release: promote dev to stable

.changeset/add-plugin-content-schema-extension.md

@@ -0,0 +1,7 @@
+---
+"@stackwright/types": minor
+---
+
+Add `contentItemSchemas` and `knownContentTypeKeys` to `PrebuildPlugin` interface.
+Add `buildExtendedPageContentSchema()` function for merging OSS and plugin content schemas.
+Add `ValidatePageContentOptions` to `validatePageContent()` for plugin-aware validation.

.changeset/add-pro-content-normalization.md

@@ -0,0 +1,6 @@
+---
+"@stackwright/build-scripts": minor
+---
+
+Add content format normalization (mapping-key YAML format → type-field format) to prebuild pipeline.
+Plugin `contentItemSchemas` and `knownContentTypeKeys` are now applied during page validation.

.changeset/dependabot-batch-updates.md

@@ -0,0 +1,15 @@
+---
+"@stackwright/core": patch
+"@stackwright/icons": patch
+"@stackwright/maplibre": patch
+"@stackwright/nextjs": patch
+"@stackwright/ui-shadcn": patch
+---
+
+chore: consolidate dependabot dependency updates
+
+- `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+- `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+- `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+- `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+- `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)

.changeset/feat-188-page-add-content-flag.md

@@ -0,0 +1,7 @@
+---
+"@stackwright/cli": patch
+---
+
+feat(cli): add --content flag to `page add` for inline YAML (#188)
+
+Agents can now create a page with full content in a single command instead of a two-step add + write sequence. Content is validated before writing; invalid YAML is rejected with field-level errors.

.changeset/feat-243-security-headers.md

@@ -0,0 +1,5 @@
+---
+"@stackwright/nextjs": minor
+---
+
+Add security headers (CSP, HSTS, COOP/CORP/COEP) to Next.js integration with customizable configuration

.changeset/fix-352-install-flag-actually-installs.md

@@ -0,0 +1,5 @@
+---
+"@stackwright/cli": patch
+---
+
+fix(cli): --install flag now runs pnpm install before postInstall hooks

.changeset/fix-plugin-config-schema-242.md

@@ -0,0 +1,6 @@
+---
+"@stackwright/types": patch
+"@stackwright/build-scripts": patch
+---
+
+Add configSchema field to PrebuildPlugin for plugin config validation

.changeset/fix-plugin-this-binding.md

@@ -0,0 +1,14 @@
+---
+"@stackwright/build-scripts": patch
+---
+
+fix(executePluginHook): preserve `this` binding when calling plugin lifecycle hooks
+
+`executePluginHook` was extracting hook methods as unbound references
+(`const hookFn = plugin[hook]`) and calling them as plain functions
+(`hookFn(context)`). In strict-mode ES classes, this strips `this`,
+causing any plugin that calls a private/instance method from `beforeBuild`
+or `afterBuild` to throw `Cannot read properties of undefined`.
+
+Fix: use `hookFn.call(plugin, context)` so the plugin instance is always
+the receiver.

.changeset/fix-preinstall-double-run.md

@@ -0,0 +1,18 @@
+---
+"@stackwright/cli": patch
+---
+
+fix(cli): remove duplicate preInstall hook call from processTemplate
+
+`processTemplate()` was calling `runScaffoldHooks('preInstall', ...)` internally,
+then `scaffold.ts` called it again after `processTemplate` returned — running every
+preInstall handler twice. Worse, the second call passed the original empty `{}` object
+(not the built package.json), so hooks registered via `scaffold.ts` could never affect
+the written file.
+
+Fix: lifecycle orchestration now lives entirely in `scaffold.ts`. `buildPackageJson` is
+exported so `scaffold.ts` can build the default package.json before running preInstall
+hooks, then passes the already-hooks-modified object into `processTemplate` for writing.
+`processTemplate` no longer calls hooks.
+
+Fixes #351.

.changeset/fix-prismjs-esm-bundle.md

@@ -0,0 +1,15 @@
+---
+"@stackwright/core": patch
+---
+
+fix(core): bundle prismjs to eliminate bare ESM sub-path imports
+
+`@stackwright/core`'s published ESM bundle contained bare imports such as
+`import 'prismjs/components/prism-javascript'` (no `.js` extension). Because
+`prismjs` is a legacy CJS package with no `exports` map, Node.js ESM strict
+resolver could not find these paths and threw `ERR_MODULE_NOT_FOUND`.
+
+Added `noExternal: ['prismjs']` to `tsup.config.ts` so that esbuild bundles
+prismjs inline at build time. All language grammar paths are resolved to real
+`.js` files before the bundle is published — no bare specifiers escape into
+the output.

.changeset/grumpy-paws-create.md

@@ -0,0 +1,5 @@
+---
+"@stackwright/core": patch
+---
+
+fix(core): prevent duplicate TopAppBar rendering that caused a double dark-mode toggle icon

.changeset/pre.json

@@ -0,0 +1,37 @@
+{
+  "mode": "pre",
+  "tag": "alpha",
+  "initialVersions": {
+    "stackwright-docs": "0.1.2",
+    "@stackwright/build-scripts": "0.5.1",
+    "@stackwright/cli": "0.8.1",
+    "@stackwright/collections": "0.1.0",
+    "@stackwright/core": "0.8.0",
+    "@stackwright/e2e": "0.3.0",
+    "@stackwright/hooks-registry": "0.1.0",
+    "@stackwright/icons": "0.5.0",
+    "launch-stackwright": "0.2.1",
+    "@stackwright/maplibre": "2.0.0",
+    "@stackwright/mcp": "0.4.1",
+    "@stackwright/nextjs": "0.4.0",
+    "@stackwright/otters": "0.2.0",
+    "@stackwright/sbom-generator": "0.2.0",
+    "@stackwright/scaffold-core": "0.3.0",
+    "@stackwright/themes": "0.5.2",
+    "@stackwright/types": "1.2.0",
+    "@stackwright/ui-shadcn": "0.1.1"
+  },
+  "changesets": [
+    "add-plugin-content-schema-extension",
+    "add-pro-content-normalization",
+    "dependabot-batch-updates",
+    "feat-188-page-add-content-flag",
+    "feat-243-security-headers",
+    "fix-352-install-flag-actually-installs",
+    "fix-plugin-config-schema-242",
+    "fix-plugin-this-binding",
+    "fix-preinstall-double-run",
+    "fix-prismjs-esm-bundle",
+    "grumpy-paws-create"
+  ]
+}

.github/workflows/release.yml

@@ -4,11 +4,6 @@ on:
   push:
     branches:
       - main
-  pull_request:
-    branches:
-      - main
-    types:
-      - closed
 
 permissions:
   contents: write
@@ -21,7 +16,7 @@ jobs:
     # Squash merges embed individual commit messages in the body, and automated
     # commits (prerelease bumps, etc.) include [skip ci] — which would incorrectly
     # suppress the release workflow if we used contains() on the full body.
-    if: "${{ !startsWith(github.event.head_commit.message, 'chore: version packages for release [skip ci]') }}"
+    if: "${{ github.event_name == 'push' && !startsWith(github.event.head_commit.message, 'chore: version packages for release [skip ci]') }}"
     steps:
       - name: Generate PerAsperaCI token
         id: app-token
@@ -42,7 +37,6 @@ jobs:
           node-version: 22
           registry-url: 'https://registry.npmjs.org'
           cache: 'pnpm'
-          provenance: true
 
       - run: pnpm install --frozen-lockfile
 

examples/stackwright-docs/CHANGELOG.md

@@ -1,5 +1,37 @@
 # stackwright-docs
 
+## 0.1.3-alpha.2
+
+### Patch Changes
+
+- Updated dependencies [fb3393e]
+  - @stackwright/core@0.8.1-alpha.2
+  - @stackwright/nextjs@0.5.0-alpha.2
+
+## 0.1.3-alpha.1
+
+### Patch Changes
+
+- Updated dependencies [c036f5b]
+- Updated dependencies [6326d49]
+- Updated dependencies [5ad5035]
+  - @stackwright/core@0.8.1-alpha.1
+  - @stackwright/icons@0.5.1-alpha.1
+  - @stackwright/nextjs@0.5.0-alpha.1
+  - @stackwright/ui-shadcn@0.1.2-alpha.1
+
+## 0.1.3-alpha.0
+
+### Patch Changes
+
+- Updated dependencies [c036f5b]
+- Updated dependencies [6326d49]
+- Updated dependencies [5ad5035]
+  - @stackwright/core@0.8.1-alpha.0
+  - @stackwright/icons@0.5.1-alpha.0
+  - @stackwright/nextjs@0.5.0-alpha.0
+  - @stackwright/ui-shadcn@0.1.2-alpha.0
+
 ## 0.1.2
 
 ### Patch Changes

examples/stackwright-docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stackwright-docs",
-  "version": "0.1.2",
+  "version": "0.1.3-alpha.2",
   "private": true,
   "scripts": {
     "prebuild": "stackwright-prebuild",

package.json

@@ -91,7 +91,8 @@
             "hono": ">=4.12.14",
             "@hono/node-server": ">=1.19.10",
             "basic-ftp": ">=5.3.0",
-            "express-rate-limit": ">=8.2.2"
+            "express-rate-limit": ">=8.2.2",
+	    "uuid": ">=14.0.0"
         },
         "onlyBuiltDependencies": [
             "@swc/core",
@@ -114,4 +115,4 @@
             "@commitlint/config-conventional"
         ]
     }
-}
+}

packages/build-scripts/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @stackwright/build-scripts
 
+## 0.6.0-alpha.0
+
+### Minor Changes
+
+- bdf7fe0: Add content format normalization (mapping-key YAML format → type-field format) to prebuild pipeline.
+  Plugin `contentItemSchemas` and `knownContentTypeKeys` are now applied during page validation.
+
+### Patch Changes
+
+- 68bdad5: Add configSchema field to PrebuildPlugin for plugin config validation
+- 83ba70c: fix(executePluginHook): preserve `this` binding when calling plugin lifecycle hooks
+
+  `executePluginHook` was extracting hook methods as unbound references
+  (`const hookFn = plugin[hook]`) and calling them as plain functions
+  (`hookFn(context)`). In strict-mode ES classes, this strips `this`,
+  causing any plugin that calls a private/instance method from `beforeBuild`
+  or `afterBuild` to throw `Cannot read properties of undefined`.
+
+  Fix: use `hookFn.call(plugin, context)` so the plugin instance is always
+  the receiver.
+
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [68bdad5]
+  - @stackwright/types@1.3.0-alpha.1
+
 ## 0.5.1
 
 ### Patch Changes

packages/build-scripts/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stackwright/build-scripts",
-    "version": "0.5.1",
+    "version": "0.6.0-alpha.0",
     "description": "Build-time scripts for Stackwright projects (prebuild image processing, YAML compilation)",
     "license": "MIT",
     "repository": {

packages/cli/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @stackwright/cli
 
+## 0.8.2-alpha.0
+
+### Patch Changes
+
+- f0b74ef: feat(cli): add --content flag to `page add` for inline YAML (#188)
+
+  Agents can now create a page with full content in a single command instead of a two-step add + write sequence. Content is validated before writing; invalid YAML is rejected with field-level errors.
+
+- 90a22c6: fix(cli): --install flag now runs pnpm install before postInstall hooks
+- a410f02: fix(cli): remove duplicate preInstall hook call from processTemplate
+
+  `processTemplate()` was calling `runScaffoldHooks('preInstall', ...)` internally,
+  then `scaffold.ts` called it again after `processTemplate` returned — running every
+  preInstall handler twice. Worse, the second call passed the original empty `{}` object
+  (not the built package.json), so hooks registered via `scaffold.ts` could never affect
+  the written file.
+
+  Fix: lifecycle orchestration now lives entirely in `scaffold.ts`. `buildPackageJson` is
+  exported so `scaffold.ts` can build the default package.json before running preInstall
+  hooks, then passes the already-hooks-modified object into `processTemplate` for writing.
+  `processTemplate` no longer calls hooks.
+
+  Fixes #351.
+
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [68bdad5]
+- Updated dependencies [83ba70c]
+  - @stackwright/types@1.3.0-alpha.1
+  - @stackwright/build-scripts@0.6.0-alpha.0
+
 ## 0.8.1
 
 ### Patch Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackwright/cli",
-  "version": "0.8.1",
+  "version": "0.8.2-alpha.0",
   "description": "CLI for Stackwright framework",
   "license": "MIT",
   "repository": {

packages/core/CHANGELOG.md

@@ -1,5 +1,53 @@
 # @stackwright/core
 
+## 0.8.1-alpha.2
+
+### Patch Changes
+
+- fb3393e: fix(core): bundle prismjs to eliminate bare ESM sub-path imports
+
+  `@stackwright/core`'s published ESM bundle contained bare imports such as
+  `import 'prismjs/components/prism-javascript'` (no `.js` extension). Because
+  `prismjs` is a legacy CJS package with no `exports` map, Node.js ESM strict
+  resolver could not find these paths and threw `ERR_MODULE_NOT_FOUND`.
+
+  Added `noExternal: ['prismjs']` to `tsup.config.ts` so that esbuild bundles
+  prismjs inline at build time. All language grammar paths are resolved to real
+  `.js` files before the bundle is published — no bare specifiers escape into
+  the output.
+
+## 0.8.1-alpha.1
+
+### Patch Changes
+
+- c036f5b: chore: consolidate dependabot dependency updates
+  - `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+  - `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+  - `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+  - `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+  - `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
+
+- 5ad5035: fix(core): prevent duplicate TopAppBar rendering that caused a double dark-mode toggle icon
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [68bdad5]
+  - @stackwright/types@1.3.0-alpha.1
+
+## 0.8.1-alpha.0
+
+### Patch Changes
+
+- c036f5b: chore: consolidate dependabot dependency updates
+  - `lucide-react`: `^0.525.0` → `^1.8.0` (icons, ui-shadcn) — includes icon rename fixes for v1 API (`CheckCircle` → `CircleCheck`, `Code2`/`Layout` backward-compat aliases)
+  - `@swc/core`: `^1.15.18` → `^1.15.26` (core, nextjs)
+  - `jsdom`: `^28.1.0` → `^29.0.2` (maplibre)
+  - `react-dom`: `19.2.4` → `19.2.5` (pnpm.overrides)
+  - `prettier`: `^3.8.1` → `^3.8.3` (devDependencies)
+
+- 5ad5035: fix(core): prevent duplicate TopAppBar rendering that caused a double dark-mode toggle icon
+- Updated dependencies [bdf7fe0]
+- Updated dependencies [68bdad5]
+  - @stackwright/types@1.3.0-alpha.0
+
 ## 0.8.0
 
 ### Minor Changes

packages/core/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stackwright/core",
-    "version": "0.8.0",
+    "version": "0.8.1-alpha.2",
     "description": "Core framework for building applications from YAML configuration",
     "license": "MIT",
     "repository": {