bsmnt 0.4.3 → 0.5.0

package/src/modules/features/cms/sanity-pagebuilder/files/lib/utils/rss.ts

@@ -0,0 +1,96 @@
+export interface RssFeedItem {
+	title: string;
+	link: string;
+	description?: string | undefined;
+	pubDate?: string | undefined;
+	authors?: string[] | undefined;
+	category?: string | undefined;
+}
+
+export interface RssFeedConfig {
+	title: string;
+	link: string;
+	description: string;
+	feedUrl: string;
+	language?: string;
+	items: RssFeedItem[];
+}
+
+function escapeXml(str: string): string {
+	return str
+		.replace(/&/g, "&")
+		.replace(/</g, "&lt;")
+		.replace(/>/g, "&gt;")
+		.replace(/"/g, "&quot;")
+		.replace(/'/g, "&apos;");
+}
+
+export function generateRssFeed(config: RssFeedConfig): Response {
+	const {
+		title,
+		link,
+		description,
+		feedUrl,
+		language = "en-us",
+		items,
+	} = config;
+
+	const itemsXml = items
+		.map((item) => {
+			const lines = [
+				`      <title>${escapeXml(item.title)}</title>`,
+				`      <link>${escapeXml(item.link)}</link>`,
+				`      <guid isPermaLink="true">${escapeXml(item.link)}</guid>`,
+			];
+
+			if (item.description) {
+				lines.push(
+					`      <description>${escapeXml(item.description)}</description>`,
+				);
+			}
+
+			const pubDate = item.pubDate ? new Date(item.pubDate) : null;
+			if (pubDate && !Number.isNaN(pubDate.getTime())) {
+				lines.push(`      <pubDate>${pubDate.toUTCString()}</pubDate>`);
+			}
+
+			for (const author of item.authors ?? []) {
+				lines.push(`      <dc:creator>${escapeXml(author)}</dc:creator>`);
+			}
+
+			if (item.category) {
+				lines.push(`      <category>${escapeXml(item.category)}</category>`);
+			}
+
+			return `    <item>\n${lines.join("\n")}\n    </item>`;
+		})
+		.join("\n");
+
+	const xml = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom">
+  <channel>
+    <title>${escapeXml(title)}</title>
+    <link>${escapeXml(link)}</link>
+    <description>${escapeXml(description)}</description>
+    <language>${language}</language>
+    <atom:link href="${escapeXml(feedUrl)}" rel="self" type="application/rss+xml" />
+${itemsXml}
+  </channel>
+</rss>`;
+
+	return new Response(xml, {
+		headers: {
+			"Content-Type": "application/rss+xml",
+		},
+	});
+}
+
+export function rssErrorResponse(): Response {
+	return new Response(
+		'<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"><channel><title>Error</title></channel></rss>',
+		{
+			status: 500,
+			headers: { "Content-Type": "application/xml" },
+		},
+	);
+}

package/src/modules/features/cms/sanity-pagebuilder/files/lib/utils/sitemap.ts

@@ -0,0 +1,40 @@
+import { PINNED_PAGE_ENTRIES } from "@/lib/integrations/sanity/pinned-pages";
+import { PAGE_SITEMAP_QUERY } from "@/lib/integrations/sanity/queries";
+import type { PAGE_SITEMAP_QUERY_RESULT } from "@/lib/integrations/sanity/sanity.types";
+import { getBaseUrl } from "./base-url";
+
+export const getSitemapBaseUrl = getBaseUrl;
+
+const getNormalizedPageSlug = (slug: string | null) => {
+	if (!slug || slug === "/") return "";
+	return slug.replace(/^\/+|\/+$/g, "");
+};
+
+export const getPagePath = (slug: string | null) => {
+	const normalizedSlug = getNormalizedPageSlug(slug);
+	return normalizedSlug ? `/${normalizedSlug}` : "/";
+};
+
+export const getPageUrl = (baseUrl: string, slug: string | null) =>
+	new URL(getPagePath(slug), baseUrl).toString();
+
+export const getMarkdownPath = (baseUrl: string, slug: string | null) => {
+	const normalizedSlug = getNormalizedPageSlug(slug);
+
+	return normalizedSlug
+		? `${baseUrl}/${normalizedSlug}.md`
+		: `${baseUrl}/index.md`;
+};
+
+export const getSitemap = async () => {
+	const sanityModule = await import("@/lib/integrations/sanity/client");
+	const client = sanityModule?.client;
+
+	if (!client) return null;
+
+	const p = await client.fetch<PAGE_SITEMAP_QUERY_RESULT>(PAGE_SITEMAP_QUERY, {
+		pinnedIds: PINNED_PAGE_ENTRIES.map((entry) => entry.id),
+	});
+
+	return p;
+};

package/src/modules/features/cms/sanity-pagebuilder/files/proxy.ts

@@ -0,0 +1,81 @@
+import type { NextRequest } from "next/server";
+import { NextResponse } from "next/server";
+import {
+	acceptHeaderRoutes,
+	ignoredPaths,
+	mdExtensionRoutes,
+} from "@/lib/integrations/sanity/markdown-proxy.config";
+
+export function proxy(request: NextRequest) {
+	const { pathname } = request.nextUrl;
+	const acceptHeader = request.headers.get("accept") || "";
+
+	if (ignoredPaths.some((p) => pathname.startsWith(p))) {
+		return NextResponse.next();
+	}
+
+	if (pathname === "/" && acceptHeader.includes("text/markdown")) {
+		const url = request.nextUrl.clone();
+		url.pathname = "/api/index.md";
+		return NextResponse.rewrite(url);
+	}
+
+	// 1. Rewrite .md extension URLs to API routes
+	//    e.g. /about.md → /api/about.md
+	for (const route of mdExtensionRoutes) {
+		const match = route.regex.exec(pathname);
+		const slug = match?.[1];
+		if (slug) {
+			const url = request.nextUrl.clone();
+			url.pathname = route.apiPath.replace("[slug]", slug);
+			return NextResponse.rewrite(url);
+		}
+	}
+
+	// 2. Accept: text/markdown — rewrite to markdown API route
+	if (acceptHeader.includes("text/markdown")) {
+		for (const route of acceptHeaderRoutes) {
+			const match = route.regex.exec(pathname);
+			const slug = match?.[1];
+			if (slug) {
+				const url = request.nextUrl.clone();
+				url.pathname = route.apiPath.replace("[slug]", slug);
+				return NextResponse.rewrite(url);
+			}
+		}
+	}
+
+	// 3. Add Link header for markdown discoverability on HTML page requests
+	const response = NextResponse.next();
+
+	if (pathname === "/") {
+		response.headers.set(
+			"Link",
+			'</index.md>; rel="alternate"; type="text/markdown"',
+		);
+		response.headers.set("Vary", "Accept");
+		return response;
+	}
+
+	for (const route of acceptHeaderRoutes) {
+		const match = route.regex.exec(pathname);
+		const slug = match?.[1];
+		if (slug) {
+			const mdUrl = route.publicPath.replace("[slug]", slug);
+			response.headers.set(
+				"Link",
+				`<${mdUrl}>; rel="alternate"; type="text/markdown"`,
+			);
+			response.headers.set("Vary", "Accept");
+			break;
+		}
+	}
+
+	return response;
+}
+
+export const config = {
+	matcher: [
+		"/((?!_next/static|_next/image|favicon.ico|sitemap.xml|sitemap.md|robots.txt).*)",
+	],
+};

package/src/templates/next-default/.github/workflows/ci.yml

@@ -0,0 +1,62 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Node version is read from .nvmrc — the single source of truth.
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      # Bun version is read from package.json's "packageManager" field — the
+      # single source of truth. Do NOT pin a version here, or the two can drift.
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      # Cache Bun's global install cache so dependencies aren't re-downloaded
+      # on every run. Keyed on the lockfile so it busts when deps change.
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Type check
+        run: bun run typecheck:compare
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Build
+        run: bun run build
+
+      # Runs your tests if any exist; a fresh project with none passes cleanly.
+      - name: Test
+        run: |
+          if git ls-files '*.test.*' '*.spec.*' '*_test.*' '*_spec.*' | grep -q .; then
+            bun test
+          else
+            echo "No test files found — skipping bun test."
+          fi
+
+      - name: Knip
+        run: bun run knip

package/src/templates/next-default/README.md

@@ -48,3 +48,25 @@ lib/
 - Edit `lib/styles/tokens.css` for theme variables, breakpoints, and custom Tailwind utilities.
 - Edit `lib/styles/global.css` for reset rules and app-wide global styles.
 - `lib/styles/fonts.ts` handles font variables.
+
+## Continuous Integration
+
+A GitHub Actions workflow (`.github/workflows/ci.yml`) runs on every pull request to `main` and on pushes to `main`. It runs type checking, linting, the production build, tests, and `knip`.
+
+The workflow takes its runtime versions from your manifests, so there's a single source of truth and nothing to keep in sync by hand:
+
+- **Node** comes from `.nvmrc`.
+- **Bun** comes from the `packageManager` field in `package.json`.
+
+It also caches Bun's install cache between runs, and the test step is a no-op until you add real test files.
+
+### Branch protection
+
+To block merges when CI fails, enable branch protection on `main`:
+
+1. Go to **Settings → Branches → Add branch ruleset** (or **Add rule**).
+2. Target the `main` branch.
+3. Enable **Require status checks to pass before merging** and select the **CI** check.
+4. (Recommended) Enable **Require a pull request before merging**.
+
+Pull requests then cannot be merged until the CI workflow passes.

package/src/templates/next-default/knip.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://unpkg.com/knip@6/schema.json",
+  "entry": [
+    "lib/scripts/**/*.{ts,tsx}",
+    "lib/hooks/**/*.{ts,tsx}",
+    "lib/utils/**/*.{ts,tsx}",
+    "lib/renderer.ts",
+    "components/**/*.{ts,tsx}"
+  ],
+  "ignoreDependencies": [
+    "zod",
+    "@svgr/webpack"
+  ]
+}

package/src/templates/next-default/lefthook.yml

@@ -14,6 +14,11 @@ pre-commit:
       run: bunx tsgo --noEmit --incremental false
       stage_fixed: false
 
+pre-push:
+  commands:
+    knip:
+      run: bun run knip
+
 post-merge:
   commands:
     install-deps:

package/src/templates/next-default/package.json

@@ -3,7 +3,10 @@
   "description": "Basement Next.js starter template",
   "version": "0.1.0",
   "private": true,
-  "packageManager": "bun@1.3.5",
+  "packageManager": "bun@1.3.14",
+  "engines": {
+    "node": ">=24"
+  },
   "scripts": {
     "analyze": "cross-env ANALYZE=true bun run build",
     "analyze:experimental": "next experimental-analyze",
@@ -12,8 +15,8 @@
     "dev:https": "bun ./lib/scripts/dev.ts --https",
     "dev:inspect": "bun ./lib/scripts/dev.ts --inspect",
     "format": "biome format --write .",
-    "knip": "bunx knip",
-    "knip:fix": "bunx knip --fix",
+    "knip": "knip",
+    "knip:fix": "knip --fix",
     "lighthouse": "bunx @unlighthouse/cli --site http://localhost:3000",
     "lint": "biome lint --max-diagnostics=200",
     "lint:fix": "biome check --write --unsafe --max-diagnostics=200",
@@ -39,12 +42,13 @@
     "@svgr/webpack": "^8.1.0",
     "@tailwindcss/postcss": "^4",
     "@types/bun": "^1.3.6",
-    "@types/node": "^20.19.30",
+    "@types/node": "^24.13.1",
     "@types/react": "^19.2.9",
     "@types/react-dom": "^19.2.3",
     "@typescript/native-preview": "^7.0.0-dev.20260122.3",
     "babel-plugin-react-compiler": "^1.0.0",
     "cross-env": "^10.1.0",
+    "knip": "^6.16.1",
     "lefthook": "^1.13.0",
     "postcss-preset-env": "^10.6.1",
     "schema-dts": "^2.0.0",

package/src/templates/next-experiments/.github/workflows/ci.yml

@@ -0,0 +1,62 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Node version is read from .nvmrc — the single source of truth.
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      # Bun version is read from package.json's "packageManager" field — the
+      # single source of truth. Do NOT pin a version here, or the two can drift.
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      # Cache Bun's global install cache so dependencies aren't re-downloaded
+      # on every run. Keyed on the lockfile so it busts when deps change.
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Type check
+        run: bun run typecheck:compare
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Build
+        run: bun run build
+
+      # Runs your tests if any exist; a fresh project with none passes cleanly.
+      - name: Test
+        run: |
+          if git ls-files '*.test.*' '*.spec.*' '*_test.*' '*_spec.*' | grep -q .; then
+            bun test
+          else
+            echo "No test files found — skipping bun test."
+          fi
+
+      - name: Knip
+        run: bun run knip

package/src/templates/next-experiments/README.md

@@ -48,3 +48,25 @@ lib/
 - Edit `lib/styles/tokens.css` for theme variables, breakpoints, and custom Tailwind utilities.
 - Edit `lib/styles/global.css` for reset rules and app-wide global styles.
 - `lib/styles/fonts.ts` handles font variables.
+
+## Continuous Integration
+
+A GitHub Actions workflow (`.github/workflows/ci.yml`) runs on every pull request to `main` and on pushes to `main`. It runs type checking, linting, the production build, tests, and `knip`.
+
+The workflow takes its runtime versions from your manifests, so there's a single source of truth and nothing to keep in sync by hand:
+
+- **Node** comes from `.nvmrc`.
+- **Bun** comes from the `packageManager` field in `package.json`.
+
+It also caches Bun's install cache between runs, and the test step is a no-op until you add real test files.
+
+### Branch protection
+
+To block merges when CI fails, enable branch protection on `main`:
+
+1. Go to **Settings → Branches → Add branch ruleset** (or **Add rule**).
+2. Target the `main` branch.
+3. Enable **Require status checks to pass before merging** and select the **CI** check.
+4. (Recommended) Enable **Require a pull request before merging**.
+
+Pull requests then cannot be merged until the CI workflow passes.

package/src/templates/next-experiments/knip.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://unpkg.com/knip@6/schema.json",
+  "entry": [
+    "lib/scripts/**/*.{ts,tsx}",
+    "lib/hooks/**/*.{ts,tsx}",
+    "lib/utils/**/*.{ts,tsx}",
+    "components/**/*.{ts,tsx}"
+  ],
+  "ignoreDependencies": [
+    "zod",
+    "three",
+    "@svgr/webpack"
+  ]
+}

package/src/templates/next-experiments/lefthook.yml

@@ -0,0 +1,30 @@
+# Lefthook configuration for git hooks
+# Cross-platform compatible (Windows, macOS, Linux)
+# https://github.com/evilmartians/lefthook
+
+pre-commit:
+  parallel: true
+  commands:
+    biome:
+      glob: '*.{js,mjs,ts,jsx,tsx,css,scss}'
+      run: bun biome check --max-diagnostics=200 --write --unsafe {staged_files}
+      stage_fixed: true
+    typecheck:
+      glob: '*.{ts,tsx}'
+      run: bunx tsgo --noEmit --incremental false
+      stage_fixed: false
+
+pre-push:
+  commands:
+    knip:
+      run: bun run knip
+
+post-merge:
+  commands:
+    install-deps:
+      run: bun i
+
+post-checkout:
+  commands:
+    install-deps:
+      run: '[ "{3}" = "1" ] && bun i || true'

package/src/templates/next-experiments/package.json

@@ -3,7 +3,10 @@
   "description": "Basement Next.js starter template",
   "version": "0.1.0",
   "private": true,
-  "packageManager": "bun@1.3.5",
+  "packageManager": "bun@1.3.14",
+  "engines": {
+    "node": ">=24"
+  },
   "scripts": {
     "analyze": "cross-env ANALYZE=true bun run build",
     "analyze:experimental": "next experimental-analyze",
@@ -12,9 +15,12 @@
     "dev:https": "bun ./lib/scripts/dev.ts --https",
     "dev:inspect": "bun ./lib/scripts/dev.ts --inspect",
     "format": "biome format --write .",
+    "knip": "knip",
+    "knip:fix": "knip --fix",
     "lighthouse": "bunx @unlighthouse/cli --site http://localhost:3000",
     "lint": "biome lint --max-diagnostics=200",
     "lint:fix": "biome check --write --unsafe --max-diagnostics=200",
+    "prepare": "lefthook install",
     "start": "next start",
     "typecheck": "tsgo --noEmit",
     "typecheck:compare": "bun run typecheck:tsc && bun run typecheck",
@@ -38,12 +44,14 @@
     "@svgr/webpack": "^8.1.0",
     "@tailwindcss/postcss": "^4",
     "@types/bun": "^1.3.6",
-    "@types/node": "^20.19.30",
+    "@types/node": "^24.13.1",
     "@types/react": "^19.2.9",
     "@types/react-dom": "^19.2.3",
     "@typescript/native-preview": "^7.0.0-dev.20260122.3",
     "babel-plugin-react-compiler": "^1.0.0",
     "cross-env": "^10.1.0",
+    "knip": "^6.16.1",
+    "lefthook": "^1.13.0",
     "postcss-preset-env": "^10.6.1",
     "schema-dts": "^2.0.0",
     "tailwindcss": "^4",

package/src/templates/next-pagebuilder/.github/workflows/ci.yml

@@ -0,0 +1,70 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Node version is read from .nvmrc — the single source of truth.
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      # Bun version is read from package.json's "packageManager" field — the
+      # single source of truth. Do NOT pin a version here, or the two can drift.
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      # Cache Bun's global install cache so dependencies aren't re-downloaded
+      # on every run. Keyed on the lockfile so it busts when deps change.
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Type check
+        run: bun run typecheck:compare
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Build
+        run: bun run build
+        env:
+          # Sanity project ID and dataset are public (they ship in the client
+          # bundle), so they are stored as repository variables. The Sanity read
+          # token is secret — add it under Settings → Secrets and variables →
+          # Actions. All three are empty (and harmless) until Sanity is set up.
+          NEXT_PUBLIC_SANITY_PROJECT_ID: ${{ vars.NEXT_PUBLIC_SANITY_PROJECT_ID }}
+          NEXT_PUBLIC_SANITY_DATASET: ${{ vars.NEXT_PUBLIC_SANITY_DATASET }}
+          SANITY_API_READ_TOKEN: ${{ secrets.SANITY_API_READ_TOKEN }}
+
+      # Runs your tests if any exist; a fresh project with none passes cleanly.
+      - name: Test
+        run: |
+          if git ls-files '*.test.*' '*.spec.*' '*_test.*' '*_spec.*' | grep -q .; then
+            bun test
+          else
+            echo "No test files found — skipping bun test."
+          fi
+
+      - name: Knip
+        run: bun run knip

package/src/templates/next-pagebuilder/README.md

@@ -21,3 +21,37 @@ bun dev
 - `bun build` - Production build
 - `bun lint` - Run linter
 - `bun sanity:typegen` - Generate Sanity types
+
+## Continuous Integration
+
+A GitHub Actions workflow (`.github/workflows/ci.yml`) runs on every pull request to `main` and on pushes to `main`. It runs type checking, linting, the production build, tests, and `knip`.
+
+The workflow takes its runtime versions from your manifests, so there's a single source of truth and nothing to keep in sync by hand:
+
+- **Node** comes from `.nvmrc`.
+- **Bun** comes from the `packageManager` field in `package.json`.
+
+It also caches Bun's install cache between runs, and the test step is a no-op until you add real test files.
+
+### Sanity environment
+
+The build reads Sanity config from GitHub Actions variables/secrets (empty and harmless until you configure Sanity). Once your repo is on GitHub, the quickest way to set them is:
+
+```bash
+bun run ci:secrets
+```
+
+This reads the values from `.env.local` and pushes them to this repo with the GitHub CLI — `NEXT_PUBLIC_SANITY_PROJECT_ID` / `NEXT_PUBLIC_SANITY_DATASET` as **Variables** (they are public) and `SANITY_API_READ_TOKEN` as a **Secret**. Requires the [GitHub CLI](https://cli.github.com), authenticated (`gh auth login`).
+
+To set them by hand instead, go to **Settings → Secrets and variables → Actions** and add the two `NEXT_PUBLIC_*` values under **Variables** and the token under **Secrets**.
+
+### Branch protection
+
+To block merges when CI fails, enable branch protection on `main`:
+
+1. Go to **Settings → Branches → Add branch ruleset** (or **Add rule**).
+2. Target the `main` branch.
+3. Enable **Require status checks to pass before merging** and select the **CI** check.
+4. (Recommended) Enable **Require a pull request before merging**.
+
+Pull requests then cannot be merged until the CI workflow passes.

package/src/templates/next-pagebuilder/app/(content)/[[...slug]]/page.tsx

@@ -10,6 +10,7 @@ import type {
   ALL_PAGE_SLUGS_QUERY_RESULT,
   PAGE_QUERY_RESULT,
 } from "@/lib/integrations/sanity/sanity.types"
+import { checkRedirect } from "@/lib/utils/check-redirect"
 import { generateSanityMetadata } from "@/lib/utils/metadata"
 import { getSlugTag } from "@/lib/utils/slug-tag"
 
@@ -71,7 +72,11 @@ export default async function CatchAllPage({
   const path = toPath(slug)
   const page = await getResolvedPage(path)
 
-  if (!page) notFound()
+  if (!page) {
+    // Fall back to a CMS redirect before 404ing.
+    await checkRedirect(path)
+    notFound()
+  }
 
   return <PageDocument page={page} path={path} searchParams={searchParams} />
 }