dependabot-batch-updates.md
new file mode 100644
index 00000000..d5b22d58
--- /dev/null
+++ b/.changeset/dependabot-batch-updates.md
@@ -0,0 +1,15 @@
+---
+"@stackwright/core": patch
+"@stackwright/icons": patch
+"@stackwright/maplibre": patch
+"@stackwright/nextjs": patch
+"@stackwright/ui-shadcn": patch
+---
+
+chore: consolidate dependabot dependency updates
+
+- `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+- `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+- `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+- `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+- `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
diff --git a/.changeset/feat-188-page-add-content-flag.md b/.changeset/feat-188-page-add-content-flag.md
new file mode 100644
index 00000000..eab52a5e
--- /dev/null
+++ b/.changeset/feat-188-page-add-content-flag.md
@@ -0,0 +1,7 @@
+---
+"@stackwright/cli": patch
+---
+
+feat(cli): add --content flag to `page add` for inline YAML (#188)
+
+Agents can now create a page with full content in a single command instead of a two-step add + write sequence. Content is validated before writing; invalid YAML is rejected with field-level errors.
diff --git a/.changeset/feat-243-security-headers.md b/.changeset/feat-243-security-headers.md
new file mode 100644
index 00000000..76a47d9a
--- /dev/null
+++ b/.changeset/feat-243-security-headers.md
@@ -0,0 +1,5 @@
+---
+"@stackwright/nextjs": minor
+---
+
+Add security headers (CSP, HSTS, COOP/CORP/COEP) to Next.js integration with customizable configuration
diff --git a/.changeset/fix-352-install-flag-actually-installs.md b/.changeset/fix-352-install-flag-actually-installs.md
new file mode 100644
index 00000000..2cf34eda
--- /dev/null
+++ b/.changeset/fix-352-install-flag-actually-installs.md
@@ -0,0 +1,5 @@
+---
+"@stackwright/cli": patch
+---
+
+fix(cli): --install flag now runs pnpm install before postInstall hooks
diff --git a/.changeset/fix-plugin-config-schema-242.md b/.changeset/fix-plugin-config-schema-242.md
new file mode 100644
index 00000000..88db2c67
--- /dev/null
+++ b/.changeset/fix-plugin-config-schema-242.md
@@ -0,0 +1,6 @@
+---
+"@stackwright/types": patch
+"@stackwright/build-scripts": patch
+---
+
+Add configSchema field to PrebuildPlugin for plugin config validation
diff --git a/.changeset/fix-plugin-this-binding.md b/.changeset/fix-plugin-this-binding.md
new file mode 100644
index 00000000..dbb13b74
--- /dev/null
+++ b/.changeset/fix-plugin-this-binding.md
@@ -0,0 +1,14 @@
+---
+"@stackwright/build-scripts": patch
+---
+
+fix(executePluginHook): preserve `this` binding when calling plugin lifecycle hooks
+
+`executePluginHook` was extracting hook methods as unbound references
+(`const hookFn = plugin[hook]`) and calling them as plain functions
+(`hookFn(context)`). In strict-mode ES classes, this strips `this`,
+causing any plugin that calls a private/instance method from `beforeBuild`
+or `afterBuild` to throw `Cannot read properties of undefined`.
+
+Fix: use `hookFn.call(plugin, context)` so the plugin instance is always
+the receiver.
diff --git a/.changeset/fix-preinstall-double-run.md b/.changeset/fix-preinstall-double-run.md
new file mode 100644
index 00000000..df264ead
--- /dev/null
+++ b/.changeset/fix-preinstall-double-run.md
@@ -0,0 +1,18 @@
+---
+"@stackwright/cli": patch
+---
+
+fix(cli): remove duplicate preInstall hook call from processTemplate
+
+`processTemplate()` was calling `runScaffoldHooks('preInstall', ...)` internally,
+then `scaffold.ts` called it again after `processTemplate` returned — running every
+preInstall handler twice. Worse, the second call passed the original empty `{}` object
+(not the built package.json), so hooks registered via `scaffold.ts` could never affect
+the written file.
+
+Fix: lifecycle orchestration now lives entirely in `scaffold.ts`. `buildPackageJson` is
+exported so `scaffold.ts` can build the default package.json before running preInstall
+hooks, then passes the already-hooks-modified object into `processTemplate` for writing.
+`processTemplate` no longer calls hooks.
+
+Fixes #351.
diff --git a/.changeset/fix-prismjs-esm-bundle.md b/.changeset/fix-prismjs-esm-bundle.md
new file mode 100644
index 00000000..7925e00d
--- /dev/null
+++ b/.changeset/fix-prismjs-esm-bundle.md
@@ -0,0 +1,15 @@
+---
+"@stackwright/core": patch
+---
+
+fix(core): bundle prismjs to eliminate bare ESM sub-path imports
+
+`@stackwright/core`'s published ESM bundle contained bare imports such as
+`import 'prismjs/components/prism-javascript'` (no `.js` extension). Because
+`prismjs` is a legacy CJS package with no `exports` map, Node.js ESM strict
+resolver could not find these paths and threw `ERR_MODULE_NOT_FOUND`.
+
+Added `noExternal: ['prismjs']` to `tsup.config.ts` so that esbuild bundles
+prismjs inline at build time. All language grammar paths are resolved to real
+`.js` files before the bundle is published — no bare specifiers escape into
+the output.
diff --git a/.changeset/grumpy-paws-create.md b/.changeset/grumpy-paws-create.md
new file mode 100644
index 00000000..3394347b
--- /dev/null
+++ b/.changeset/grumpy-paws-create.md
@@ -0,0 +1,5 @@
+---
+"@stackwright/core": patch
+---
+
+fix(core): prevent duplicate TopAppBar rendering that caused a double dark-mode toggle icon
diff --git a/.changeset/pre.json b/.changeset/pre.json
new file mode 100644
index 00000000..e745f394
--- /dev/null
+++ b/.changeset/pre.json
@@ -0,0 +1,37 @@
+{
+  "mode": "pre",
+  "tag": "alpha",
+  "initialVersions": {
+    "stackwright-docs": "0.1.2",
+    "@stackwright/build-scripts": "0.5.1",
+    "@stackwright/cli": "0.8.1",
+    "@stackwright/collections": "0.1.0",
+    "@stackwright/core": "0.8.0",
+    "@stackwright/e2e": "0.3.0",
+    "@stackwright/hooks-registry": "0.1.0",
+    "@stackwright/icons": "0.5.0",
+    "launch-stackwright": "0.2.1",
+    "@stackwright/maplibre": "2.0.0",
+    "@stackwright/mcp": "0.4.1",
+    "@stackwright/nextjs": "0.4.0",
+    "@stackwright/otters": "0.2.0",
+    "@stackwright/sbom-generator": "0.2.0",
+    "@stackwright/scaffold-core": "0.3.0",
+    "@stackwright/themes": "0.5.2",
+    "@stackwright/types": "1.2.0",
+    "@stackwright/ui-shadcn": "0.1.1"
+  },
+  "changesets": [
+    "add-plugin-content-schema-extension",
+    "add-pro-content-normalization",
+    "dependabot-batch-updates",
+    "feat-188-page-add-content-flag",
+    "feat-243-security-headers",
+    "fix-352-install-flag-actually-installs",
+    "fix-plugin-config-schema-242",
+    "fix-plugin-this-binding",
+    "fix-preinstall-double-run",
+    "fix-prismjs-esm-bundle",
+    "grumpy-paws-create"
+  ]
+}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0105b55f..6617efd8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,11 +4,6 @@ on:
   push:
     branches:
       - main
-  pull_request:
-    branches:
-      - main
-    types:
-      - closed
 
 permissions:
   contents: write
@@ -21,7 +16,7 @@ jobs:
     # Squash merges embed individual commit messages in the body, and automated
     # commits (prerelease bumps, etc.) include [skip ci] — which would incorrectly
     # suppress the release workflow if we used contains() on the full body.
-    if: "${{ !startsWith(github.event.head_commit.message, 'chore: version packages for release [skip ci]') }}"
+    if: "${{ github.event_name == 'push' && !startsWith(github.event.head_commit.message, 'chore: version packages for release [skip ci]') }}"
     steps:
       - name: Generate PerAsperaCI token
         id: app-token
@@ -42,7 +37,6 @@ jobs:
           node-version: 22
           registry-url: 'https://registry.npmjs.org'
           cache: 'pnpm'
-          provenance: true
 
       - run: pnpm install --frozen-lockfile
 
diff --git a/examples/stackwright-docs/CHANGELOG.md b/examples/stackwright-docs/CHANGELOG.md
index d862bff6..d10be9f4 100644
--- a/examples/stackwright-docs/CHANGELOG.md
+++ b/examples/stackwright-docs/CHANGELOG.md
@@ -1,5 +1,37 @@
 # stackwright-docs
 
+## 0.1.3-alpha.2
+
+### Patch Changes
+
+- Updated dependencies [fb3393e]
+  - @stackwright/core@0.8.1-alpha.2
+  - @stackwright/nextjs@0.5.0-alpha.2
+
+## 0.1.3-alpha.1
+
+### Patch Changes
+
+- Updated dependencies [c036f5b]
+- Updated dependencies [6326d49]
+- Updated dependencies [5ad5035]
+  - @stackwright/core@0.8.1-alpha.1
+  - @stackwright/icons@0.5.1-alpha.1
+  - @stackwright/nextjs@0.5.0-alpha.1
+  - @stackwright/ui-shadcn@0.1.2-alpha.1
+
+## 0.1.3-alpha.0
+
+### Patch Changes
+
+- Updated dependencies [c036f5b]
+- Updated dependencies [6326d49]
+- Updated dependencies [5ad5035]
+  - @stackwright/core@0.8.1-alpha.0
+  - @stackwright/icons@0.5.1-alpha.0
+  - @stackwright/nextjs@0.5.0-alpha.0
+  - @stackwright/ui-shadcn@0.1.2-alpha.0
+
 ## 0.1.2
 
 ### Patch Changes
diff --git a/examples/stackwright-docs/package.json b/examples/stackwright-docs/package.json
index 1ac7886f..85d31e39 100644
--- a/examples/stackwright-docs/package.json
+++ b/examples/stackwright-docs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "stackwright-docs",
-  "version": "0.1.2",
+  "version": "0.1.3-alpha.2",
   "private": true,
   "scripts": {
     "prebuild": "stackwright-prebuild",
diff --git a/package.json b/package.json
index 6fa262b7..bbe31490 100644
--- a/package.json
+++ b/package.json
@@ -91,7 +91,8 @@
             "hono": ">=4.12.14",
             "@hono/node-server": ">=1.19.10",
             "basic-ftp": ">=5.3.0",
-            "express-rate-limit": ">=8.2.2"
+            "express-rate-limit": ">=8.2.2",
+	    "uuid": ">=14.0.0"
         },
         "onlyBuiltDependencies": [
             "@swc/core",
@@ -114,4 +115,4 @@
             "@commitlint/config-conventional"
         ]
     }
-}
\ No newline at end of file
+}
diff --git a/packages/build-scripts/CHANGELOG.md b/packages/build-scripts/CHANGELOG.md
index 74daa332..6b47744d 100644
--- a/packages/build-scripts/CHANGELOG.md
+++ b/packages/build-scripts/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @stackwright/build-scripts
 
+## 0.6.0-alpha.0
+
+### Minor Changes
+
+- bdf7fe0: Add content format normalization (mapping-key YAML format → type-field format) to prebuild pipeline.
+  Plugin `contentItemSchemas` and `knownContentTypeKeys` are now applied during page validation.
+
+### Patch Changes
+
+- 68bdad5: Add configSchema field to PrebuildPlugin for plugin config validation
+- 83ba70c: fix(executePluginHook): preserve `this` binding when calling plugin lifecycle hooks
+
+  `executePluginHook` was extracting hook methods as unbound references
+  (`const hookFn = plugin[hook]`) and calling them as plain functions
+  (`hookFn(context)`). In strict-mode ES classes, this strips `this`,
+  causing any plugin that calls a private/instance method from `beforeBuild`
+  or `afterBuild` to throw `Cannot read properties of undefined`.
+
+  Fix: use `hookFn.call(plugin, context)` so the plugin instance is always
+  the receiver.
+
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [68bdad5]
+  - @stackwright/types@1.3.0-alpha.1
+
 ## 0.5.1
 
 ### Patch Changes
diff --git a/packages/build-scripts/package.json b/packages/build-scripts/package.json
index 9bb0f161..8b1b3df8 100644
--- a/packages/build-scripts/package.json
+++ b/packages/build-scripts/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@stackwright/build-scripts",
-    "version": "0.5.1",
+    "version": "0.6.0-alpha.0",
     "description": "Build-time scripts for Stackwright projects (prebuild image processing, YAML compilation)",
     "license": "MIT",
     "repository": {
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index 54b0d70e..43b89dc7 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,36 @@
 # @stackwright/cli
 
+## 0.8.2-alpha.0
+
+### Patch Changes
+
+- f0b74ef: feat(cli): add --content flag to `page add` for inline YAML (#188)
+
+  Agents can now create a page with full content in a single command instead of a two-step add + write sequence. Content is validated before writing; invalid YAML is rejected with field-level errors.
+
+- 90a22c6: fix(cli): --install flag now runs pnpm install before postInstall hooks
+- a410f02: fix(cli): remove duplicate preInstall hook call from processTemplate
+
+  `processTemplate()` was calling `runScaffoldHooks('preInstall', ...)` internally,
+  then `scaffold.ts` called it again after `processTemplate` returned — running every
+  preInstall handler twice. Worse, the second call passed the original empty `{}` object
+  (not the built package.json), so hooks registered via `scaffold.ts` could never affect
+  the written file.
+
+  Fix: lifecycle orchestration now lives entirely in `scaffold.ts`. `buildPackageJson` is
+  exported so `scaffold.ts` can build the default package.json before running preInstall
+  hooks, then passes the already-hooks-modified object into `processTemplate` for writing.
+  `processTemplate` no longer calls hooks.
+
+  Fixes #351.
+
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [68bdad5]
+- Updated dependencies [83ba70c]
+  - @stackwright/types@1.3.0-alpha.1
+  - @stackwright/build-scripts@0.6.0-alpha.0
+
 ## 0.8.1
 
 ### Patch Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 72a98e4f..f4ad9ddf 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@stackwright/cli",
-  "version": "0.8.1",
+  "version": "0.8.2-alpha.0",
   "description": "CLI for Stackwright framework",
   "license": "MIT",
   "repository": {
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index 99032ec9..3167a89c 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -1,5 +1,53 @@
 # @stackwright/core
 
+## 0.8.1-alpha.2
+
+### Patch Changes
+
+- fb3393e: fix(core): bundle prismjs to eliminate bare ESM sub-path imports
+
+  `@stackwright/core`'s published ESM bundle contained bare imports such as
+  `import 'prismjs/components/prism-javascript'` (no `.js` extension). Because
+  `prismjs` is a legacy CJS package with no `exports` map, Node.js ESM strict
+  resolver could not find these paths and threw `ERR_MODULE_NOT_FOUND`.
+
+  Added `noExternal: ['prismjs']` to `tsup.config.ts` so that esbuild bundles
+  prismjs inline at build time. All language grammar paths are resolved to real
+  `.js` files before the bundle is published — no bare specifiers escape into
+  the output.
+
+## 0.8.1-alpha.1
+
+### Patch Changes
+
+- c036f5b: chore: consolidate dependabot dependency updates
+  - `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+  - `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+  - `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+  - `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+  - `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
+
+- 5ad5035: fix(core): prevent duplicate TopAppBar rendering that caused a double dark-mode toggle icon
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [68bdad5]
+  - @stackwright/types@1.3.0-alpha.1
+
+## 0.8.1-alpha.0
+
+### Patch Changes
+
+- c036f5b: chore: consolidate dependabot dependency updates
+  - `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+  - `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+  - `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+  - `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+  - `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
+
+- 5ad5035: fix(core): prevent duplicate TopAppBar rendering that caused a double dark-mode toggle icon
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [68bdad5]
+  - @stackwright/types@1.3.0-alpha.0
+
 ## 0.8.0
 
 ### Minor Changes
diff --git a/packages/core/package.json b/packages/core/package.json
index 2aec1a45..c0eca4bd 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@stackwright/core",
-    "version": "0.8.0",
+    "version": "0.8.1-alpha.2",
     "description": "Core framework for building applications from YAML configuration",
     "license": "MIT",
     "repository": {
diff --git a/packages/core/test/utils/prismHighlighter.test.ts b/packages/core/test/utils/prismHighlighter.test.ts
new file mode 100644
index 00000000..e4ca6e2a
--- /dev/null
+++ b/packages/core/test/utils/prismHighlighter.test.ts
@@ -0,0 +1,149 @@
+import { describe, it, expect } from 'vitest';
+import {
+  highlightCode,
+  getTokenColor,
+  highlightCodeWithMode,
+} from '../../src/utils/prismHighlighter';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Assert every token in an array satisfies the HighlightToken shape. */
+function expectWellFormedTokens(tokens: ReturnType<typeof highlightCode>) {
+  for (const token of tokens) {
+    expect(token.type === null || typeof token.type === 'string').toBe(true);
+    expect(typeof token.content).toBe('string');
+  }
+}
+
+// ---------------------------------------------------------------------------
+// highlightCode
+// ---------------------------------------------------------------------------
+
+describe('highlightCode', () => {
+  it('returns a single plain-text token when no language is provided', () => {
+    const tokens = highlightCode('hello');
+    expect(tokens).toEqual([{ type: null, content: 'hello' }]);
+  });
+
+  it('falls back to plain-text when the language is unsupported', () => {
+    const tokens = highlightCode('hello', 'cobol');
+    expect(tokens).toEqual([{ type: null, content: 'hello' }]);
+  });
+
+  it('produces at least one keyword token for JavaScript "const"', () => {
+    const tokens = highlightCode('const x = 1;', 'javascript');
+    expect(tokens.some((t) => t.type === 'keyword')).toBe(true);
+  });
+
+  describe('language alias resolution', () => {
+    it('"js" resolves to javascript and produces keyword tokens', () => {
+      const tokens = highlightCode('const x = 1;', 'js');
+      expect(tokens.some((t) => t.type === 'keyword')).toBe(true);
+    });
+
+    it('"yml" resolves to yaml and produces typed tokens', () => {
+      const tokens = highlightCode('x: 1', 'yml');
+      expect(tokens.some((t) => t.type !== null)).toBe(true);
+    });
+
+    it('"py" resolves to python and produces typed tokens', () => {
+      const tokens = highlightCode('def f(): pass', 'py');
+      expect(tokens.some((t) => t.type !== null)).toBe(true);
+    });
+
+    it('"sh" resolves to bash and produces typed tokens', () => {
+      const tokens = highlightCode('echo hi', 'sh');
+      expect(tokens.some((t) => t.type !== null)).toBe(true);
+    });
+
+    it('"shell" resolves to bash and produces typed tokens', () => {
+      const tokens = highlightCode('echo hi', 'shell');
+      expect(tokens.some((t) => t.type !== null)).toBe(true);
+    });
+  });
+
+  it('every token from any call has the correct HighlightToken shape', () => {
+    const cases = [
+      highlightCode('hello'),
+      highlightCode('hello', 'cobol'),
+      highlightCode('const x = 1;', 'javascript'),
+      highlightCode('x: 1', 'yml'),
+    ];
+    for (const tokens of cases) {
+      expectWellFormedTokens(tokens);
+    }
+  });
+
+  it('multi-line code produces more than 2 tokens for JavaScript', () => {
+    const tokens = highlightCode('const a = 1;\nconst b = 2;', 'javascript');
+    expect(tokens.length).toBeGreaterThan(2);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// getTokenColor
+// ---------------------------------------------------------------------------
+
+describe('getTokenColor', () => {
+  it('returns a truthy string for a known token type in light mode', () => {
+    const color = getTokenColor('keyword');
+    expect(typeof color).toBe('string');
+    expect(color).toBeTruthy();
+  });
+
+  it('returns a different color in dark mode vs light mode for the same token type', () => {
+    const light = getTokenColor('keyword', false);
+    const dark = getTokenColor('keyword', true);
+    expect(typeof dark).toBe('string');
+    expect(dark).not.toBe(light);
+  });
+
+  it('returns undefined for a null type', () => {
+    expect(getTokenColor(null)).toBeUndefined();
+  });
+
+  it('returns undefined for an unknown token type', () => {
+    expect(getTokenColor('unknownXYZ')).toBeUndefined();
+  });
+
+  it('defaults to light mode when isDark is not provided', () => {
+    expect(getTokenColor('string')).toBe(getTokenColor('string', false));
+  });
+});
+
+// ---------------------------------------------------------------------------
+// highlightCodeWithMode
+// ---------------------------------------------------------------------------
+
+describe('highlightCodeWithMode', () => {
+  it('attaches a resolved color string to every token with a known type', () => {
+    const tokens = highlightCodeWithMode('const x = 1;', 'javascript', false);
+
+    // Every token whose type resolves to a color must carry that color.
+    for (const token of tokens) {
+      const expected = getTokenColor(token.type, false);
+      if (expected !== undefined) {
+        expect(token.color).toBe(expected);
+      }
+    }
+
+    // Specifically: the keyword token color must match getTokenColor('keyword', false).
+    const kwToken = tokens.find((t) => t.type === 'keyword');
+    expect(kwToken).toBeDefined();
+    expect(kwToken!.color).toBe(getTokenColor('keyword', false));
+  });
+
+  it('dark-mode keyword color differs from light-mode keyword color', () => {
+    const lightTokens = highlightCodeWithMode('const x = 1;', 'javascript', false);
+    const darkTokens = highlightCodeWithMode('const x = 1;', 'javascript', true);
+
+    const lightKw = lightTokens.find((t) => t.type === 'keyword');
+    const darkKw = darkTokens.find((t) => t.type === 'keyword');
+
+    expect(lightKw).toBeDefined();
+    expect(darkKw).toBeDefined();
+    expect(lightKw!.color).not.toBe(darkKw!.color);
+  });
+});
diff --git a/packages/core/tsup.config.ts b/packages/core/tsup.config.ts
index ed01a95a..bd1e06bb 100644
--- a/packages/core/tsup.config.ts
+++ b/packages/core/tsup.config.ts
@@ -9,6 +9,7 @@ export default defineConfig({
   sourcemap: true,
   clean: true,
   external: ['react', 'react-dom'],
+  noExternal: ['prismjs'],
   outExtension({ format }) {
     return {
       js: format === 'cjs' ? '.js' : '.mjs',
diff --git a/packages/icons/CHANGELOG.md b/packages/icons/CHANGELOG.md
index b3768769..054b7bc6 100644
--- a/packages/icons/CHANGELOG.md
+++ b/packages/icons/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @stackwright/icons
 
+## 0.5.1-alpha.1
+
+### Patch Changes
+
+- c036f5b: chore: consolidate dependabot dependency updates
+  - `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+  - `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+  - `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+  - `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+  - `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
+
+## 0.5.1-alpha.0
+
+### Patch Changes
+
+- c036f5b: chore: consolidate dependabot dependency updates
+  - `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+  - `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+  - `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+  - `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+  - `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
+
 ## 0.5.0
 
 ### Minor Changes
diff --git a/packages/icons/package.json b/packages/icons/package.json
index f0789281..057f2f62 100644
--- a/packages/icons/package.json
+++ b/packages/icons/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@stackwright/icons",
-  "version": "0.5.0",
+  "version": "0.5.1-alpha.1",
   "description": "Lucide-based icon registry for Stackwright",
   "license": "MIT",
   "repository": {
diff --git a/packages/launch-stackwright/CHANGELOG.md b/packages/launch-stackwright/CHANGELOG.md
index a9c654a1..b068380a 100644
--- a/packages/launch-stackwright/CHANGELOG.md
+++ b/packages/launch-stackwright/CHANGELOG.md
@@ -1,5 +1,14 @@
 # launch-stackwright
 
+## 0.2.2-alpha.0
+
+### Patch Changes
+
+- Updated dependencies [f0b74ef]
+- Updated dependencies [90a22c6]
+- Updated dependencies [a410f02]
+  - @stackwright/cli@0.8.2-alpha.0
+
 ## 0.2.1
 
 ### Patch Changes
diff --git a/packages/launch-stackwright/package.json b/packages/launch-stackwright/package.json
index 58f6e977..a785e5f4 100644
--- a/packages/launch-stackwright/package.json
+++ b/packages/launch-stackwright/package.json
@@ -1,6 +1,6 @@
 {
   "name": "launch-stackwright",
-  "version": "0.2.1",
+  "version": "0.2.2-alpha.0",
   "description": "Launch a new Stackwright project with the otter raft ready to build",
   "license": "MIT",
   "repository": {
diff --git a/packages/maplibre/CHANGELOG.md b/packages/maplibre/CHANGELOG.md
index bdeb6ebb..ed5deaf2 100644
--- a/packages/maplibre/CHANGELOG.md
+++ b/packages/maplibre/CHANGELOG.md
@@ -1,5 +1,42 @@
 # @stackwright/maplibre
 
+## 2.0.1-alpha.2
+
+### Patch Changes
+
+- Updated dependencies [fb3393e]
+  - @stackwright/core@0.8.1-alpha.2
+
+## 2.0.1-alpha.1
+
+### Patch Changes
+
+- c036f5b: chore: consolidate dependabot dependency updates
+  - `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+  - `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+  - `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+  - `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+  - `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
+
+- Updated dependencies [c036f5b]
+- Updated dependencies [5ad5035]
+  - @stackwright/core@0.8.1-alpha.1
+
+## 2.0.1-alpha.0
+
+### Patch Changes
+
+- c036f5b: chore: consolidate dependabot dependency updates
+  - `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+  - `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+  - `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+  - `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+  - `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
+
+- Updated dependencies [c036f5b]
+- Updated dependencies [5ad5035]
+  - @stackwright/core@0.8.1-alpha.0
+
 ## 2.0.0
 
 ### Minor Changes
diff --git a/packages/maplibre/package.json b/packages/maplibre/package.json
index a35b0b63..2f7d813c 100644
--- a/packages/maplibre/package.json
+++ b/packages/maplibre/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@stackwright/maplibre",
-  "version": "2.0.0",
+  "version": "2.0.1-alpha.2",
   "description": "MapLibre GL adapter for Stackwright maps (free tier, no API keys required)",
   "license": "MIT",
   "repository": {
diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
index ca072e23..ea0d518a 100644
--- a/packages/mcp/CHANGELOG.md
+++ b/packages/mcp/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @stackwright/mcp
 
+## 0.4.2-alpha.0
+
+### Patch Changes
+
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [f0b74ef]
+- Updated dependencies [90a22c6]
+- Updated dependencies [68bdad5]
+- Updated dependencies [a410f02]
+  - @stackwright/types@1.3.0-alpha.1
+  - @stackwright/cli@0.8.2-alpha.0
+
 ## 0.4.1
 
 ### Patch Changes
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
index 57d610a4..df164e92 100644
--- a/packages/mcp/package.json
+++ b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@stackwright/mcp",
-    "version": "0.4.1",
+    "version": "0.4.2-alpha.0",
     "description": "MCP server for Stackwright — exposes content types, page management, and validation as agent tools",
     "license": "MIT",
     "repository": {
diff --git a/packages/nextjs/CHANGELOG.md b/packages/nextjs/CHANGELOG.md
index 2d983d40..838d5e32 100644
--- a/packages/nextjs/CHANGELOG.md
+++ b/packages/nextjs/CHANGELOG.md
@@ -1,5 +1,56 @@
 # @stackwright/nextjs
 
+## 0.5.0-alpha.2
+
+### Patch Changes
+
+- Updated dependencies [fb3393e]
+  - @stackwright/core@0.8.1-alpha.2
+
+## 0.5.0-alpha.1
+
+### Minor Changes
+
+- 6326d49: Add security headers (CSP, HSTS, COOP/CORP/COEP) to Next.js integration with customizable configuration
+
+### Patch Changes
+
+- c036f5b: chore: consolidate dependabot dependency updates
+  - `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+  - `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+  - `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+  - `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+  - `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
+
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [c036f5b]
+- Updated dependencies [68bdad5]
+- Updated dependencies [5ad5035]
+  - @stackwright/types@1.3.0-alpha.1
+  - @stackwright/core@0.8.1-alpha.1
+
+## 0.5.0-alpha.0
+
+### Minor Changes
+
+- 6326d49: Add security headers (CSP, HSTS, COOP/CORP/COEP) to Next.js integration with customizable configuration
+
+### Patch Changes
+
+- c036f5b: chore: consolidate dependabot dependency updates
+  - `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+  - `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+  - `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+  - `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+  - `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
+
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [c036f5b]
+- Updated dependencies [68bdad5]
+- Updated dependencies [5ad5035]
+  - @stackwright/types@1.3.0-alpha.0
+  - @stackwright/core@0.8.1-alpha.0
+
 ## 0.4.0
 
 ### Minor Changes
diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json
index 2819cf1b..10e9ec10 100644
--- a/packages/nextjs/package.json
+++ b/packages/nextjs/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@stackwright/nextjs",
-    "version": "0.4.0",
+    "version": "0.5.0-alpha.2",
     "description": "Next.js implementations for Stackwright components",
     "license": "MIT",
     "repository": {
diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md
index b3b9c907..0b4cb34f 100644
--- a/packages/types/CHANGELOG.md
+++ b/packages/types/CHANGELOG.md
@@ -1,5 +1,29 @@
 # @stackwright/types
 
+## 1.3.0-alpha.1
+
+### Minor Changes
+
+- bdf7fe0: Add `contentItemSchemas` and `knownContentTypeKeys` to `PrebuildPlugin` interface.
+  Add `buildExtendedPageContentSchema()` function for merging OSS and plugin content schemas.
+  Add `ValidatePageContentOptions` to `validatePageContent()` for plugin-aware validation.
+
+### Patch Changes
+
+- 68bdad5: Add configSchema field to PrebuildPlugin for plugin config validation
+
+## 1.3.0-alpha.0
+
+### Minor Changes
+
+- bdf7fe0: Add `contentItemSchemas` and `knownContentTypeKeys` to `PrebuildPlugin` interface.
+  Add `buildExtendedPageContentSchema()` function for merging OSS and plugin content schemas.
+  Add `ValidatePageContentOptions` to `validatePageContent()` for plugin-aware validation.
+
+### Patch Changes
+
+- 68bdad5: Add configSchema field to PrebuildPlugin for plugin config validation
+
 ## 1.2.0
 
 ### Minor Changes
diff --git a/packages/types/package.json b/packages/types/package.json
index e5a642cc..96e43192 100644
--- a/packages/types/package.json
+++ b/packages/types/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@stackwright/types",
-    "version": "1.2.0",
+    "version": "1.3.0-alpha.1",
     "description": "TypeScript types and JSON schemas for Stackwright",
     "license": "MIT",
     "repository": {
diff --git a/packages/ui-shadcn/CHANGELOG.md b/packages/ui-shadcn/CHANGELOG.md
index c5d780a7..8449e73f 100644
--- a/packages/ui-shadcn/CHANGELOG.md
+++ b/packages/ui-shadcn/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @stackwright/ui-shadcn
 
+## 0.1.2-alpha.1
+
+### Patch Changes
+
+- c036f5b: chore: consolidate dependabot dependency updates
+  - `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+  - `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+  - `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+  - `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+  - `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
+
+## 0.1.2-alpha.0
+
+### Patch Changes
+
+- c036f5b: chore: consolidate dependabot dependency updates
+  - `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+  - `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+  - `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+  - `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+  - `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/packages/ui-shadcn/package.json b/packages/ui-shadcn/package.json
index 5dc258bd..be1264c2 100644
--- a/packages/ui-shadcn/package.json
+++ b/packages/ui-shadcn/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@stackwright/ui-shadcn",
-  "version": "0.1.1",
+  "version": "0.1.2-alpha.1",
   "description": "shadcn/ui + Tailwind CSS UI adapter for Stackwright",
   "license": "MIT",
   "repository": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index cc0e1060..8047d9e4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -31,6 +31,7 @@ overrides:
   '@hono/node-server': '>=1.19.10'
   basic-ftp: '>=5.3.0'
   express-rate-limit: '>=8.2.2'
+  uuid: '>=14.0.0'
 
 importers:
 
@@ -286,8 +287,8 @@ importers:
         specifier: ^1.30.0
         version: 1.30.0
       uuid:
-        specifier: ^13.0.0
-        version: 13.0.0
+        specifier: '>=14.0.0'
+        version: 14.0.0
       zod:
         specifier: ^4.3.6
         version: 4.3.6
@@ -5831,8 +5832,8 @@ packages:
   uri-js@4.4.1:
     resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
 
-  uuid@13.0.0:
-    resolution: {integrity: sha512-XQegIaBTVUjSHliKqcnFqYypAd4S+WCYt5NIeRs6w/UAry7z8Y9j5ZwRRL4kzq9U3sD6v+85er9FvkEaBpji2w==}
+  uuid@14.0.0:
+    resolution: {integrity: sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==}
     hasBin: true
 
   vary@1.1.2:
@@ -11443,7 +11444,7 @@ snapshots:
     dependencies:
       punycode: 2.3.1
 
-  uuid@13.0.0: {}
+  uuid@14.0.0: {}
 
   vary@1.1.2: {}