bsmnt 0.4.3 → 0.6.0

package/src/modules/features/cms/sanity-pagebuilder/files/lib/utils/rss.ts

@@ -0,0 +1,96 @@
+export interface RssFeedItem {
+	title: string;
+	link: string;
+	description?: string | undefined;
+	pubDate?: string | undefined;
+	authors?: string[] | undefined;
+	category?: string | undefined;
+}
+
+export interface RssFeedConfig {
+	title: string;
+	link: string;
+	description: string;
+	feedUrl: string;
+	language?: string;
+	items: RssFeedItem[];
+}
+
+function escapeXml(str: string): string {
+	return str
+		.replace(/&/g, "&")
+		.replace(/</g, "&lt;")
+		.replace(/>/g, "&gt;")
+		.replace(/"/g, "&quot;")
+		.replace(/'/g, "&apos;");
+}
+
+export function generateRssFeed(config: RssFeedConfig): Response {
+	const {
+		title,
+		link,
+		description,
+		feedUrl,
+		language = "en-us",
+		items,
+	} = config;
+
+	const itemsXml = items
+		.map((item) => {
+			const lines = [
+				`      <title>${escapeXml(item.title)}</title>`,
+				`      <link>${escapeXml(item.link)}</link>`,
+				`      <guid isPermaLink="true">${escapeXml(item.link)}</guid>`,
+			];
+
+			if (item.description) {
+				lines.push(
+					`      <description>${escapeXml(item.description)}</description>`,
+				);
+			}
+
+			const pubDate = item.pubDate ? new Date(item.pubDate) : null;
+			if (pubDate && !Number.isNaN(pubDate.getTime())) {
+				lines.push(`      <pubDate>${pubDate.toUTCString()}</pubDate>`);
+			}
+
+			for (const author of item.authors ?? []) {
+				lines.push(`      <dc:creator>${escapeXml(author)}</dc:creator>`);
+			}
+
+			if (item.category) {
+				lines.push(`      <category>${escapeXml(item.category)}</category>`);
+			}
+
+			return `    <item>\n${lines.join("\n")}\n    </item>`;
+		})
+		.join("\n");
+
+	const xml = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom">
+  <channel>
+    <title>${escapeXml(title)}</title>
+    <link>${escapeXml(link)}</link>
+    <description>${escapeXml(description)}</description>
+    <language>${language}</language>
+    <atom:link href="${escapeXml(feedUrl)}" rel="self" type="application/rss+xml" />
+${itemsXml}
+  </channel>
+</rss>`;
+
+	return new Response(xml, {
+		headers: {
+			"Content-Type": "application/rss+xml",
+		},
+	});
+}
+
+export function rssErrorResponse(): Response {
+	return new Response(
+		'<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"><channel><title>Error</title></channel></rss>',
+		{
+			status: 500,
+			headers: { "Content-Type": "application/xml" },
+		},
+	);
+}

package/src/modules/features/cms/sanity-pagebuilder/files/lib/utils/sitemap.ts

@@ -0,0 +1,40 @@
+import { PINNED_PAGE_ENTRIES } from "@/lib/integrations/sanity/pinned-pages";
+import { PAGE_SITEMAP_QUERY } from "@/lib/integrations/sanity/queries";
+import type { PAGE_SITEMAP_QUERY_RESULT } from "@/lib/integrations/sanity/sanity.types";
+import { getBaseUrl } from "./base-url";
+
+export const getSitemapBaseUrl = getBaseUrl;
+
+const getNormalizedPageSlug = (slug: string | null) => {
+	if (!slug || slug === "/") return "";
+	return slug.replace(/^\/+|\/+$/g, "");
+};
+
+export const getPagePath = (slug: string | null) => {
+	const normalizedSlug = getNormalizedPageSlug(slug);
+	return normalizedSlug ? `/${normalizedSlug}` : "/";
+};
+
+export const getPageUrl = (baseUrl: string, slug: string | null) =>
+	new URL(getPagePath(slug), baseUrl).toString();
+
+export const getMarkdownPath = (baseUrl: string, slug: string | null) => {
+	const normalizedSlug = getNormalizedPageSlug(slug);
+
+	return normalizedSlug
+		? `${baseUrl}/${normalizedSlug}.md`
+		: `${baseUrl}/index.md`;
+};
+
+export const getSitemap = async () => {
+	const sanityModule = await import("@/lib/integrations/sanity/client");
+	const client = sanityModule?.client;
+
+	if (!client) return null;
+
+	const p = await client.fetch<PAGE_SITEMAP_QUERY_RESULT>(PAGE_SITEMAP_QUERY, {
+		pinnedIds: PINNED_PAGE_ENTRIES.map((entry) => entry.id),
+	});
+
+	return p;
+};

package/src/modules/features/cms/sanity-pagebuilder/files/proxy.ts

@@ -0,0 +1,81 @@
+import type { NextRequest } from "next/server";
+import { NextResponse } from "next/server";
+import {
+	acceptHeaderRoutes,
+	ignoredPaths,
+	mdExtensionRoutes,
+} from "@/lib/integrations/sanity/markdown-proxy.config";
+
+export function proxy(request: NextRequest) {
+	const { pathname } = request.nextUrl;
+	const acceptHeader = request.headers.get("accept") || "";
+
+	if (ignoredPaths.some((p) => pathname.startsWith(p))) {
+		return NextResponse.next();
+	}
+
+	if (pathname === "/" && acceptHeader.includes("text/markdown")) {
+		const url = request.nextUrl.clone();
+		url.pathname = "/api/index.md";
+		return NextResponse.rewrite(url);
+	}
+
+	// 1. Rewrite .md extension URLs to API routes
+	//    e.g. /about.md → /api/about.md
+	for (const route of mdExtensionRoutes) {
+		const match = route.regex.exec(pathname);
+		const slug = match?.[1];
+		if (slug) {
+			const url = request.nextUrl.clone();
+			url.pathname = route.apiPath.replace("[slug]", slug);
+			return NextResponse.rewrite(url);
+		}
+	}
+
+	// 2. Accept: text/markdown — rewrite to markdown API route
+	if (acceptHeader.includes("text/markdown")) {
+		for (const route of acceptHeaderRoutes) {
+			const match = route.regex.exec(pathname);
+			const slug = match?.[1];
+			if (slug) {
+				const url = request.nextUrl.clone();
+				url.pathname = route.apiPath.replace("[slug]", slug);
+				return NextResponse.rewrite(url);
+			}
+		}
+	}
+
+	// 3. Add Link header for markdown discoverability on HTML page requests
+	const response = NextResponse.next();
+
+	if (pathname === "/") {
+		response.headers.set(
+			"Link",
+			'</index.md>; rel="alternate"; type="text/markdown"',
+		);
+		response.headers.set("Vary", "Accept");
+		return response;
+	}
+
+	for (const route of acceptHeaderRoutes) {
+		const match = route.regex.exec(pathname);
+		const slug = match?.[1];
+		if (slug) {
+			const mdUrl = route.publicPath.replace("[slug]", slug);
+			response.headers.set(
+				"Link",
+				`<${mdUrl}>; rel="alternate"; type="text/markdown"`,
+			);
+			response.headers.set("Vary", "Accept");
+			break;
+		}
+	}
+
+	return response;
+}
+
+export const config = {
+	matcher: [
+		"/((?!_next/static|_next/image|favicon.ico|sitemap.xml|sitemap.md|robots.txt).*)",
+	],
+};

package/src/modules/features/env/dotenvx/files/decrypt-env.mjs

@@ -0,0 +1,45 @@
+// Print a decrypted env file to the terminal (read-only — never writes).
+//
+//   bun run env:view              # .env (shared / development)
+//   bun run env:view --preview    # .env.preview
+//   bun run env:view --prod       # .env.production
+
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+
+// This prints decrypted secrets to stdout — never where logs are captured. Most
+// CI sets `CI`; Vercel builds set `VERCEL` (not `CI`), so check both.
+if (process.env.CI || process.env.VERCEL) {
+  console.error(
+    "env:view prints decrypted secrets — refusing to run in CI / on Vercel.",
+  );
+  process.exit(1);
+}
+
+const args = process.argv.slice(2);
+const file =
+  args.includes("--prod") || args.includes("--production")
+    ? ".env.production"
+    : args.includes("--preview")
+      ? ".env.preview"
+      : ".env";
+
+// Friendlier than dotenvx's MISSING_ENV_FILE error when the file isn't created yet.
+if (!existsSync(file)) {
+  const flag =
+    file === ".env.production"
+      ? " --prod"
+      : file === ".env.preview"
+        ? " --preview"
+        : "";
+  console.error(
+    `No ${file} yet. Add values with: bun run env:set KEY value${flag}`,
+  );
+  process.exit(1);
+}
+
+// `dotenvx` resolves from node_modules/.bin when run via `bun run`.
+const res = spawnSync("dotenvx", ["decrypt", "-f", file, "--stdout"], {
+  stdio: "inherit",
+});
+process.exit(res.status ?? 1);

package/src/modules/features/env/dotenvx/files/gitleaks.yml

@@ -0,0 +1,25 @@
+name: gitleaks
+
+# Scans the PR diff for committed secrets. Encrypted values and non-secret config
+# pass; runs with --redact so values never reach the logs.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write # gitleaks comments findings on the PR
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: gitleaks/gitleaks-action@v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # The action reads GITLEAKS_LICENSE; source it from your org secret.
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE_KEY }}

package/src/modules/features/env/dotenvx/files/instrumentation.ts

@@ -0,0 +1,14 @@
+// Decrypt env at runtime on Vercel serverless, where the `dotenvx run` wrapper
+// doesn't run. Node only (dotenvx can't run on the edge).
+export async function register() {
+  if (process.env.NEXT_RUNTIME !== "nodejs") return
+
+  const { config } = await import("@dotenvx/dotenvx")
+  const vercelEnv = process.env.VERCEL_ENV
+
+  config({
+    path: vercelEnv ? [".env", `.env.${vercelEnv}`] : [".env"],
+    overload: true, // Next pre-loads the encrypted .env; overwrite with decrypted values
+    ignore: ["MISSING_ENV_FILE"], // env-specific file may not exist
+  })
+}

package/src/modules/features/env/dotenvx/files/push-keys.mjs

@@ -0,0 +1,129 @@
+// Push the dotenvx private keys from .env.keys to GitHub / Vercel so encrypted
+// envs decrypt in CI and at runtime. Each value is piped via stdin — never as a
+// CLI argument — so it doesn't land in process listings or shell history.
+//
+//   bun run env:setup-remote          # pick a target from a menu
+//   bun run env:setup-remote github   # gh secret set   for each DOTENV_PRIVATE_KEY*
+//   bun run env:setup-remote vercel   # vercel env add  for each DOTENV_PRIVATE_KEY*
+
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { createInterface } from "node:readline/promises";
+
+const TARGETS = ["github", "vercel"];
+
+// Collect every DOTENV_PRIVATE_KEY* assignment (base + per-environment) from
+// .env.keys content, stripping surrounding quotes. Skips empty values.
+export function parsePrivateKeys(content) {
+  const keys = [];
+  for (const raw of content.split("\n")) {
+    const match = raw.match(/^\s*(DOTENV_PRIVATE_KEY[A-Z_]*)\s*=\s*(.+?)\s*$/);
+    if (!match) continue;
+    const value = match[2].replace(/^["']|["']$/g, "");
+    if (value) keys.push({ name: match[1], value });
+  }
+  return keys;
+}
+
+// The base key decrypts the shared .env (loaded in every environment); a
+// suffixed key (…_PRODUCTION / …_PREVIEW) decrypts only that environment's file.
+export function vercelEnvsFor(name) {
+  const suffix = name.slice("DOTENV_PRIVATE_KEY".length).replace(/^_/, "");
+  return suffix
+    ? [suffix.toLowerCase()]
+    : ["production", "preview", "development"];
+}
+
+// Ask which remote when no arg was given. Never hang a non-interactive shell.
+async function promptTarget() {
+  if (!process.stdin.isTTY) {
+    console.error("Usage: bun run env:setup-remote github | vercel");
+    process.exit(1);
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (
+      await rl.question(
+        "Push private keys to:\n  1) GitHub secrets (CI)\n  2) Vercel env (runtime)\nSelect [1/2]: ",
+      )
+    )
+      .trim()
+      .toLowerCase();
+    if (answer === "1" || answer === "github") return "github";
+    if (answer === "2" || answer === "vercel") return "vercel";
+    console.error("Cancelled — choose 1 (GitHub) or 2 (Vercel).");
+    process.exit(1);
+  } finally {
+    rl.close();
+  }
+}
+
+// Pipe the value through stdin so it never appears in argv.
+function pipe(cmd, args, input) {
+  const res = spawnSync(cmd, args, {
+    input,
+    stdio: ["pipe", "inherit", "inherit"],
+  });
+  if (res.error?.code === "ENOENT") {
+    console.error(`\n${cmd} not found — install its CLI and sign in first.`);
+    process.exit(1);
+  }
+  return res.status === 0;
+}
+
+async function main() {
+  // Validate an explicit arg up front so a typo fails before anything else.
+  const arg = process.argv[2];
+  if (arg && !TARGETS.includes(arg)) {
+    console.error(`Unknown target "${arg}". Use: github | vercel`);
+    process.exit(1);
+  }
+
+  if (!existsSync(".env.keys")) {
+    console.error(
+      "No .env.keys found — run `bun run env:setup` to restore it first.",
+    );
+    process.exit(1);
+  }
+
+  const keys = parsePrivateKeys(readFileSync(".env.keys", "utf-8"));
+  if (keys.length === 0) {
+    console.error("No DOTENV_PRIVATE_KEY* entries found in .env.keys.");
+    process.exit(1);
+  }
+
+  const target = arg ?? (await promptTarget());
+
+  let ok = true;
+  for (const { name, value } of keys) {
+    if (target === "github") {
+      console.log(`→ gh secret set ${name}`);
+      ok = pipe("gh", ["secret", "set", name], value) && ok;
+    } else {
+      for (const env of vercelEnvsFor(name)) {
+        console.log(`→ vercel env add ${name} ${env}`);
+        ok = pipe("vercel", ["env", "add", name, env], value) && ok;
+      }
+    }
+  }
+
+  if (!ok) {
+    console.error(
+      target === "github"
+        ? "\nSome secrets failed. Check the GitHub CLI is authenticated (`gh auth login`) and the repo exists on GitHub."
+        : "\nSome env vars failed. Check the Vercel CLI is linked (`vercel link`); a var that already exists must be removed first (`vercel env rm NAME ENV`).",
+    );
+    process.exit(1);
+  }
+
+  console.log(
+    target === "vercel"
+      ? "\nDone. Redeploy for the new env vars to take effect."
+      : "\nDone.",
+  );
+}
+
+// Only run the script when invoked directly (not when imported by a test).
+if (import.meta.main) {
+  await main();
+}

package/src/modules/features/env/dotenvx/files/save-key.mjs

@@ -0,0 +1,108 @@
+// Save the private key to 1Password (Development vault) and point .env's op-ref
+// at it, so teammates restore with `bun run env:setup`. The key is piped via
+// stdin (JSON template), never passed as an argument.
+//
+//   bun run env:save
+
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { createInterface } from "node:readline/promises";
+
+const VAULT = "Development";
+
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+
+// Write the op-ref into .env (it's a plaintext line, never encrypted).
+function setOpRef(ref) {
+  let content = existsSync(".env") ? readFileSync(".env", "utf-8") : "";
+  if (/^DOTENV_PRIVATE_KEY_OP_REF=.*$/m.test(content)) {
+    content = content.replace(
+      /^DOTENV_PRIVATE_KEY_OP_REF=.*$/m,
+      `DOTENV_PRIVATE_KEY_OP_REF=${ref}`,
+    );
+  } else {
+    if (content.length > 0 && !content.endsWith("\n")) content += "\n";
+    content += `DOTENV_PRIVATE_KEY_OP_REF=${ref}\n`;
+  }
+  writeFileSync(".env", content);
+}
+
+// 1. Read the base private key from .env.keys.
+if (!existsSync(".env.keys")) {
+  fail("No .env.keys found — set up dotenvx (or run `bun run env:setup`) first.");
+}
+const keyMatch = readFileSync(".env.keys", "utf-8").match(
+  /^\s*DOTENV_PRIVATE_KEY\s*=\s*(.+?)\s*$/m,
+);
+const privateKey = keyMatch?.[1]?.replace(/^["']|["']$/g, "");
+if (!privateKey) fail("No DOTENV_PRIVATE_KEY found in .env.keys.");
+
+// 2. Require the 1Password CLI, signed in.
+const whoami = spawnSync("op", ["whoami"], { stdio: "ignore" });
+if (whoami.error?.code === "ENOENT") {
+  fail("1Password CLI not found — install `op` and run `op signin` first.");
+}
+if (whoami.status !== 0) {
+  fail("Not signed in to 1Password — run `op signin` first.");
+}
+
+// 3. Prompt for the item title (default: package.json name) and an optional tag.
+if (!process.stdin.isTTY) fail("env:save is interactive — run it in a terminal.");
+let defaultTitle = "";
+try {
+  defaultTitle = JSON.parse(readFileSync("package.json", "utf-8")).name ?? "";
+} catch {
+  // no package.json name — leave the title prompt empty
+}
+const rl = createInterface({ input: process.stdin, output: process.stdout });
+const title =
+  (
+    await rl.question(
+      `1Password item title${defaultTitle ? ` [${defaultTitle}]` : ""}: `,
+    )
+  ).trim() || defaultTitle;
+const tag = (await rl.question("Tag (optional): ")).trim();
+rl.close();
+if (!title) fail("A title is required.");
+
+// 4. Refuse if an item with that title already exists in the vault.
+const existing = spawnSync("op", ["item", "get", title, "--vault", VAULT], {
+  stdio: "ignore",
+});
+if (existing.status === 0) {
+  fail(
+    `An item "${title}" already exists in ${VAULT} — rename or remove it first.`,
+  );
+}
+
+// 5. Create the item from a JSON template piped via stdin.
+const template = {
+  title,
+  category: "SECURE_NOTE",
+  ...(tag ? { tags: [tag] } : {}),
+  fields: [{ label: "private-key", type: "CONCEALED", value: privateKey }],
+};
+const created = spawnSync(
+  "op",
+  ["item", "create", "--vault", VAULT, "--format", "json", "-"],
+  { input: JSON.stringify(template), encoding: "utf-8", stdio: ["pipe", "pipe", "inherit"] },
+);
+if (created.status !== 0) fail("\nFailed to create the 1Password item.");
+
+// 6. Reference the item by id (stable; survives renames), falling back to title.
+let itemRef = title;
+try {
+  const id = JSON.parse(created.stdout)?.id;
+  if (id) itemRef = id;
+} catch {
+  // non-JSON output — keep the title-based ref
+}
+const ref = `op://${VAULT}/${itemRef}/private-key`;
+setOpRef(ref);
+
+console.log(`\n✓ Saved to 1Password (${VAULT} / "${title}").`);
+console.log(`  Set DOTENV_PRIVATE_KEY_OP_REF=${ref} in .env.`);
+console.log("  Teammates can now restore with `bun run env:setup`.");

package/src/modules/features/env/dotenvx/files/setup-env.mjs

@@ -0,0 +1,67 @@
+// Restore .env.keys (dotenvx private decryption keys) from 1Password via `op`.
+// Store either the full .env.keys contents (recommended — covers every
+// environment) or just the DOTENV_PRIVATE_KEY value in a 1Password item field;
+// the reference lives in the committed .env (DOTENV_PRIVATE_KEY_OP_REF):
+//
+//   DOTENV_PRIVATE_KEY_OP_REF="op://Development/<item>/<field>" bun run env:setup
+//
+// `--auto` (run from the preinstall hook) is for onboarding: it never fails
+// `bun install` — it skips when .env.keys already exists, in CI, or when the
+// reference / `op` CLI is missing.
+
+import { spawnSync } from "node:child_process";
+import { existsSync, writeFileSync } from "node:fs";
+
+const AUTO = process.argv.includes("--auto");
+
+// In --auto mode any unmet precondition exits 0 so the install never breaks.
+const stop = (msg) => {
+  console.error(msg);
+  process.exit(AUTO ? 0 : 1);
+};
+
+// Onboarding skips: nothing to do, or the wrong place to do it.
+if (AUTO && existsSync(".env.keys")) process.exit(0);
+if (AUTO && (process.env.CI || process.env.VERCEL)) process.exit(0);
+
+const OP_REF = process.env.DOTENV_PRIVATE_KEY_OP_REF;
+if (!OP_REF) {
+  stop(
+    "✗ set DOTENV_PRIVATE_KEY_OP_REF to the 1Password reference for .env.keys\n" +
+      '  e.g. DOTENV_PRIVATE_KEY_OP_REF="op://Development/<item>/<field>" bun run env:setup',
+  );
+}
+
+const res = spawnSync("op", ["read", OP_REF], { encoding: "utf8" });
+
+if (res.error) {
+  const why =
+    res.error.code === "ENOENT"
+      ? "install the 1Password CLI (`op`) and sign in — https://developer.1password.com/docs/cli/get-started/"
+      : res.error.message;
+  stop(`✗ failed to run \`op\`: ${why}`);
+}
+
+if (res.status !== 0) {
+  stop(`✗ \`op read\` failed:\n${res.stderr.trim()}`);
+}
+
+const HEADER = `#/------------------!DOTENV_PRIVATE_KEYS!-------------------/
+#/ private decryption keys. DO NOT commit to source control /
+#/     [how it works](https://dotenvx.com/encryption)       /
+#/          ⛨ ARMORED KEYS: \`dotenvx armor up\`              /
+#/----------------------------------------------------------/
+
+# .env
+`;
+
+const value = res.stdout.trim();
+
+// op may hold the full .env.keys file or just the bare private key. Pass full
+// contents through; wrap a bare key in the standard .env.keys format.
+const contents = value.includes("DOTENV_PRIVATE_KEY")
+  ? `${value}\n`
+  : `${HEADER}DOTENV_PRIVATE_KEY=${value}\n`;
+
+writeFileSync(".env.keys", contents);
+console.info("✓ wrote .env.keys from 1Password");

package/src/modules/features/env/dotenvx/files/vercelignore

@@ -0,0 +1,4 @@
+# Never upload the private keys or local env files on `vercel deploy`.
+# (Encrypted .env / .env.production / .env.preview ARE uploaded — they're safe.)
+.env.keys
+.env*.local

package/src/modules/features/env/dotenvx/files/write-env.mjs

@@ -0,0 +1,47 @@
+// Add or (re)encrypt env values without remembering the dotenvx flags.
+//
+//   bun run env:set KEY value          # encrypt one value into .env
+//   bun run env:set KEY value --plain  # store it plaintext (e.g. NEXT_PUBLIC_*)
+//   bun run env:set KEY value --prod   # target .env.production (--preview too)
+//   bun run env:encrypt-all            # bulk-encrypt every plaintext value in .env
+//   bun run env:encrypt-all --prod     # bulk-encrypt .env.production
+
+import { spawnSync } from "node:child_process";
+
+const [mode, ...rest] = process.argv.slice(2);
+
+// --prod / --preview pick the per-environment file; default is the shared .env.
+const ENV_FLAGS = new Set(["--prod", "--production", "--preview"]);
+const file =
+  rest.includes("--prod") || rest.includes("--production")
+    ? ".env.production"
+    : rest.includes("--preview")
+      ? ".env.preview"
+      : ".env";
+
+// On bulk encrypt, keep browser-public NEXT_PUBLIC_* and the 1Password pointer
+// plaintext (same exclusions the scaffold uses).
+const EXCLUDE = ["--exclude-key", "DOTENV_PRIVATE_KEY_OP_REF", "NEXT_PUBLIC_*"];
+
+function run(args) {
+  // `dotenvx` resolves from node_modules/.bin when run via `bun run`.
+  const res = spawnSync("dotenvx", args, { stdio: "inherit" });
+  process.exit(res.status ?? 1);
+}
+
+if (mode === "encrypt") {
+  run(["encrypt", "-f", file, ...EXCLUDE]);
+} else if (mode === "set") {
+  // Forward KEY, value and any dotenvx flags (e.g. --plain) straight through.
+  const passthrough = rest.filter((arg) => !ENV_FLAGS.has(arg));
+  if (passthrough.filter((arg) => !arg.startsWith("-")).length < 2) {
+    console.error(
+      "Usage: bun run env:set KEY value [--plain] [--preview|--prod]",
+    );
+    process.exit(1);
+  }
+  run(["set", ...passthrough, "-f", file]);
+} else {
+  console.error(`Unknown env command: ${mode ?? "(none)"} (use set | encrypt)`);
+  process.exit(1);
+}