fix(gatekeeper): enhance logging and stabilize upstream polling

.changeset/init-mail-package.md

@@ -1,5 +0,0 @@
----
-"@mintel/mail": minor
----
-
-Initial release of the branded email system package.

.changeset/resilient-build-scripts.md

@@ -0,0 +1,7 @@
+---
+"@mintel/monorepo": patch
+"acquisition-manager": patch
+"feedback-commander": patch
+---
+
+fix: make directus extension build scripts more resilient

.dockerignore

@@ -1,7 +1,7 @@
 node_modules
 .next
 .git
-.npmrc
+# .npmrc is allowed as it contains the registry template
 dist
 build
 out

.env.example

@@ -1,4 +1,5 @@
 # Project
+IMAGE_TAG=v1.7.10
 PROJECT_NAME=sample-website
 PROJECT_COLOR=#82ed20
 

.gitea/workflows/maintenance.yml

@@ -0,0 +1,44 @@
+name: 🏥 Server Maintenance
+
+on:
+  schedule:
+    - cron: '0 3 * * *' # Every day at 3:00 AM
+  workflow_dispatch: # Allow manual trigger
+
+jobs:
+  maintenance:
+    name: 🧹 Prune & Clean
+    runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: 🚀 Execute Maintenance via SSH
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+
+          # Run the prune script on the host
+          # We transfer the script and execute it to ensure it matches the repo version
+          scp packages/infra/scripts/prune-registry.sh root@${{ secrets.SSH_HOST }}:/tmp/prune-registry.sh
+          ssh root@${{ secrets.SSH_HOST }} "bash /tmp/prune-registry.sh && rm /tmp/prune-registry.sh"
+
+      - name: 🔔 Notification - Success
+        if: success()
+        run: |
+          curl -s -k -X POST "${{ secrets.GOTIFY_URL }}/message?token=${{ secrets.GOTIFY_TOKEN }}" \
+            -F "title=🏥 Maintenance Complete" \
+            -F "message=Server-Wartung erfolgreich ausgeführt.\nRegistry & Docker Ressourcen bereinigt." \
+            -F "priority=2" || true
+
+      - name: 🔔 Notification - Failure
+        if: failure()
+        run: |
+          curl -s -k -X POST "${{ secrets.GOTIFY_URL }}/message?token=${{ secrets.GOTIFY_TOKEN }}" \
+            -F "title=❌ Maintenance FAILED" \
+            -F "message=Die automatische Server-Wartung ist fehlgeschlagen!\nBitte Logs prüfen." \
+            -F "priority=8" || true

.gitea/workflows/pipeline.yml

@@ -2,6 +2,8 @@ name: Monorepo Pipeline
 
 on:
   push:
+    branches:
+      - '**'
     tags:
       - 'v*'
 
@@ -10,43 +12,124 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  qa:
-    name: 🧪 Quality Assurance
+  prioritize:
+    name: ⚡ Prioritize Release
     runs-on: docker
     container:
       image: catthehacker/ubuntu:act-latest
+    steps:
+      - name: 🛑 Cancel Redundant Runs
+        env:
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+          REF: ${{ github.ref }}
+          REF_NAME: ${{ github.ref_name }}
+          EVENT: ${{ github.event_name }}
+        run: |
+          echo "🔎 Debug: Event=$EVENT, Ref=$REF, RefName=$REF_NAME, RunId=$RUN_ID"
+          
+          case "$REF" in
+            refs/tags/v*)
+              echo "🚀 Release detected ($REF_NAME). Cancelling non-tag runs..."
+              
+              # Fetch all runs
+              RUNS=$(curl -s -H "Authorization: token $GITEA_TOKEN" "https://git.infra.mintel.me/api/v1/repos/$REPO/actions/runs")
+              
+              # Identify runs to cancel: in_progress/queued, NOT this run, and NOT a tag run
+              echo "$RUNS" | jq -c '.workflow_runs[] | select(.status == "in_progress" or .status == "queued") | select(.id | tostring != "'$RUN_ID'")' | while read -r run; do
+                ID=$(echo "$run" | jq -r '.id')
+                RUN_REF=$(echo "$run" | jq -r '.ref')
+                TITLE=$(echo "$run" | jq -r '.display_title')
+                
+                case "$RUN_REF" in
+                  refs/tags/v*)
+                    echo "⏭️ Skipping parallel release run $ID ($TITLE) on $RUN_REF"
+                    ;;
+                  *)
+                    echo "🛑 Cancelling redundant branch run $ID ($TITLE) on $RUN_REF..."
+                    curl -X POST -s -H "Authorization: token $GITEA_TOKEN" "https://git.infra.mintel.me/api/v1/repos/$REPO/actions/runs/$ID/cancel"
+                    ;;
+                esac
+              done
+              ;;
+            *)
+              echo "ℹ️ Regular push. No prioritization needed."
+              ;;
+          esac
+
+  lint:
+    name: 🧹 Lint
+    needs: prioritize
+    if: always() && !cancelled() && (needs.prioritize.result == 'success' || needs.prioritize.result == 'skipped')
+    runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
+    env:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
           node_version: 20
-          cache: 'pnpm'
-
+      - name: Enable pnpm
+        run: corepack enable && corepack prepare pnpm@10.2.0 --activate
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-
+        run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts --no-color
       - name: Lint
         run: pnpm lint
 
+  test:
+    name: 🧪 Test
+    needs: prioritize
+    if: always() && !cancelled() && (needs.prioritize.result == 'success' || needs.prioritize.result == 'skipped')
+    runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
+    env:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node_version: 20
+      - name: Enable pnpm
+        run: corepack enable && corepack prepare pnpm@10.2.0 --activate
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts --no-color
       - name: Test
         run: pnpm test
 
+  build:
+    name: 🏗️ Build
+    needs: prioritize
+    if: always() && !cancelled() && (needs.prioritize.result == 'success' || needs.prioritize.result == 'skipped')
+    runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
+    env:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node_version: 20
+      - name: Enable pnpm
+        run: corepack enable && corepack prepare pnpm@10.2.0 --activate
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts --no-color
       - name: Build
         run: pnpm build
 
   release:
     name: 🚀 Release
-    needs: qa
+    needs: [lint, test, build]
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: docker
     container:
@@ -59,30 +142,24 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
           node_version: 20
-          cache: 'pnpm'
-
+      - name: Enable pnpm
+        run: corepack enable && corepack prepare pnpm@10.2.0 --activate
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
+        run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts --no-color
+      - name: 🏷️ Sync Versions (if Tagged)
+        run: pnpm sync-versions
       - name: 🏷️ Release Packages (Tag-Driven)
         run: |
           echo "🏷️ Tag detected [${{ github.ref_name }}], performing sync release..."
-          pnpm sync-versions
           pnpm release:tag
 
   build-images:
     name: 🐳 Build ${{ matrix.name }}
-    needs: qa
+    needs: [lint, test, build]
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: docker
     container:

.husky/pre-push

@@ -0,0 +1,16 @@
+
+# Check if we are pushing a tag
+while read local_ref local_sha remote_ref remote_sha
+do
+  if [[ "$remote_ref" == refs/tags/v* ]]; then
+    TAG=${remote_ref#refs/tags/}
+    echo "🏷️ Tag detected: $TAG, syncing versions..."
+    pnpm sync-versions "$TAG"
+    
+    # Stage the changed files (excluding ignored files like .env)
+    git add package.json packages/*/package.json apps/*/package.json .env.example
+    
+    echo "⚠️ package.json and .env files updated to match tag $TAG."
+    echo "⚠️ Note: You might need to push again if these changes were not already in your commit/tag."
+  fi
+done

Dockerfile.template

@@ -0,0 +1,56 @@
+# Stage 1: Builder
+FROM registry.infra.mintel.me/mintel/nextjs:latest AS builder
+WORKDIR /app
+
+# Clean the workspace in case the base image is dirty
+RUN rm -rf ./*
+
+# Arguments for build-time configuration
+ARG NEXT_PUBLIC_BASE_URL
+ARG NEXT_PUBLIC_TARGET
+ARG DIRECTUS_URL
+ARG NPM_TOKEN
+
+# Environment variables for Next.js build
+ENV NEXT_PUBLIC_BASE_URL=$NEXT_PUBLIC_BASE_URL
+ENV NEXT_PUBLIC_TARGET=$NEXT_PUBLIC_TARGET
+ENV DIRECTUS_URL=$DIRECTUS_URL
+ENV SKIP_RUNTIME_ENV_VALIDATION=true
+ENV CI=true
+
+# Enable pnpm
+RUN corepack enable
+
+# Copy lockfile and manifest for dependency installation caching
+COPY pnpm-lock.yaml package.json .npmrc* ./
+
+# Install dependencies with cache mount
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
+    --mount=type=secret,id=NPM_TOKEN \
+    export NPM_TOKEN=$(cat /run/secrets/NPM_TOKEN 2>/dev/null || echo $NPM_TOKEN) && \
+    pnpm install --frozen-lockfile
+
+# Copy source code
+COPY . .
+
+# Build application
+RUN pnpm build
+
+# Stage 2: Runner
+FROM registry.infra.mintel.me/mintel/runtime:latest AS runner
+WORKDIR /app
+
+ENV HOSTNAME="0.0.0.0"
+ENV PORT=3000
+ENV NODE_ENV=production
+
+# Copy standalone output and static files
+# Adjust paths if using a monorepo structure (e.g., /app/apps/web/public)
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/.next/cache ./.next/cache
+
+USER nextjs
+
+CMD ["node", "server.js"]

apps/sample-website/eslint.config.mjs

@@ -1,3 +0,0 @@
-import { nextConfig } from "@mintel/eslint-config/next";
-
-export default nextConfig;

apps/sample-website/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sample-website",
-  "version": "0.1.1",
+  "version": "1.7.10",
   "private": true,
   "type": "module",
   "scripts": {
@@ -8,15 +8,9 @@
     "dev:local": "mintel dev --local",
     "build": "next build",
     "start": "next start",
-    "lint": "next lint",
+    "lint": "eslint src/",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests",
-    "cms:bootstrap": "mintel directus bootstrap",
-    "cms:push:testing": "mintel directus sync push testing",
-    "cms:pull:testing": "mintel directus sync pull testing",
-    "cms:push:staging": "mintel directus sync push staging",
-    "cms:pull:staging": "mintel directus sync pull staging",
-    "cms:push:prod": "mintel directus sync push production",
     "cms:pull:prod": "mintel directus sync pull production",
     "pagespeed:test": "mintel pagespeed"
   },
@@ -24,8 +18,8 @@
     "@mintel/next-utils": "workspace:*",
     "@mintel/observability": "workspace:*",
     "@mintel/next-observability": "workspace:*",
-    "@sentry/nextjs": "^8.55.0",
-    "next": "15.1.6",
+    "@sentry/nextjs": "10.38.0",
+    "next": "16.1.6",
     "next-intl": "^4.8.2",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"

directus/schema/snapshot.yaml

@@ -0,0 +1,19 @@
+version: 1
+directus: 11.15.1
+vendor: postgres
+collections: []
+fields: []
+systemFields:
+  - collection: directus_activity
+    field: timestamp
+    schema:
+      is_indexed: true
+  - collection: directus_revisions
+    field: activity
+    schema:
+      is_indexed: true
+  - collection: directus_revisions
+    field: parent
+    schema:
+      is_indexed: true
+relations: []

docker-compose.yml

@@ -1,17 +1,18 @@
 services:
   app:
     build:
-      context: .
+      context: ./apps/sample-website
       dockerfile: Dockerfile
       args:
         NEXT_PUBLIC_BASE_URL: ${NEXT_PUBLIC_BASE_URL:-http://localhost:3000}
         NEXT_PUBLIC_UMAMI_WEBSITE_ID: ${NEXT_PUBLIC_UMAMI_WEBSITE_ID}
         NEXT_PUBLIC_UMAMI_SCRIPT_URL: ${NEXT_PUBLIC_UMAMI_SCRIPT_URL}
         NEXT_PUBLIC_TARGET: ${TARGET:-development}
-      DIRECTUS_URL: ${DIRECTUS_URL:-http://directus:8055}
     restart: always
     networks:
       - infra
+    environment:
+      - DIRECTUS_URL=${DIRECTUS_URL:-http://directus:8055}
     env_file:
       - .env
     ports:
@@ -22,7 +23,7 @@ services:
       - "traefik.http.services.sample-website.loadbalancer.server.port=3000"
 
   directus:
-    image: registry.infra.mintel.me/mintel/directus:latest
+    image: registry.infra.mintel.me/mintel/directus:${IMAGE_TAG:-latest}
     restart: always
     networks:
       - infra
@@ -46,6 +47,7 @@ services:
     volumes:
       - ./directus/uploads:/directus/uploads
       - ./directus/extensions:/directus/extensions
+      - ./directus/schema:/directus/schema
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.sample-website-directus.rule=Host(`${DIRECTUS_HOST:-cms.sample-website.localhost}`)"

eslint.config.js

@@ -8,6 +8,10 @@ export default [
       "packages/customer-manager/index.js",
       "**/*.db",
       "**/build/**",
+      "**/data/**",
+      "**/reference/**",
+      "**/dist/**",
+      "**/.next/**",
     ],
   },
   ...baseConfig,

package.json

@@ -5,11 +5,17 @@
   "scripts": {
     "build": "pnpm -r build",
     "dev": "pnpm -r dev",
-    "lint": "pnpm -r lint",
+    "lint": "pnpm -r --filter='./packages/**' --filter='./apps/**' lint",
     "test": "pnpm -r test",
     "changeset": "changeset",
     "version-packages": "changeset version",
-    "sync-versions": "tsx scripts/sync-versions.ts",
+    "sync-versions": "tsx scripts/sync-versions.ts --",
+    "cms:push:infra": "./scripts/sync-directus.sh push infra",
+    "cms:pull:infra": "./scripts/sync-directus.sh pull infra",
+    "cms:schema:snapshot": "./scripts/cms-snapshot.sh",
+    "cms:schema:apply": "./scripts/cms-apply.sh local",
+    "cms:schema:apply:infra": "./scripts/cms-apply.sh infra",
+    "dev:infra": "docker-compose up -d directus directus-db",
     "release": "pnpm build && changeset publish",
     "release:tag": "pnpm build && pnpm -r publish --no-git-checks --access public",
     "prepare": "husky"
@@ -27,7 +33,7 @@
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.1.2",
     "eslint": "^9.39.2",
-    "eslint-plugin-next": "^0.0.0",
+    "@next/eslint-plugin-next": "16.1.6",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^7.0.1",
     "happy-dom": "^20.4.0",
@@ -45,5 +51,12 @@
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
     "require-in-the-middle": "^8.0.1"
+  },
+  "version": "1.7.10",
+  "pnpm": {
+    "overrides": {
+      "next": "16.1.6",
+      "@sentry/nextjs": "10.38.0"
+    }
   }
 }

packages/acquisition-manager/index.js

@@ -0,0 +1 @@
+import{defineModule as e}from"@directus/extensions-sdk";import{defineComponent as t,resolveComponent as n,openBlock as a,createBlock as i,withCtx as r,createElementVNode as o}from"vue";var s=t({__name:"module",setup:e=>(e,t)=>{const s=n("private-view");return a(),i(s,{title:"Acquisition Manager"},{default:r(()=>[...t[0]||(t[0]=[o("div",{class:"acquisition-manager"},[o("h1",null,"Acquisition Manager"),o("p",null,"Modern Industrial Acquisition Management Interface")],-1)])]),_:1})}}),u=[],c=[];!function(e,t){if(e&&"undefined"!=typeof document){var n,a=!0===t.prepend?"prepend":"append",i=!0===t.singleTag,r="string"==typeof t.container?document.querySelector(t.container):document.getElementsByTagName("head")[0];if(i){var o=u.indexOf(r);-1===o&&(o=u.push(r)-1,c[o]={}),n=c[o]&&c[o][a]?c[o][a]:c[o][a]=s()}else n=s();65279===e.charCodeAt(0)&&(e=e.substring(1)),n.styleSheet?n.styleSheet.cssText+=e:n.appendChild(document.createTextNode(e))}function s(){var e=document.createElement("style");if(e.setAttribute("type","text/css"),t.attributes)for(var n=Object.keys(t.attributes),i=0;i<n.length;i++)e.setAttribute(n[i],t.attributes[n[i]]);var o="prepend"===a?"afterbegin":"beforeend";return r.insertAdjacentElement(o,e),e}}("\n.acquisition-manager[data-v-19f4e937] {\n\tpadding: 20px;\n}\n",{});var d=e({id:"acquisition-manager",name:"Acquisition Manager",icon:"account_balance_wallet",routes:[{path:"",component:((e,t)=>{const n=e.__vccOpts||e;for(const[e,a]of t)n[e]=a;return n})(s,[["__scopeId","data-v-19f4e937"],["__file","module.vue"]])}]});export{d as default};

packages/acquisition-manager/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "acquisition-manager",
+  "description": "Custom High-Fidelity Acquisition Management for Directus",
+  "icon": "account_balance_wallet",
+  "version": "1.7.10",
+  "type": "module",
+  "keywords": [
+    "directus",
+    "directus-extension",
+    "directus-extension-module"
+  ],
+  "files": [
+    "dist"
+  ],
+  "directus:extension": {
+    "type": "module",
+    "path": "index.js",
+    "source": "src/index.ts",
+    "host": "*",
+    "name": "Acquisition Manager"
+  },
+  "scripts": {
+    "build": "directus-extension build && (cp -f dist/index.js index.js 2>/dev/null || true)",
+    "dev": "directus-extension build -w"
+  },
+  "devDependencies": {
+    "@directus/extensions-sdk": "11.0.2",
+    "vue": "^3.4.0"
+  }
+}

packages/acquisition-manager/src/index.ts

@@ -0,0 +1,14 @@
+import { defineModule } from '@directus/extensions-sdk';
+import ModuleComponent from './module.vue';
+
+export default defineModule({
+    id: 'acquisition-manager',
+    name: 'Acquisition Manager',
+    icon: 'account_balance_wallet',
+    routes: [
+        {
+            path: '',
+            component: ModuleComponent,
+        },
+    ],
+});

packages/acquisition-manager/src/module.vue

@@ -0,0 +1,18 @@
+<template>
+	<private-view title="Acquisition Manager">
+		<div class="acquisition-manager">
+			<h1>Acquisition Manager</h1>
+			<p>Modern Industrial Acquisition Management Interface</p>
+		</div>
+	</private-view>
+</template>
+
+<script setup lang="ts">
+// Logic will be added here
+</script>
+
+<style scoped>
+.acquisition-manager {
+	padding: 20px;
+}
+</style>

packages/acquisition/build.js

@@ -0,0 +1,44 @@
+import { build } from 'esbuild';
+import { resolve, dirname } from 'path';
+import { mkdirSync } from 'fs';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+const entryPoint = resolve(__dirname, 'src/index.ts');
+const outfile = resolve(__dirname, 'index.js');
+
+try {
+    mkdirSync(dirname(outfile), { recursive: true });
+} catch (e) { }
+
+console.log(`Building from ${entryPoint} to ${outfile}...`);
+
+build({
+    entryPoints: [entryPoint],
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    outfile: outfile,
+    format: 'esm',
+    external: [],
+    plugins: [{
+        name: 'mock-jquery',
+        setup(build) {
+            build.onResolve({ filter: /^jquery$/ }, args => ({ path: args.path, namespace: 'mock-jquery' }));
+            build.onLoad({ filter: /.*/, namespace: 'mock-jquery' }, () => ({ contents: 'export default {};', loader: 'js' }));
+        }
+    }, {
+        name: 'mock-canvas',
+        setup(build) {
+            build.onResolve({ filter: /^canvas$/ }, args => ({ path: args.path, namespace: 'mock-canvas' }));
+            build.onLoad({ filter: /.*/, namespace: 'mock-canvas' }, () => ({ contents: 'export default {};', loader: 'js' }));
+        }
+    }]
+}).then(() => {
+    console.log("Build succeeded!");
+}).catch((e) => {
+    console.error("Build failed:", e);
+    process.exit(1);
+});

packages/acquisition/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "acquisition",
+  "version": "1.7.10",
+  "type": "module",
+  "directus:extension": {
+    "type": "endpoint",
+    "path": "index.js",
+    "source": "src/index.ts",
+    "host": "^11.0.0"
+  },
+  "scripts": {
+    "build": "node build.js",
+    "dev": "node build.js --watch"
+  },
+  "devDependencies": {
+    "@directus/extensions-sdk": "11.0.2",
+    "esbuild": "^0.25.0",
+    "typescript": "^5.6.3"
+  },
+  "dependencies": {
+    "jquery": "^3.7.1",
+    "react": "^19.2.4",
+    "react-dom": "^19.2.4"
+  }
+}

packages/acquisition/src/index.ts

@@ -0,0 +1,5 @@
+import { defineEndpoint } from '@directus/extensions-sdk';
+
+export default defineEndpoint((router) => {
+    router.get('/ping', (req, res) => res.send('pong'));
+});

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintel/cli",
-  "version": "1.0.1",
+  "version": "1.7.10",
   "publishConfig": {
     "access": "public",
     "registry": "https://npm.infra.mintel.me"
@@ -28,4 +28,4 @@
     "@types/prompts": "^2.4.4",
     "@mintel/tsconfig": "workspace:*"
   }
-}
+}

packages/cli/src/index.ts

@@ -231,7 +231,7 @@ program
           "pagespeed:test": "mintel pagespeed",
         },
         dependencies: {
-          next: "15.1.6",
+          next: "16.1.6",
           react: "^19.0.0",
           "react-dom": "^19.0.0",
           "@mintel/next-utils": "workspace:*",

packages/cms-infra/extensions/acquisition-manager/index.js

@@ -0,0 +1 @@
+import{defineModule as e}from"@directus/extensions-sdk";import{defineComponent as t,resolveComponent as n,openBlock as a,createBlock as i,withCtx as r,createElementVNode as o}from"vue";var s=t({__name:"module",setup:e=>(e,t)=>{const s=n("private-view");return a(),i(s,{title:"Acquisition Manager"},{default:r(()=>[...t[0]||(t[0]=[o("div",{class:"acquisition-manager"},[o("h1",null,"Acquisition Manager"),o("p",null,"Modern Industrial Acquisition Management Interface")],-1)])]),_:1})}}),u=[],c=[];!function(e,t){if(e&&"undefined"!=typeof document){var n,a=!0===t.prepend?"prepend":"append",i=!0===t.singleTag,r="string"==typeof t.container?document.querySelector(t.container):document.getElementsByTagName("head")[0];if(i){var o=u.indexOf(r);-1===o&&(o=u.push(r)-1,c[o]={}),n=c[o]&&c[o][a]?c[o][a]:c[o][a]=s()}else n=s();65279===e.charCodeAt(0)&&(e=e.substring(1)),n.styleSheet?n.styleSheet.cssText+=e:n.appendChild(document.createTextNode(e))}function s(){var e=document.createElement("style");if(e.setAttribute("type","text/css"),t.attributes)for(var n=Object.keys(t.attributes),i=0;i<n.length;i++)e.setAttribute(n[i],t.attributes[n[i]]);var o="prepend"===a?"afterbegin":"beforeend";return r.insertAdjacentElement(o,e),e}}("\n.acquisition-manager[data-v-19f4e937] {\n\tpadding: 20px;\n}\n",{});var d=e({id:"acquisition-manager",name:"Acquisition Manager",icon:"account_balance_wallet",routes:[{path:"",component:((e,t)=>{const n=e.__vccOpts||e;for(const[e,a]of t)n[e]=a;return n})(s,[["__scopeId","data-v-19f4e937"],["__file","module.vue"]])}]});export{d as default};

packages/cms-infra/extensions/acquisition-manager/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "acquisition-manager",
+  "description": "Custom High-Fidelity Acquisition Management for Directus",
+  "icon": "account_balance_wallet",
+  "version": "1.0.0",
+  "type": "module",
+  "keywords": [
+    "directus",
+    "directus-extension",
+    "directus-extension-module"
+  ],
+  "files": [
+    "dist"
+  ],
+  "directus:extension": {
+    "type": "module",
+    "path": "index.js",
+    "source": "src/index.ts",
+    "host": "*",
+    "name": "Acquisition Manager"
+  },
+  "scripts": {
+    "build": "directus-extension build && (cp -f dist/index.js index.js 2>/dev/null || true)",
+    "dev": "directus-extension build -w"
+  },
+  "devDependencies": {
+    "@directus/extensions-sdk": "11.0.2",
+    "vue": "^3.4.0"
+  }
+}

packages/cms-infra/extensions/acquisition/package.json

@@ -0,0 +1,25 @@
+{
+    "name": "acquisition",
+    "version": "1.0.0",
+    "type": "module",
+    "directus:extension": {
+        "type": "endpoint",
+        "path": "index.js",
+        "source": "src/index.ts",
+        "host": "^11.0.0"
+    },
+    "scripts": {
+        "build": "node build.js",
+        "dev": "node build.js --watch"
+    },
+    "devDependencies": {
+        "@directus/extensions-sdk": "11.0.2",
+        "esbuild": "^0.25.0",
+        "typescript": "^5.6.3"
+    },
+    "dependencies": {
+        "jquery": "^3.7.1",
+        "react": "^19.2.4",
+        "react-dom": "^19.2.4"
+    }
+}

packages/cms-infra/extensions/customer-manager/package.json

@@ -1,29 +1,30 @@
 {
-    "name": "customer-manager",
-    "description": "Custom High-Fidelity Customer & Company Management for Directus",
-    "icon": "supervisor_account",
-    "version": "1.0.0",
-    "keywords": [
-        "directus",
-        "directus-extension",
-        "directus-extension-module"
-    ],
-    "files": [
-        "dist"
-    ],
-    "directus:extension": {
-        "type": "module",
-        "path": "index.js",
-        "source": "src/index.ts",
-        "host": "*",
-        "name": "Customer Manager"
-    },
-    "scripts": {
-        "build": "directus-extension build",
-        "dev": "directus-extension build -w"
-    },
-    "devDependencies": {
-        "@directus/extensions-sdk": "11.0.2",
-        "vue": "^3.4.0"
-    }
+  "name": "customer-manager",
+  "description": "Custom High-Fidelity Customer & Company Management for Directus",
+  "icon": "supervisor_account",
+  "version": "1.7.3",
+  "type": "module",
+  "keywords": [
+    "directus",
+    "directus-extension",
+    "directus-extension-module"
+  ],
+  "files": [
+    "dist"
+  ],
+  "directus:extension": {
+    "type": "module",
+    "path": "index.js",
+    "source": "src/index.ts",
+    "host": "*",
+    "name": "Customer Manager"
+  },
+  "scripts": {
+    "build": "directus-extension build && (cp -f dist/index.js index.js 2>/dev/null || true)",
+    "dev": "directus-extension build -w"
+  },
+  "devDependencies": {
+    "@directus/extensions-sdk": "11.0.2",
+    "vue": "^3.4.0"
+  }
 }

packages/cms-infra/extensions/feedback-commander/package.json

@@ -1,29 +1,30 @@
 {
-    "name": "feedback-commander",
-    "description": "Custom High-Fidelity Feedback Management Extension for Directus",
-    "icon": "view_kanban",
-    "version": "1.0.0",
-    "keywords": [
-        "directus",
-        "directus-extension",
-        "directus-extension-module"
-    ],
-    "files": [
-        "index.js"
-    ],
-    "directus:extension": {
-        "type": "module",
-        "path": "index.js",
-        "source": "src/index.ts",
-        "host": "*",
-        "name": "Feedback Commander"
-    },
-    "scripts": {
-        "build": "directus-extension build",
-        "dev": "directus-extension build -w"
-    },
-    "devDependencies": {
-        "@directus/extensions-sdk": "11.0.2",
-        "vue": "^3.4.0"
-    }
-}
+  "name": "feedback-commander",
+  "description": "Custom High-Fidelity Feedback Management Extension for Directus",
+  "icon": "view_kanban",
+  "version": "1.7.3",
+  "type": "module",
+  "keywords": [
+    "directus",
+    "directus-extension",
+    "directus-extension-module"
+  ],
+  "files": [
+    "dist"
+  ],
+  "directus:extension": {
+    "type": "module",
+    "path": "index.js",
+    "source": "src/index.ts",
+    "host": "*",
+    "name": "Feedback Commander"
+  },
+  "scripts": {
+    "build": "directus-extension build && (cp -f dist/index.js index.js 2>/dev/null || true)",
+    "dev": "directus-extension build -w"
+  },
+  "devDependencies": {
+    "@directus/extensions-sdk": "11.0.2",
+    "vue": "^3.4.0"
+  }
+}

packages/cms-infra/extensions/people-manager/index.js

@@ -0,0 +1 @@
+import{defineModule as e}from"@directus/extensions-sdk";import{defineComponent as t,resolveComponent as n,openBlock as a,createBlock as r,withCtx as o,createElementVNode as p}from"vue";var s=t({__name:"module",setup:e=>(e,t)=>{const s=n("private-view");return a(),r(s,{title:"People Manager"},{default:o(()=>[...t[0]||(t[0]=[p("div",{class:"people-manager"},[p("h1",null,"People Manager"),p("p",null,"Modern Industrial People Management Interface")],-1)])]),_:1})}}),d=[],i=[];!function(e,t){if(e&&"undefined"!=typeof document){var n,a=!0===t.prepend?"prepend":"append",r=!0===t.singleTag,o="string"==typeof t.container?document.querySelector(t.container):document.getElementsByTagName("head")[0];if(r){var p=d.indexOf(o);-1===p&&(p=d.push(o)-1,i[p]={}),n=i[p]&&i[p][a]?i[p][a]:i[p][a]=s()}else n=s();65279===e.charCodeAt(0)&&(e=e.substring(1)),n.styleSheet?n.styleSheet.cssText+=e:n.appendChild(document.createTextNode(e))}function s(){var e=document.createElement("style");if(e.setAttribute("type","text/css"),t.attributes)for(var n=Object.keys(t.attributes),r=0;r<n.length;r++)e.setAttribute(n[r],t.attributes[n[r]]);var p="prepend"===a?"afterbegin":"beforeend";return o.insertAdjacentElement(p,e),e}}("\n.people-manager[data-v-da2952f8] {\n\tpadding: 20px;\n}\n",{});var u=e({id:"people-manager",name:"People Manager",icon:"person",routes:[{path:"",component:((e,t)=>{const n=e.__vccOpts||e;for(const[e,a]of t)n[e]=a;return n})(s,[["__scopeId","data-v-da2952f8"],["__file","module.vue"]])}]});export{u as default};

packages/cms-infra/extensions/people-manager/package.json

@@ -0,0 +1,30 @@
+{
+    "name": "people-manager",
+    "description": "Custom High-Fidelity People Management for Directus",
+    "icon": "person",
+    "version": "1.0.0",
+    "type": "module",
+    "keywords": [
+        "directus",
+        "directus-extension",
+        "directus-extension-module"
+    ],
+    "files": [
+        "dist"
+    ],
+    "directus:extension": {
+        "type": "module",
+        "path": "index.js",
+        "source": "src/index.ts",
+        "host": "*",
+        "name": "People Manager"
+    },
+    "scripts": {
+        "build": "directus-extension build && (cp -f dist/index.js index.js 2>/dev/null || true)",
+        "dev": "directus-extension build -w"
+    },
+    "devDependencies": {
+        "@directus/extensions-sdk": "11.0.2",
+        "vue": "^3.4.0"
+    }
+}

packages/cms-infra/package.json

@@ -1,11 +1,12 @@
 {
-    "name": "@mintel/cms-infra",
-    "version": "1.0.0",
-    "private": true,
-    "type": "module",
-    "scripts": {
-        "up": "docker compose up -d",
-        "down": "docker compose down",
-        "logs": "docker compose logs -f"
-    }
-}
+  "name": "@mintel/cms-infra",
+  "version": "1.7.10",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "up": "npm run build:extensions && docker compose up -d",
+    "down": "docker compose down",
+    "logs": "docker compose logs -f",
+    "build:extensions": "../../scripts/sync-extensions.sh"
+  }
+}

packages/customer-manager/package.json

@@ -1,29 +1,30 @@
 {
-    "name": "customer-manager",
-    "description": "Custom High-Fidelity Customer & Company Management for Directus",
-    "icon": "supervisor_account",
-    "version": "1.0.0",
-    "keywords": [
-        "directus",
-        "directus-extension",
-        "directus-extension-module"
-    ],
-    "files": [
-        "dist"
-    ],
-    "directus:extension": {
-        "type": "module",
-        "path": "index.js",
-        "source": "src/index.ts",
-        "host": "*",
-        "name": "Customer Manager"
-    },
-    "scripts": {
-        "build": "directus-extension build",
-        "dev": "directus-extension build -w"
-    },
-    "devDependencies": {
-        "@directus/extensions-sdk": "11.0.2",
-        "vue": "^3.4.0"
-    }
-}
+  "name": "customer-manager",
+  "description": "Custom High-Fidelity Customer & Company Management for Directus",
+  "icon": "supervisor_account",
+  "version": "1.7.10",
+  "type": "module",
+  "keywords": [
+    "directus",
+    "directus-extension",
+    "directus-extension-module"
+  ],
+  "files": [
+    "dist"
+  ],
+  "directus:extension": {
+    "type": "module",
+    "path": "index.js",
+    "source": "src/index.ts",
+    "host": "*",
+    "name": "Customer Manager"
+  },
+  "scripts": {
+    "build": "directus-extension build && (cp -f dist/index.js index.js 2>/dev/null || true)",
+    "dev": "directus-extension build -w"
+  },
+  "devDependencies": {
+    "@directus/extensions-sdk": "11.0.2",
+    "vue": "^3.4.0"
+  }
+}

packages/eslint-config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintel/eslint-config",
-  "version": "1.0.1",
+  "version": "1.7.10",
   "publishConfig": {
     "access": "public",
     "registry": "https://npm.infra.mintel.me"
@@ -20,8 +20,8 @@
   "dependencies": {
     "@eslint/eslintrc": "^3.0.0",
     "@eslint/js": "^9.39.2",
-    "@next/eslint-plugin-next": "15.1.6",
-    "eslint-config-next": "15.1.6",
+    "@next/eslint-plugin-next": "16.1.6",
+    "eslint-config-next": "16.1.6",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^7.0.1",
     "typescript-eslint": "^8.54.0"

packages/feedback-commander/package.json

@@ -1,29 +1,30 @@
 {
-    "name": "@mintel/extension-feedback-commander",
-    "description": "Custom High-Fidelity Feedback Management Extension for Directus",
-    "icon": "view_kanban",
-    "version": "1.0.0",
-    "keywords": [
-        "directus",
-        "directus-extension",
-        "directus-extension-module"
-    ],
-    "files": [
-        "dist"
-    ],
-    "directus:extension": {
-        "type": "module",
-        "path": "dist/index.js",
-        "source": "src/index.ts",
-        "host": "*",
-        "name": "Feedback Commander"
-    },
-    "scripts": {
-        "build": "directus-extension build",
-        "dev": "directus-extension build -w"
-    },
-    "devDependencies": {
-        "@directus/extensions-sdk": "11.0.2",
-        "vue": "^3.4.0"
-    }
-}
+  "name": "feedback-commander",
+  "description": "Custom High-Fidelity Feedback Management Extension for Directus",
+  "icon": "view_kanban",
+  "version": "1.7.10",
+  "type": "module",
+  "keywords": [
+    "directus",
+    "directus-extension",
+    "directus-extension-module"
+  ],
+  "files": [
+    "dist"
+  ],
+  "directus:extension": {
+    "type": "module",
+    "path": "index.js",
+    "source": "src/index.ts",
+    "host": "*",
+    "name": "Feedback Commander"
+  },
+  "scripts": {
+    "build": "directus-extension build && (cp -f dist/index.js index.js 2>/dev/null || true)",
+    "dev": "directus-extension build -w"
+  },
+  "devDependencies": {
+    "@directus/extensions-sdk": "11.0.2",
+    "vue": "^3.4.0"
+  }
+}

packages/gatekeeper/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@mintel/gatekeeper",
-  "version": "1.0.0",
+  "version": "1.7.12",
   "private": true,
   "type": "module",
   "scripts": {
     "dev": "next dev",
     "build": "next build",
     "start": "next start",
-    "lint": "next lint",
+    "lint": "eslint src/",
     "test": "vitest run"
   },
   "dependencies": {
     "@mintel/next-utils": "workspace:*",
     "clsx": "^2.1.1",
     "lucide-react": "^0.474.0",
-    "next": "15.1.7",
+    "next": "16.1.6",
     "next-intl": "^4.8.2",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
@@ -33,4 +33,4 @@
     "tailwindcss": "^3.4.17",
     "typescript": "^5.0.0"
   }
-}
+}

packages/gatekeeper/src/app/api/verify/route.ts

@@ -11,6 +11,8 @@ export async function GET(req: NextRequest) {
 
   // 1. URL Parameter Bypass (for automated tests/staging)
   const originalUrl = req.headers.get("x-forwarded-uri") || "/";
+
+  console.log(`[Verify] Check: ${originalUrl} | Cookie: ${session ? "Found" : "Missing"}`);
   const host =
     req.headers.get("x-forwarded-host") || req.headers.get("host") || "";
   const proto = req.headers.get("x-forwarded-proto") || "https";
@@ -44,7 +46,7 @@ export async function GET(req: NextRequest) {
 
       return response;
     }
-  } catch (e) {
+  } catch (_e) {
     // URL parsing failed, proceed with normal logic
   }
 
@@ -54,15 +56,17 @@ export async function GET(req: NextRequest) {
   if (session?.value) {
     if (session.value === password) {
       isAuthenticated = true;
+      console.log(`[Verify] Legacy password match`);
     } else {
       try {
         const payload = JSON.parse(session.value);
         if (payload.identity) {
           isAuthenticated = true;
           identity = payload.identity;
+          console.log(`[Verify] Identity verified: ${identity}`);
         }
-      } catch (e) {
-        // Fallback or old format
+      } catch (_e) {
+        console.log(`[Verify] JSON Parse failed for cookie: ${session.value.substring(0, 10)}...`);
       }
     }
   }

packages/gatekeeper/src/app/api/whoami/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { cookies } from "next/headers";
 
-export async function GET(req: NextRequest) {
+export async function GET(_req: NextRequest) {
   const cookieStore = await cookies();
   const authCookieName =
     process.env.AUTH_COOKIE_NAME || "mintel_gatekeeper_session";
@@ -17,7 +17,7 @@ export async function GET(req: NextRequest) {
     const payload = JSON.parse(session.value);
     identity = payload.identity || "Guest";
     company = payload.company || null;
-  } catch (e) {
+  } catch (_e) {
     // Old format probably just the password
   }
 

packages/gatekeeper/src/app/login/page.tsx

@@ -17,8 +17,8 @@ export default async function LoginPage({ searchParams }: LoginPageProps) {
   async function login(formData: FormData) {
     "use server";
 
-    const email = formData.get("email") as string;
-    const password = formData.get("password") as string;
+    const email = (formData.get("email") as string || "").trim();
+    const password = (formData.get("password") as string || "").trim();
 
     const expectedCode = process.env.GATEKEEPER_PASSWORD || "mintel";
     const adminEmail = process.env.DIRECTUS_ADMIN_EMAIL;
@@ -31,19 +31,19 @@ export default async function LoginPage({ searchParams }: LoginPageProps) {
     let userIdentity = "";
     let userCompany: any = null;
 
-    // 1. Check Global Admin (from ENV)
-    if (
+    // 1. Check Generic Code (Guest) - High Priority to prevent autofill traps
+    if (password === expectedCode) {
+      userIdentity = "Guest";
+    }
+    // 2. Check Global Admin (from ENV)
+    else if (
       adminEmail &&
       adminPassword &&
-      email === adminEmail &&
-      password === adminPassword
+      email === adminEmail.trim() &&
+      password === adminPassword.trim()
     ) {
       userIdentity = "Admin";
     }
-    // 2. Check Generic Code (Guest)
-    else if (!email && password === expectedCode) {
-      userIdentity = "Guest";
-    }
     // 3. Check Lightweight Client Users (dedicated collection)
     if (email && password && process.env.INFRA_DIRECTUS_URL) {
       try {
@@ -116,6 +116,7 @@ export default async function LoginPage({ searchParams }: LoginPageProps) {
     }
 
     if (userIdentity) {
+      console.log(`[Login] Success: ${userIdentity} | Redirect: ${targetRedirect}`);
       const cookieStore = await cookies();
       // Store identity in the cookie (simplified for now, ideally signed)
       const sessionValue = JSON.stringify({
@@ -126,6 +127,8 @@ export default async function LoginPage({ searchParams }: LoginPageProps) {
 
       const isDev = process.env.NODE_ENV === "development";
 
+      console.log(`[Login] Setting Cookie: ${authCookieName} | Domain: ${cookieDomain || "Default"}`);
+
       cookieStore.set(authCookieName, sessionValue, {
         httpOnly: true,
         secure: !isDev,
@@ -136,6 +139,7 @@ export default async function LoginPage({ searchParams }: LoginPageProps) {
       });
       redirect(targetRedirect);
     } else {
+      console.log(`[Login] Failed for inputs. Redirecting back with error.`);
       redirect(`/login?error=1&redirect=${encodeURIComponent(targetRedirect)}`);
     }
   }

packages/husky-config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintel/husky-config",
-  "version": "1.0.0",
+  "version": "1.7.10",
   "publishConfig": {
     "access": "public",
     "registry": "https://npm.infra.mintel.me"

packages/infra/docker/Dockerfile.gatekeeper

@@ -19,7 +19,6 @@ COPY packages/cli/package.json ./packages/cli/package.json
 COPY packages/observability/package.json ./packages/observability/package.json
 COPY packages/next-observability/package.json ./packages/next-observability/package.json
 COPY packages/husky-config/package.json ./packages/husky-config/package.json
-COPY packages/ui/package.json ./packages/ui/package.json
 
 # Use a secret for NPM_TOKEN and a cache mount for the pnpm store
 RUN --mount=type=cache,id=pnpm,target=/pnpm/store \

packages/infra/docker/Dockerfile.nextjs

@@ -1,19 +1,13 @@
-# Step 1: Builder image
-FROM node:20-alpine AS builder
+# Step 1: Base image for Next.js builds
+FROM node:20-alpine
 RUN apk add --no-cache libc6-compat curl
+
+# Enable pnpm
+RUN corepack enable pnpm && \
+    corepack prepare pnpm@10.2.0 --activate
+
 WORKDIR /app
-RUN corepack enable pnpm
 
-# Step 2: Install dependencies
-# We copy everything first because we have a .dockerignore
-# and we need the workspace structure for pnpm to work correctly
-COPY . .
-
-# Use a secret for NPM_TOKEN to authenticate with private registry
-RUN --mount=type=cache,target=/root/.local/share/pnpm/store/v3 \
-    --mount=type=secret,id=NPM_TOKEN \
-    export NPM_TOKEN=$(cat /run/secrets/NPM_TOKEN) && \
-    pnpm i --frozen-lockfile
-
-# Step 3: Build shared packages
-RUN pnpm --filter "./packages/*" -r build
+# Final environment
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1

packages/infra/docker/Dockerfile.runtime

@@ -1,19 +1,22 @@
-FROM node:20-alpine
+FROM node:20-alpine AS runner
+RUN apk add --no-cache libc6-compat curl
 
-# Install essential production utilities
-RUN apk add --no-cache curl libc6-compat
+WORKDIR /app
 
-# Set standard production environment
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
 
-WORKDIR /app
-
 # Create non-root user for security
 RUN addgroup --system --gid 1001 nodejs && \
     adduser --system --uid 1001 nextjs
 
-# Expose the default Next.js port
+# Set correct permissions
+RUN chown -R nextjs:nodejs /app
+
+USER nextjs
+
 EXPOSE 3000
+
+CMD ["node", "server.js"]

packages/infra/docker/docker-compose.template.yml

@@ -53,7 +53,7 @@ services:
       - "traefik.http.services.${PROJECT_NAME}-gatekeeper.loadbalancer.server.port=3000"
 
   directus:
-    image: registry.infra.mintel.me/mintel/directus:latest
+    image: registry.infra.mintel.me/mintel/directus:${IMAGE_TAG:-latest}
     restart: always
     networks:
       - infra

packages/infra/gitea/deploy-action.yml

@@ -275,6 +275,10 @@ jobs:
             docker system prune -f --filter "until=24h"
           EOF
 
+      - name: 🧹 Post-Deploy Cleanup (Runner)
+        if: always()
+        run: docker builder prune -f --filter "until=1h"
+
   # ──────────────────────────────────────────────────────────────────────────────
   # JOB 5: Notifications
   # ──────────────────────────────────────────────────────────────────────────────

packages/infra/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintel/infra",
-  "version": "1.0.1",
+  "version": "1.7.10",
   "publishConfig": {
     "access": "public",
     "registry": "https://npm.infra.mintel.me"

packages/infra/scripts/prune-registry.sh

@@ -2,7 +2,7 @@
 set -e
 
 # Configuration
-REGISTRY_DATA="/opt/infra/registry/data/docker/registry/v2"
+REGISTRY_DATA="/mnt/HC_Volume_104575103/registry-data/docker/registry/v2"
 KEEP_TAGS=3
 
 echo "🏥 Starting Aggressive Registry & Docker Maintenance..."
@@ -15,31 +15,26 @@ for repo_dir in "$REGISTRY_DATA/repositories/mintel/"*; do
     if [ -d "$tags_dir" ]; then
         echo "🔍 Processing repository: mintel/$repo_name"
         
-        # Prune main-* tags
-        echo "  📦 Pruning main tags..."
-        main_tags=$(ls -dt "$tags_dir"/main-* 2>/dev/null || true)
-        count=0
-        for tag_path in $main_tags; do
-            ((++count))
-            if [ $count -gt $KEEP_TAGS ]; then
-                echo "    🗑️ Deleting old main tag: $(basename "$tag_path")"
-                rm -rf "$tag_path"
-            fi
+        # Prune various tag patterns
+        PATTERNS=("main-*" "testing-*" "branch-*" "v*" "rc*" "[0-9a-f]*")
+        
+        for pattern in "${PATTERNS[@]}"; do
+            echo "  📦 Pruning $pattern tags..."
+            tags=$(ls -dt "$tags_dir"/${pattern} 2>/dev/null || true)
+            count=0
+            for tag_path in $tags; do
+                tag_name=$(basename "$tag_path")
+                if [[ "$tag_name" == "latest" ]]; then continue; fi
+                
+                ((++count))
+                if [ $count -gt $KEEP_TAGS ]; then
+                    echo "    🗑️ Deleting old tag: $tag_name"
+                    rm -rf "$tag_path"
+                fi
+            done
         done
 
-        # Prune version tags (v* and rc*)
-        echo "  🏷️ Pruning version tags..."
-        version_tags=$(ls -dt "$tags_dir"/v1* 2>/dev/null || true)
-        count=0
-        for tag_path in $version_tags; do
-            ((++count))
-            if [ $count -gt $KEEP_TAGS ]; then
-                echo "    🗑️ Deleting old version tag: $(basename "$tag_path")"
-                rm -rf "$tag_path"
-            fi
-        done
-
-        # Always prune buildcache (as it rebuilds quickly)
+        # Always prune buildcache
         if [ -d "$tags_dir/buildcache" ]; then
             echo "  🧹 Deleting buildcache tag"
             rm -rf "$tags_dir/buildcache"
@@ -49,7 +44,7 @@ done
 
 # 2. Run Garbage Collection
 echo "♻️ Running Registry Garbage Collection..."
-docker exec registry-registry-1 bin/registry garbage-collect /etc/docker/registry/config.yml
+docker exec registry-registry-1 bin/registry garbage-collect /etc/docker/registry/config.yml --delete-untagged
 
 # 3. Prune Host Docker resources (Shorter window: 24h)
 echo "🧹 Pruning Host Docker resources..."

packages/infra/scripts/wait-for-upstream.sh

@@ -0,0 +1,90 @@
+#!/bin/bash
+set -e
+
+# wait-for-upstream.sh
+# Usage: ./wait-for-upstream.sh <org/repo> <version_tag> [poll_interval_sec]
+
+REPO=$1
+TAG=$2
+INTERVAL=${3:-30}
+MAX_RETRIES=40 # ~20 minutes default
+
+if [[ -z "$REPO" || -z "$TAG" ]]; then
+  echo "❌ Error: REPO and TAG are required."
+  echo "Usage: $0 <org/repo> <version_tag>"
+  exit 1
+fi
+
+if [[ -z "$GITEA_TOKEN" ]]; then
+  echo "❌ Error: GITEA_TOKEN is not set."
+  exit 1
+fi
+
+GITEA_API="https://git.infra.mintel.me/api/v1"
+
+echo "🔎 Searching for upstream release $TAG in $REPO..."
+
+# 1. Find the run for the specific tag
+# We look for runs on the specific ref (refs/tags/vX.Y.Z)
+RUN_QUERY=$(curl -s -H "Authorization: token $GITEA_TOKEN" "$GITEA_API/repos/$REPO/actions/runs?ref=refs/tags/$TAG")
+
+# Gitea returns a list of runs. We take the latest one by creation date.
+RUN_ID=$(echo "$RUN_QUERY" | jq -r '.workflow_runs | sort_by(.created_at) | last | .id // empty')
+
+if [[ -z "$RUN_ID" || "$RUN_ID" == "null" ]]; then
+  echo "ℹ️ No recent action run found for tag $TAG in $REPO."
+  echo "🔎 Checking if tag $TAG exists in the repository..."
+  
+  TAG_EXISTS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token $GITEA_TOKEN" "$GITEA_API/repos/$REPO/tags/$TAG")
+  
+  if [[ "$TAG_EXISTS" == "200" ]]; then
+    echo "✅ Tag $TAG exists. Assuming it was released successfully in the past."
+    exit 0
+  fi
+
+  echo "⚠️ Warning: Tag $TAG not found either. Upstream might be lagging or the version is invalid."
+  echo "   Waiting 15s to see if it appears..."
+  sleep 15
+  
+  RUN_QUERY=$(curl -s -H "Authorization: token $GITEA_TOKEN" "$GITEA_API/repos/$REPO/actions/runs?ref=refs/tags/$TAG")
+  RUN_ID=$(echo "$RUN_QUERY" | jq -r '.workflow_runs[0].id // empty')
+  
+  if [[ -z "$RUN_ID" || "$RUN_ID" == "null" ]]; then
+     # Final check for tag
+     TAG_EXISTS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token $GITEA_TOKEN" "$GITEA_API/repos/$REPO/tags/$TAG")
+     if [[ "$TAG_EXISTS" == "200" ]]; then
+       echo "✅ Tag $TAG finally detected. Proceeding."
+       exit 0
+     fi
+     echo "❌ Error: Could not find any action run OR tag for $TAG in $REPO."
+     exit 1
+  fi
+fi
+
+echo "⏳ Waiting for upstream run $RUN_ID status..."
+
+RETRY_COUNT=0
+while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
+  STATUS_QUERY=$(curl -s -H "Authorization: token $GITEA_TOKEN" "$GITEA_API/repos/$REPO/actions/runs/$RUN_ID")
+  STATUS=$(echo "$STATUS_QUERY" | jq -r '.status')
+  CONCLUSION=$(echo "$STATUS_QUERY" | jq -r '.conclusion')
+
+  echo "   - Current Status: $STATUS (Conclusion: $CONCLUSION)"
+
+  if [[ "$STATUS" == "success" || "$CONCLUSION" == "success" ]]; then
+    echo "✅ Upstream release $TAG is READY."
+    exit 0
+  fi
+
+  if [[ "$STATUS" == "failure" || "$CONCLUSION" == "failure" || "$CONCLUSION" == "cancelled" ]]; then
+    echo "❌ Error: Upstream release $TAG FAILED or was CANCELLED."
+    exit 1
+  fi
+
+  echo "   - Still working... waiting $INTERVAL seconds (Attempt $((RETRY_COUNT+1))/$MAX_RETRIES)"
+  sleep $INTERVAL
+  RETRY_COUNT=$((RETRY_COUNT+1))
+done
+
+echo "❌ Error: Timeout waiting for upstream release $TAG."
+exit 1

packages/mail/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @mintel/mail
+
+## 1.7.0
+
+### Minor Changes
+
+- 96ec2c7: Initial release of the branded email system package.

packages/mail/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintel/mail",
-  "version": "1.2.0",
+  "version": "1.7.10",
   "private": false,
   "publishConfig": {
     "access": "public",
@@ -38,6 +38,7 @@
     "@mintel/tsconfig": "workspace:*",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
+    "prettier": "^3.8.1",
     "tsup": "^8.3.5",
     "typescript": "^5.0.0",
     "vitest": "^3.0.4"

packages/mail/vitest.config.ts

@@ -0,0 +1,23 @@
+import { defineConfig } from "vitest/config";
+import path from "path";
+
+export default defineConfig({
+  test: {
+    environment: "node",
+    alias: {
+      "prettier/plugins/html": path.resolve(
+        process.cwd(),
+        "../../node_modules/prettier/plugins/html.js",
+      ),
+      "prettier/parser-html": path.resolve(
+        process.cwd(),
+        "../../node_modules/prettier/plugins/html.js",
+      ),
+    },
+    server: {
+      deps: {
+        inline: [/@react-email/],
+      },
+    },
+  },
+});

packages/next-config/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @mintel/next-config
 
+## 1.6.1
+
+### Patch Changes
+
+- Add `turbopack: {}` to support Next.js 16 default Turbopack behavior when a webpack config is present.
+
+## 1.6.1
+
+### Patch Changes
+
+- Add `turbopack: {}` to support Next.js 16 default Turbopack behavior when a webpack config is present.
+
 ## 1.0.1
 
 ### Patch Changes

packages/next-config/index.js

@@ -7,6 +7,7 @@ import path from "node:path";
 /** @type {import('next').NextConfig} */
 export const baseNextConfig = {
   output: "standalone",
+  turbopack: {},
   images: {
     dangerouslyAllowSVG: true,
     contentDispositionType: "attachment",

packages/next-config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintel/next-config",
-  "version": "1.0.1",
+  "version": "1.7.10",
   "publishConfig": {
     "access": "public",
     "registry": "https://npm.infra.mintel.me"
@@ -16,6 +16,7 @@
   },
   "dependencies": {
     "next-intl": "^4.8.2",
-    "@sentry/nextjs": "^8.0.0"
+    "@sentry/nextjs": "^10.38.0",
+    "next": "16.1.6"
   }
 }

packages/next-feedback/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintel/next-feedback",
-  "version": "1.0.0",
+  "version": "1.7.10",
   "publishConfig": {
     "access": "public",
     "registry": "https://npm.infra.mintel.me"
@@ -23,8 +23,7 @@
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
-    "lint": "eslint src/",
-    "test": "vitest run"
+    "lint": "eslint src/"
   },
   "dependencies": {
     "@directus/sdk": "^21.0.0",
@@ -32,7 +31,7 @@
     "framer-motion": "^11.5.4",
     "html2canvas": "^1.4.1",
     "lucide-react": "^0.441.0",
-    "next": "15.1.7",
+    "next": "16.1.6",
     "tailwind-merge": "^2.5.2"
   },
   "devDependencies": {

packages/next-observability/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintel/next-observability",
-  "version": "1.0.0",
+  "version": "1.7.10",
   "publishConfig": {
     "access": "public",
     "registry": "https://npm.infra.mintel.me"
@@ -28,8 +28,8 @@
   },
   "dependencies": {
     "@mintel/observability": "workspace:*",
-    "@sentry/nextjs": "^8.55.0",
-    "next": "15.1.7"
+    "@sentry/nextjs": "^10.38.0",
+    "next": "16.1.6"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",

packages/next-utils/package.json

@@ -1,22 +1,22 @@
 {
   "name": "@mintel/next-utils",
-  "version": "1.0.1",
+  "version": "1.7.10",
   "publishConfig": {
     "access": "public",
     "registry": "https://npm.infra.mintel.me"
   },
+  "type": "module",
   "main": "./dist/index.js",
-  "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
   "scripts": {
-    "build": "tsup src/index.ts --format cjs,esm --dts",
-    "dev": "tsup src/index.ts --format cjs,esm --watch --dts",
+    "build": "tsup src/index.ts --format esm --dts --clean",
+    "dev": "tsup src/index.ts --format esm --watch --dts",
     "lint": "eslint src/",
     "test": "vitest run"
   },
   "dependencies": {
     "@directus/sdk": "^21.0.0",
-    "next": "15.1.7",
+    "next": "16.1.6",
     "next-intl": "^4.8.2",
     "zod": "^3.0.0"
   },

packages/next-utils/src/directus.ts

@@ -7,18 +7,43 @@ import {
   AuthenticationClient,
 } from "@directus/sdk";
 
-export type MintelDirectusClient = DirectusClient<any> &
-  RestClient<any> &
-  AuthenticationClient<any>;
+export type MintelDirectusClient<Schema extends object = any> =
+  DirectusClient<Schema> & RestClient<Schema> & AuthenticationClient<Schema>;
 
 /**
- * Creates a Directus client configured with Mintel standards
+ * Creates a Directus client configured with Mintel standards.
+ * Automatically handles internal vs. external URLs based on environment.
  */
-export function createMintelDirectusClient(url?: string): MintelDirectusClient {
-  const directusUrl =
-    url || process.env.DIRECTUS_URL || "http://localhost:8055";
+export function createMintelDirectusClient<Schema extends object = any>(
+  url?: string,
+): MintelDirectusClient<Schema> {
+  const isServer = typeof window === "undefined";
 
-  return createDirectus(directusUrl).with(rest()).with(authentication());
+  // 1. If an explicit URL is provided, use it.
+  if (url) {
+    return createDirectus<Schema>(url).with(rest()).with(authentication());
+  }
+
+  // 2. On server: Prioritize INTERNAL_DIRECTUS_URL, fallback to DIRECTUS_URL
+  if (isServer) {
+    const directusUrl =
+      process.env.INTERNAL_DIRECTUS_URL ||
+      process.env.DIRECTUS_URL ||
+      "http://localhost:8055";
+    return createDirectus<Schema>(directusUrl)
+      .with(rest())
+      .with(authentication());
+  }
+
+  // 3. In browser: Use a proxy path if we are on a different origin,
+  // or use the current origin if no DIRECTUS_URL is set.
+  const proxyPath = "/api/directus"; // Standard Mintel proxy path
+  const browserUrl =
+    typeof window !== "undefined"
+      ? `${window.location.origin}${proxyPath}`
+      : proxyPath;
+
+  return createDirectus<Schema>(browserUrl).with(rest()).with(authentication());
 }
 
 /**

packages/next-utils/src/env.ts

@@ -4,10 +4,17 @@ export const mintelEnvSchema = {
   NODE_ENV: z
     .enum(["development", "production", "test"])
     .default("development"),
-  NEXT_PUBLIC_BASE_URL: z.string().url(),
+  NEXT_PUBLIC_BASE_URL: z.string().url().optional(),
+  NEXT_PUBLIC_TARGET: z
+    .enum(["development", "testing", "staging", "production"])
+    .optional(),
+  TARGET: z
+    .enum(["development", "testing", "staging", "production"])
+    .optional(),
 
   // Analytics (Proxy Pattern)
   UMAMI_WEBSITE_ID: z.string().optional(),
+  NEXT_PUBLIC_UMAMI_WEBSITE_ID: z.string().optional(),
   UMAMI_API_ENDPOINT: z
     .string()
     .url()
@@ -23,6 +30,8 @@ export const mintelEnvSchema = {
   LOG_LEVEL: z
     .enum(["trace", "debug", "info", "warn", "error", "fatal"])
     .default("info"),
+
+  // Mail
   MAIL_HOST: z.string().optional(),
   MAIL_PORT: z.coerce.number().default(587),
   MAIL_USERNAME: z.string().optional(),
@@ -32,17 +41,60 @@ export const mintelEnvSchema = {
     (val) => (typeof val === "string" ? val.split(",").filter(Boolean) : val),
     z.array(z.string()).default([]),
   ),
+
+  // Directus
+  DIRECTUS_URL: z.string().url().default("http://localhost:8055"),
+  DIRECTUS_ADMIN_EMAIL: z.string().optional(),
+  DIRECTUS_ADMIN_PASSWORD: z.string().optional(),
+  DIRECTUS_API_TOKEN: z.string().optional(),
+  INTERNAL_DIRECTUS_URL: z.string().url().optional(),
 };
 
-export function validateMintelEnv(schemaExtension = {}) {
-  const fullSchema = z.object({
-    ...mintelEnvSchema,
-    ...schemaExtension,
+/**
+ * Standard Mintel refinements for environment variables.
+ * Enforces mandatory requirements for non-development environments.
+ */
+export const withMintelRefinements = <T extends z.ZodTypeAny>(schema: T) => {
+  return schema.superRefine((data: any, ctx) => {
+    const skipValidation =
+      process.env.SKIP_ENV_VALIDATION === "true" ||
+      process.env.SKIP_RUNTIME_ENV_VALIDATION === "true";
+
+    if (skipValidation) return;
+
+    const target = data.TARGET || data.NEXT_PUBLIC_TARGET || "development";
+
+    // Strict validation for non-development environments
+    if (target !== "development") {
+      if (!data.MAIL_HOST) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: "MAIL_HOST is required in non-development environments",
+          path: ["MAIL_HOST"],
+        });
+      }
+    }
   });
+};
+
+export type MintelEnv<T extends z.ZodRawShape = Record<string, never>> =
+  z.infer<
+    ReturnType<
+      typeof withMintelRefinements<z.ZodObject<typeof mintelEnvSchema & T>>
+    >
+  >;
+
+export function validateMintelEnv<
+  T extends z.ZodRawShape = Record<string, never>,
+>(schemaExtension: T = {} as T): MintelEnv<T> {
+  const fullSchema = withMintelRefinements(
+    z.object(mintelEnvSchema).extend(schemaExtension),
+  );
 
   const isBuildTime =
     process.env.NEXT_PHASE === "phase-production-build" ||
-    process.env.SKIP_ENV_VALIDATION === "true";
+    process.env.SKIP_ENV_VALIDATION === "true" ||
+    process.env.SKIP_RUNTIME_ENV_VALIDATION === "true";
 
   const result = fullSchema.safeParse(process.env);
 
@@ -51,7 +103,7 @@ export function validateMintelEnv(schemaExtension = {}) {
       console.warn(
         "⚠️ Some environment variables are missing during build, but skipping strict validation.",
       );
-      // Return partial data to allow build to continue
+      // Return process.env casted to the full schema type to unblock builds
       return process.env as unknown as z.infer<typeof fullSchema>;
     }
 
@@ -62,5 +114,5 @@ export function validateMintelEnv(schemaExtension = {}) {
     throw new Error("Invalid environment variables");
   }
 
-  return result.data;
+  return result.data as MintelEnv<T>;
 }

packages/observability/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintel/observability",
-  "version": "1.0.0",
+  "version": "1.7.10",
   "publishConfig": {
     "access": "public",
     "registry": "https://npm.infra.mintel.me"

packages/people-manager/index.js

@@ -0,0 +1 @@
+import{defineModule as e}from"@directus/extensions-sdk";import{defineComponent as t,resolveComponent as n,openBlock as a,createBlock as r,withCtx as o,createElementVNode as p}from"vue";var s=t({__name:"module",setup:e=>(e,t)=>{const s=n("private-view");return a(),r(s,{title:"People Manager"},{default:o(()=>[...t[0]||(t[0]=[p("div",{class:"people-manager"},[p("h1",null,"People Manager"),p("p",null,"Modern Industrial People Management Interface")],-1)])]),_:1})}}),d=[],i=[];!function(e,t){if(e&&"undefined"!=typeof document){var n,a=!0===t.prepend?"prepend":"append",r=!0===t.singleTag,o="string"==typeof t.container?document.querySelector(t.container):document.getElementsByTagName("head")[0];if(r){var p=d.indexOf(o);-1===p&&(p=d.push(o)-1,i[p]={}),n=i[p]&&i[p][a]?i[p][a]:i[p][a]=s()}else n=s();65279===e.charCodeAt(0)&&(e=e.substring(1)),n.styleSheet?n.styleSheet.cssText+=e:n.appendChild(document.createTextNode(e))}function s(){var e=document.createElement("style");if(e.setAttribute("type","text/css"),t.attributes)for(var n=Object.keys(t.attributes),r=0;r<n.length;r++)e.setAttribute(n[r],t.attributes[n[r]]);var p="prepend"===a?"afterbegin":"beforeend";return o.insertAdjacentElement(p,e),e}}("\n.people-manager[data-v-da2952f8] {\n\tpadding: 20px;\n}\n",{});var u=e({id:"people-manager",name:"People Manager",icon:"person",routes:[{path:"",component:((e,t)=>{const n=e.__vccOpts||e;for(const[e,a]of t)n[e]=a;return n})(s,[["__scopeId","data-v-da2952f8"],["__file","module.vue"]])}]});export{u as default};

packages/people-manager/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "people-manager",
+  "description": "Custom High-Fidelity People Management for Directus",
+  "icon": "person",
+  "version": "1.7.10",
+  "type": "module",
+  "keywords": [
+    "directus",
+    "directus-extension",
+    "directus-extension-module"
+  ],
+  "files": [
+    "dist"
+  ],
+  "directus:extension": {
+    "type": "module",
+    "path": "index.js",
+    "source": "src/index.ts",
+    "host": "*",
+    "name": "People Manager"
+  },
+  "scripts": {
+    "build": "directus-extension build && (cp -f dist/index.js index.js 2>/dev/null || true)",
+    "dev": "directus-extension build -w"
+  },
+  "devDependencies": {
+    "@directus/extensions-sdk": "11.0.2",
+    "vue": "^3.4.0"
+  }
+}

packages/people-manager/src/index.ts

@@ -0,0 +1,14 @@
+import { defineModule } from '@directus/extensions-sdk';
+import ModuleComponent from './module.vue';
+
+export default defineModule({
+    id: 'people-manager',
+    name: 'People Manager',
+    icon: 'person',
+    routes: [
+        {
+            path: '',
+            component: ModuleComponent,
+        },
+    ],
+});

packages/people-manager/src/module.vue

@@ -0,0 +1,18 @@
+<template>
+	<private-view title="People Manager">
+		<div class="people-manager">
+			<h1>People Manager</h1>
+			<p>Modern Industrial People Management Interface</p>
+		</div>
+	</private-view>
+</template>
+
+<script setup lang="ts">
+// Logic will be added here
+</script>
+
+<style scoped>
+.people-manager {
+	padding: 20px;
+}
+</style>

packages/tsconfig/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintel/tsconfig",
-  "version": "1.0.1",
+  "version": "1.7.10",
   "publishConfig": {
     "access": "public",
     "registry": "https://npm.infra.mintel.me"

pnpm-workspace.yaml

@@ -1,4 +1,3 @@
 packages:
   - 'packages/*'
   - 'apps/*'
-  - '../klz-2026'

scripts/cms-apply.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+
+# Configuration
+PROJECT="infra-cms"
+LOCAL_SCHEMA_PATH="./packages/cms-infra/schema/snapshot.yaml"
+REMOTE_HOST="root@infra.mintel.me"
+REMOTE_DIR="/opt/infra/directus"
+
+ENV=$1
+
+if [ -z "$ENV" ]; then
+    echo "Usage: ./scripts/cms-apply.sh [local|infra]"
+    exit 1
+fi
+
+case $ENV in
+  local)
+    PROJECT="infra-cms"
+    CMD_PREFIX="docker-compose -f packages/cms-infra/docker-compose.yml"
+    
+    LOCAL_CONTAINER=$($CMD_PREFIX ps -q $PROJECT)
+    if [ -z "$LOCAL_CONTAINER" ]; then
+        echo "❌ Local $PROJECT container not found. Is it running?"
+        exit 1
+    fi
+
+    echo "🚀 Applying schema to LOCAL $PROJECT..."
+    docker exec "$LOCAL_CONTAINER" npx directus schema apply -y /directus/schema/snapshot.yaml
+    ;;
+  infra)
+    # 'infra' is the remote production server for at-mintel
+    PROJECT="directus" # Remote project name
+    
+    echo "🔍 Detecting remote container..."
+    REMOTE_CONTAINER=$(ssh "$REMOTE_HOST" "docker ps --filter label=com.docker.compose.project=$PROJECT --filter label=com.docker.compose.service=directus -q")
+    
+    if [ -z "$REMOTE_CONTAINER" ]; then
+        # Fallback to older name if labels fail
+        REMOTE_CONTAINER=$(ssh "$REMOTE_HOST" "docker ps -f name=directus-directus-1 -q")
+    fi
+
+    if [ -z "$REMOTE_CONTAINER" ]; then
+        echo "❌ Remote container for $ENV not found."
+        exit 1
+    fi
+
+    echo "📦 Syncing extensions to REMOTE $ENV..."
+    # Ensure remote directory exists
+    ssh "$REMOTE_HOST" "mkdir -p $REMOTE_DIR/extensions"
+    rsync -avz --delete ./packages/cms-infra/extensions/ "$REMOTE_HOST:$REMOTE_DIR/extensions/"
+    
+    echo "📤 Injecting snapshot directly into container $REMOTE_CONTAINER..."
+    # Inject file via stdin to avoid needing a host-side mount or scp path matching
+    ssh "$REMOTE_HOST" "docker exec -i $REMOTE_CONTAINER sh -c 'cat > /tmp/snapshot.yaml'" < "$LOCAL_SCHEMA_PATH"
+    
+    echo "🚀 Applying schema to REMOTE $ENV..."
+    ssh "$REMOTE_HOST" "docker exec $REMOTE_CONTAINER npx directus schema apply -y /tmp/snapshot.yaml"
+    
+    echo "🔄 Restarting remote Directus to clear cache..."
+    ssh "$REMOTE_HOST" "cd $REMOTE_DIR && docker compose restart directus"
+    
+    # Cleanup
+    ssh "$REMOTE_HOST" "docker exec $REMOTE_CONTAINER rm /tmp/snapshot.yaml"
+    ;;
+  *)
+    echo "❌ Invalid environment: $ENV. Supported: local, infra."
+    exit 1
+    ;;
+esac
+
+echo "✨ Schema apply complete!"

scripts/cms-snapshot.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+# Configuration
+PROJECT="infra-cms"
+SCHEMA_PATH="./packages/cms-infra/schema/snapshot.yaml"
+CMD_PREFIX="docker-compose -f packages/cms-infra/docker-compose.yml"
+
+# Detect local container
+LOCAL_CONTAINER=$($CMD_PREFIX ps -q $PROJECT)
+
+if [ -z "$LOCAL_CONTAINER" ]; then
+    echo "❌ Local $PROJECT container not found. Is it running?"
+    exit 1
+fi
+
+echo "📸 Creating schema snapshot for local $PROJECT..."
+# Note: we save it to the mounted volume path inside the container
+docker exec "$LOCAL_CONTAINER" npx directus schema snapshot -y /directus/schema/snapshot.yaml
+
+echo "🛠️ Repairing snapshot for Postgres compatibility..."
+python3 ./scripts/fix_snapshot_v3.py
+
+echo "✅ Snapshot saved and repaired at $SCHEMA_PATH"

scripts/fix_snapshot_v3.py

@@ -0,0 +1,96 @@
+import sys
+import os
+
+path = '/Users/marcmintel/Projects/at-mintel/packages/cms-infra/schema/snapshot.yaml'
+if not os.path.exists(path):
+    print(f"File not found: {path}")
+    sys.exit(1)
+
+with open(path, 'r') as f:
+    lines = f.readlines()
+
+new_lines = []
+current_collection = None
+current_field = None
+in_schema = False
+
+fix_fields = {'id', 'company', 'user_created', 'user_updated', 'screenshot', 'logo', 'feedback_id'}
+uuid_fields = {'id', 'company', 'user_created', 'user_updated'}
+
+# For multi-pass logic
+snapshot_has_feedback_id = False
+
+for line in lines:
+    stripped = line.strip()
+    
+    if stripped.startswith('- collection:'):
+        current_collection = stripped.split(':')[-1].strip()
+        in_schema = False
+    elif stripped.startswith('field:'):
+        current_field = stripped.split(':')[-1].strip()
+        if current_collection == 'visual_feedback_comments' and current_field == 'feedback_id':
+             snapshot_has_feedback_id = True
+    elif stripped == 'schema:':
+        in_schema = True
+    elif stripped == 'meta:' or stripped.startswith('- collection:') or (not line.startswith(' ') and line.strip() and not line.startswith('-')):
+        in_schema = False
+        
+    # Top-level field type
+    if not in_schema and stripped.startswith('type:') and current_field in uuid_fields:
+        line = line.replace('type: string', 'type: uuid')
+    
+    # Schema data type
+    if in_schema and current_field in fix_fields:
+        if 'data_type: char' in line or 'data_type: varchar' in line:
+            line = line.replace('data_type: char', 'data_type: uuid').replace('data_type: varchar', 'data_type: uuid')
+        if 'max_length:' in line:
+            line = '      max_length: null\n'
+            
+    new_lines.append(line)
+
+# Handle Missing feedback_id Injection
+if not snapshot_has_feedback_id:
+    # We find systemFields and inject before it
+    injected = False
+    final_lines = []
+    feedback_id_block = """  - collection: visual_feedback_comments
+    field: feedback_id
+    type: integer
+    meta:
+      collection: visual_feedback_comments
+      field: feedback_id
+      interface: select-dropdown-m2o
+      required: true
+      sort: 4
+      width: full
+    schema:
+      name: feedback_id
+      table: visual_feedback_comments
+      data_type: integer
+      is_nullable: false
+      is_indexed: true
+      foreign_key_table: visual_feedback
+      foreign_key_column: id
+"""
+    for line in new_lines:
+        if 'systemFields:' in line and not injected:
+            final_lines.append(feedback_id_block)
+            injected = True
+        final_lines.append(line)
+    new_lines = final_lines
+
+# Second pass for primary key nullability
+final_lines = []
+for i in range(len(new_lines)):
+    line = new_lines[i]
+    if 'is_primary_key: true' in line:
+        # Search backwards and forwards
+        for j in range(max(0, i-10), min(len(new_lines), i+10)):
+            if 'is_nullable: true' in new_lines[j]:
+                new_lines[j] = new_lines[j].replace('is_nullable: true', 'is_nullable: false')
+    final_lines.append(line)
+
+with open(path, 'w') as f:
+    f.writelines(new_lines)
+
+print("SUCCESS: Full normalization and field injection complete.")

scripts/sync-directus.sh

@@ -0,0 +1,123 @@
+#!/bin/bash
+
+# Configuration
+REMOTE_HOST="root@infra.mintel.me"
+REMOTE_DIR="/opt/infra/directus"
+
+# DB Details (matching docker-compose defaults)
+DB_USER="directus"
+DB_NAME="directus"
+
+ACTION=$1
+ENV=$2
+
+# Help
+if [ -z "$ACTION" ] || [ -z "$ENV" ]; then
+    echo "Usage: ./scripts/sync-directus.sh [push|pull] [infra|testing|staging|production]"
+    echo ""
+    echo "Commands:"
+    echo "  push   Sync LOCAL data -> REMOTE"
+    echo "  pull   Sync REMOTE data -> LOCAL"
+    echo ""
+    echo "Environments:"
+    echo "  infra (infra.mintel.me)"
+    exit 1
+fi
+
+# Map Environment
+case $ENV in
+  infra)
+    PROJECT_NAME="directus"
+    ;;
+  *)
+    echo "❌ Invalid environment: $ENV. Only 'infra' is currently configured for monorepo sync."
+    exit 1
+    ;;
+esac
+
+# Detect local containers
+echo "🔍 Detecting local database..."
+LOCAL_DB_CONTAINER=$(docker compose ps -q directus-db)
+if [ -z "$LOCAL_DB_CONTAINER" ]; then
+    echo "❌ Local directus-db container not found. Is it running? (npm run dev)"
+    exit 1
+fi
+
+if [ "$ACTION" == "push" ]; then
+    echo "🚀 Pushing Local Data to $ENV..."
+    
+    # 1. DB Dump
+    echo "📦 Dumping local database..."
+    docker exec "$LOCAL_DB_CONTAINER" pg_dump -U "$DB_USER" --clean --if-exists --no-owner --no-privileges "$DB_NAME" > dump.sql
+    
+    # 2. Upload Dump
+    echo "📤 Uploading dump to remote server..."
+    scp dump.sql "$REMOTE_HOST:$REMOTE_DIR/dump.sql"
+    
+    # 3. Restore on Remote
+    echo "🔄 Restoring dump on $ENV..."
+    REMOTE_DB_CONTAINER=$(ssh "$REMOTE_HOST" "cd $REMOTE_DIR && docker compose -p $PROJECT_NAME ps -q directus-postgres")
+
+    if [ -z "$REMOTE_DB_CONTAINER" ]; then
+        echo "❌ Remote $ENV-db container not found!"
+        exit 1
+    fi
+
+    # Wipe remote DB clean before restore to avoid constraint errors
+    echo "🧹 Wiping remote database schema..."
+    ssh "$REMOTE_HOST" "docker exec $REMOTE_DB_CONTAINER psql -U $DB_USER $DB_NAME -c 'DROP SCHEMA public CASCADE; CREATE SCHEMA public;'"
+    
+    echo "⚡ Restoring database..."
+    ssh "$REMOTE_HOST" "docker exec -i $REMOTE_DB_CONTAINER psql -U $DB_USER $DB_NAME < $REMOTE_DIR/dump.sql"
+    
+    # 4. Sync Uploads
+    echo "📁 Syncing uploads (Local -> $ENV)..."
+    rsync -avz --progress ./directus/uploads/ "$REMOTE_HOST:$REMOTE_DIR/uploads/"
+    
+    # Clean up
+    rm dump.sql
+    ssh "$REMOTE_HOST" "rm $REMOTE_DIR/dump.sql"
+    
+    # 5. Restart Directus to trigger migrations and refresh schema cache
+    echo "🔄 Restarting remote Directus to apply migrations..."
+    ssh "$REMOTE_HOST" "cd $REMOTE_DIR && docker compose -p $PROJECT_NAME restart directus"
+    
+    echo "✨ Push to $ENV complete!"
+
+elif [ "$ACTION" == "pull" ]; then
+    echo "📥 Pulling $ENV Data to Local..."
+    
+    # 1. DB Dump on Remote
+    echo "📦 Dumping remote database ($ENV)..."
+    REMOTE_DB_CONTAINER=$(ssh "$REMOTE_HOST" "cd $REMOTE_DIR && docker compose -p $PROJECT_NAME ps -q directus-postgres")
+
+    if [ -z "$REMOTE_DB_CONTAINER" ]; then
+        echo "❌ Remote $ENV-db container not found!"
+        exit 1
+    fi
+    ssh "$REMOTE_HOST" "docker exec $REMOTE_DB_CONTAINER pg_dump -U $DB_USER --clean --if-exists --no-owner --no-privileges $DB_NAME > $REMOTE_DIR/dump.sql"
+    
+    # 2. Download Dump
+    echo "📥 Downloading dump..."
+    scp "$REMOTE_HOST:$REMOTE_DIR/dump.sql" dump.sql
+    
+    # Wipe local DB clean before restore to avoid constraint errors
+    echo "🧹 Wiping local database schema..."
+    docker exec "$LOCAL_DB_CONTAINER" psql -U "$DB_USER" "$DB_NAME" -c 'DROP SCHEMA public CASCADE; CREATE SCHEMA public;'
+    
+    echo "⚡ Restoring database locally..."
+    docker exec -i "$LOCAL_DB_CONTAINER" psql -U "$DB_USER" "$DB_NAME" < dump.sql
+    
+    # 4. Sync Uploads
+    echo "📁 Syncing uploads ($ENV -> Local)..."
+    rsync -avz --progress "$REMOTE_HOST:$REMOTE_DIR/uploads/" ./directus/uploads/
+    
+    # Clean up
+    rm dump.sql
+    ssh "$REMOTE_HOST" "rm $REMOTE_DIR/dump.sql"
+    
+    echo "✨ Pull to Local complete!"
+else
+    echo "Invalid action: $ACTION. Use push or pull."
+    exit 1
+fi

scripts/sync-extensions.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+
+# Configuration
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+EXTENSIONS_ROOT="$REPO_ROOT/packages"
+TARGET_DIR="$REPO_ROOT/packages/cms-infra/extensions"
+
+# List of extensions to sync - including modules and endpoints
+EXTENSIONS=(
+  "acquisition"
+  "acquisition-manager"
+  "customer-manager"
+  "feedback-commander"
+  "people-manager"
+)
+
+echo "🚀 Starting extension sync..."
+
+# Ensure target directory exists
+mkdir -p "$TARGET_DIR"
+
+for EXT in "${EXTENSIONS[@]}"; do
+  EXT_PATH="$EXTENSIONS_ROOT/$EXT"
+  
+  if [ -d "$EXT_PATH" ]; then
+    echo "📦 Building $EXT..."
+    
+    # Build the extension
+    # We use --if-present to avoid errors if build script is missing
+    (cd "$EXT_PATH" && pnpm build)
+    
+    # Create target directory for this extension
+    # Directus expects extensions to be in subdirectories matching their name
+    mkdir -p "$TARGET_DIR/$EXT"
+    
+    echo "🚚 Syncing $EXT to $TARGET_DIR/$EXT..."
+    
+    # Clean target first to avoid ghost files
+    rm -rf "${TARGET_DIR:?}/$EXT"/*
+    
+    # Copy build artifacts and package metadata
+    # Some extensions have index.js in root after build, some use dist/
+    # We check for index.js and package.json
+    if [ -f "$EXT_PATH/index.js" ]; then
+        cp "$EXT_PATH/index.js" "$TARGET_DIR/$EXT/"
+    fi
+    
+    if [ -f "$EXT_PATH/package.json" ]; then
+        cp "$EXT_PATH/package.json" "$TARGET_DIR/$EXT/"
+    fi
+
+    if [ -d "$EXT_PATH/dist" ]; then
+        cp -r "$EXT_PATH/dist" "$TARGET_DIR/$EXT/"
+    fi
+    
+    # Sync node_modules if they exist (sometimes needed if not everything is bundled)
+    if [ -d "$EXT_PATH/node_modules" ]; then
+       echo "📚 Syncing node_modules for $EXT..."
+       rsync -a --delete "$EXT_PATH/node_modules/" "$TARGET_DIR/$EXT/node_modules/"
+    fi
+
+    echo "✅ $EXT synced."
+  else
+    echo "❌ Extension source not found: $EXT_PATH"
+  fi
+done
+
+echo "✨ Extension sync complete!"

scripts/sync-versions.ts

@@ -1,11 +1,51 @@
 import * as fs from "fs";
 import * as path from "path";
 
-const tag = process.env.GITHUB_REF_NAME || process.env.TAG;
+import { execSync } from "child_process";
 
-if (!tag || !tag.startsWith("v")) {
-  console.error("❌ No valid tag found (must start with v, e.g., v1.0.0)");
-  process.exit(1);
+/**
+ * Gets the current version tag from arguments, environment or git.
+ */
+function getVersionTag() {
+  // 0. Check arguments (passed from husky hook or manual run)
+  const argTag = process.argv.slice(2).find((arg) => arg.startsWith("v"));
+  if (argTag) {
+    return argTag;
+  }
+
+  // 1. Check CI environment variables
+  if (
+    process.env.GITHUB_REF_NAME &&
+    process.env.GITHUB_REF_NAME.startsWith("v")
+  ) {
+    return process.env.GITHUB_REF_NAME;
+  }
+  if (process.env.TAG && process.env.TAG.startsWith("v")) {
+    return process.env.TAG;
+  }
+
+  // 2. Try to get it from local git
+  try {
+    const gitTag = execSync("git describe --tags --abbrev=0", {
+      encoding: "utf8",
+    }).trim();
+    if (gitTag && gitTag.startsWith("v")) {
+      return gitTag;
+    }
+  } catch (e) {
+    // Fallback or silence
+  }
+
+  return null;
+}
+
+const tag = getVersionTag();
+
+if (!tag) {
+  console.log(
+    "ℹ️ No version tag found (starting with v). Skipping version sync.",
+  );
+  process.exit(0); // Exit gracefully if no tag is present
 }
 
 const version = tag.replace(/^v/, "");
@@ -33,20 +73,50 @@ function updatePkg(pkgPath: string) {
   console.log(`✅ Updated ${pkg.name} to ${version}`);
 }
 
+/**
+ * Updates the IMAGE_TAG in .env files.
+ */
+function updateEnv(envPath: string) {
+  if (!fs.existsSync(envPath)) return;
+  let content = fs.readFileSync(envPath, "utf-8");
+
+  if (content.includes("IMAGE_TAG=")) {
+    content = content.replace(/IMAGE_TAG=.*/g, `IMAGE_TAG=${tag}`);
+  } else {
+    // Proactively add it if missing
+    if (content.includes("# Project")) {
+      content = content.replace("# Project", `# Project\nIMAGE_TAG=${tag}`);
+    } else {
+      content = `IMAGE_TAG=${tag}\n${content}`;
+    }
+  }
+
+  fs.writeFileSync(envPath, content);
+  console.log(`✅ Updated IMAGE_TAG in ${envPath} to ${tag}`);
+}
+
 // Update root
 rootPkg.version = version;
 fs.writeFileSync("package.json", JSON.stringify(rootPkg, null, 2) + "\n");
 
 // Update all packages
-const packages = fs.readdirSync(packagesDir);
-for (const p of packages) {
-  updatePkg(path.join(packagesDir, p, "package.json"));
+if (fs.existsSync(packagesDir)) {
+  const packages = fs.readdirSync(packagesDir);
+  for (const p of packages) {
+    updatePkg(path.join(packagesDir, p, "package.json"));
+  }
 }
 
 // Update all apps
-const apps = fs.readdirSync(appsDir);
-for (const a of apps) {
-  updatePkg(path.join(appsDir, a, "package.json"));
+if (fs.existsSync(appsDir)) {
+  const apps = fs.readdirSync(appsDir);
+  for (const a of apps) {
+    updatePkg(path.join(appsDir, a, "package.json"));
+  }
 }
 
+// Update .env files
+updateEnv(".env");
+updateEnv(".env.example");
+
 console.log("✨ All versions synced!");