bsmnt 0.4.3 → 0.6.0

package/src/templates/next-pagebuilder/lib/scripts/setup-ci-secrets.ts

@@ -0,0 +1,117 @@
+/**
+ * Push CI environment to GitHub Actions for this repository.
+ *
+ * Reads values from `.env.local` and sets them on the current repo via the
+ * GitHub CLI (`gh`), matching the `build` step in `.github/workflows/ci.yml`:
+ * the public Sanity project ID and dataset become repository *variables*, and
+ * the read token becomes a *secret*.
+ *
+ * Run once the repo exists on GitHub:  `bun run ci:secrets`
+ * Requires the GitHub CLI, authenticated (`gh auth login`).
+ */
+import { execFileSync } from "node:child_process"
+import { existsSync, readFileSync } from "node:fs"
+import path from "node:path"
+
+const ENV_FILE = ".env.local"
+
+/** Public config — stored as GitHub Actions repository variables. */
+const VARIABLES = [
+  "NEXT_PUBLIC_SANITY_PROJECT_ID",
+  "NEXT_PUBLIC_SANITY_DATASET",
+] as const
+
+/** Sensitive config — stored as GitHub Actions secrets. */
+const SECRETS = ["SANITY_API_READ_TOKEN"] as const
+
+function parseEnvFile(file: string): Record<string, string> {
+  const env: Record<string, string> = {}
+  if (!existsSync(file)) return env
+
+  for (const rawLine of readFileSync(file, "utf8").split("\n")) {
+    const line = rawLine.trim()
+    if (!line || line.startsWith("#")) continue
+
+    const eq = line.indexOf("=")
+    if (eq === -1) continue
+
+    const key = line.slice(0, eq).trim()
+    let value = line.slice(eq + 1).trim()
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1)
+    }
+    env[key] = value
+  }
+
+  return env
+}
+
+function ensureGitHubRepo(): void {
+  try {
+    execFileSync("gh", ["--version"], { stdio: "pipe" })
+  } catch {
+    console.error(
+      "✖ GitHub CLI (gh) not found. Install it: https://cli.github.com",
+    )
+    process.exit(1)
+  }
+
+  try {
+    execFileSync("gh", ["repo", "view", "--json", "nameWithOwner"], {
+      stdio: "pipe",
+    })
+  } catch {
+    console.error("✖ No GitHub repository detected for this directory.")
+    console.error(
+      "  Create and push the repo first (e.g. `gh repo create`), then re-run.",
+    )
+    process.exit(1)
+  }
+}
+
+ensureGitHubRepo()
+
+const env = parseEnvFile(path.resolve(ENV_FILE))
+let pushed = 0
+let skipped = 0
+
+for (const name of VARIABLES) {
+  const value = env[name] ?? process.env[name]
+  if (!value) {
+    console.info(`- ${name}: not found in ${ENV_FILE}, skipping`)
+    skipped++
+    continue
+  }
+  // Public value — safe to pass on the command line.
+  execFileSync("gh", ["variable", "set", name, "--body", value], {
+    stdio: "pipe",
+  })
+  console.info(`✓ variable  ${name}`)
+  pushed++
+}
+
+for (const name of SECRETS) {
+  const value = env[name] ?? process.env[name]
+  if (!value) {
+    console.info(`- ${name}: not found in ${ENV_FILE}, skipping`)
+    skipped++
+    continue
+  }
+  // Sensitive — pipe via stdin so the token never appears in the process args.
+  execFileSync("gh", ["secret", "set", name], { input: value, stdio: "pipe" })
+  console.info(`✓ secret    ${name}`)
+  pushed++
+}
+
+if (pushed === 0) {
+  console.info(
+    `\nNothing to sync. Add your Sanity values to ${ENV_FILE} (or run Sanity setup) first.`,
+  )
+} else {
+  console.info(
+    `\nDone — ${String(pushed)} value(s) pushed to GitHub Actions${skipped ? `, ${String(skipped)} skipped` : ""}.`,
+  )
+}

package/src/templates/next-pagebuilder/next.config.ts

@@ -5,6 +5,12 @@ const nextConfig: NextConfig = {
   reactStrictMode: true,
   reactCompiler: true,
   typedRoutes: true,
+  // Bundle the committed encrypted env files into serverless functions so
+  // instrumentation.ts can decrypt them at runtime. .env.keys is never listed
+  // (and is git/vercel-ignored); missing files are skipped.
+  outputFileTracingIncludes: {
+    "/**": ["./.env", "./.env.production", "./.env.preview"],
+  },
   turbopack: {
     rules: {
       "*.svg": {

package/src/templates/next-pagebuilder/package.json

@@ -3,14 +3,19 @@
   "description": "Basement Next.js starter template",
   "version": "0.1.0",
   "private": true,
+  "packageManager": "bun@1.3.14",
+  "engines": {
+    "node": ">=24"
+  },
   "scripts": {
     "analyze": "cross-env ANALYZE=true bun run build",
     "analyze:experimental": "next experimental-analyze",
     "build": "next build",
+    "ci:secrets": "bun ./lib/scripts/setup-ci-secrets.ts",
     "dev": "next dev",
     "format": "biome format --write .",
-    "knip": "bunx knip",
-    "knip:fix": "bunx knip --fix",
+    "knip": "knip",
+    "knip:fix": "knip --fix",
     "lighthouse": "bunx @unlighthouse/cli --site http://localhost:3000",
     "lint": "biome lint --max-diagnostics=200",
     "lint:fix": "biome check --write --unsafe --max-diagnostics=200",
@@ -37,12 +42,13 @@
     "@svgr/webpack": "^8.1.0",
     "@tailwindcss/postcss": "^4.2.2",
     "@types/bun": "^1.3.11",
-    "@types/node": "^25.5.0",
+    "@types/node": "^24.13.1",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "@typescript/native-preview": "^7.0.0-dev.20260323.1",
     "babel-plugin-react-compiler": "^1.0.0",
     "cross-env": "^10.1.0",
+    "knip": "^6.16.1",
     "lefthook": "^1.13.0",
     "postcss-functions": "^4.0.2",
     "postcss-preset-env": "^11.2.0",

package/src/templates/next-webgl/.env.example

@@ -1,11 +1,19 @@
 # ============================================
 # Basement Next Starter - Environment Variables
 # ============================================
-# Copy this file to .env.local and fill in the values
-# Run: cp .env.example .env.local
+# This project uses dotenvx (https://dotenvx.com): the committed `.env` holds
+# shared values, with secrets encrypted there. The private keys live in
+# `.env.keys` (gitignored) — restore them with `bun run env:setup`.
 #
-# Only configure the integrations you need.
-# Remove unused sections to keep your env file clean.
+# Add or change a variable in `.env` (not .env.local):
+#   - Secret (API key, token, …):  bun run env:set KEY value   (--preview / --prod)
+#   - Trivial / NEXT_PUBLIC_*:      bun run env:set KEY value --plain
+#   - Bulk-encrypt a file edited by hand:  bun run env:encrypt-all  (--preview / --prod)
+#
+# Edge runtime (middleware, `runtime = "edge"`): dotenvx can't decrypt there.
+# Set any secret those read directly in Vercel's env vars, not here.
+#
+# This file just documents the available variables; real values live in `.env`.
 # ============================================
 
 
@@ -16,7 +24,7 @@
 # Base URL for your site (used for SEO, canonical URLs, etc.)
 # Development: http://localhost:3000
 # Production: https://your-domain.com
-NEXT_PUBLIC_BASE_URL="http://localhost:3000"
+NEXT_PUBLIC_BASE_URL=""
 
 # Draft mode secret for preview functionality
 # Generate a random string: openssl rand -base64 32
@@ -32,7 +40,7 @@ DRAFT_MODE_TOKEN=""
 
 # Required for Sanity
 NEXT_PUBLIC_SANITY_PROJECT_ID=""
-NEXT_PUBLIC_SANITY_DATASET="production"
+NEXT_PUBLIC_SANITY_DATASET=""
 NEXT_PUBLIC_SANITY_API_READ_TOKEN=""
 
 # Optional - for server-side mutations and visual editing

package/src/templates/next-webgl/.github/workflows/ci.yml

@@ -0,0 +1,83 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Node version is read from .nvmrc — the single source of truth.
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      # Bun version is read from package.json's "packageManager" field — the
+      # single source of truth. Do NOT pin a version here, or the two can drift.
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      # Cache Bun's global install cache so dependencies aren't re-downloaded
+      # on every run. Keyed on the lockfile so it busts when deps change.
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Type check
+        run: bun run typecheck:compare
+
+      - name: Lint
+        run: bun run lint
+
+      # dotenvx needs the private key to decrypt secrets at build time. It's
+      # pulled from 1Password via an org-wide service-account token + the op-ref
+      # committed in .env. Optional: builds pass without it (only plaintext /
+      # NEXT_PUBLIC_* is read), and a per-repo DOTENV_PRIVATE_KEY secret still
+      # works as a fallback.
+      - name: Install 1Password CLI
+        if: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN != '' }}
+        uses: 1password/install-cli-action@v1
+
+      - name: Build
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          DOTENV_PRIVATE_KEY: ${{ secrets.DOTENV_PRIVATE_KEY }}
+        run: |
+          if [ -n "$OP_SERVICE_ACCOUNT_TOKEN" ]; then
+            ref="$(grep -m1 '^DOTENV_PRIVATE_KEY_OP_REF=' .env | cut -d= -f2-)"
+            if [ -n "$ref" ]; then
+              DOTENV_PRIVATE_KEY="$(op read "$ref")"
+              echo "::add-mask::$DOTENV_PRIVATE_KEY"
+              export DOTENV_PRIVATE_KEY
+            fi
+          fi
+          bun run build
+
+      # Runs your tests if any exist; a fresh project with none passes cleanly.
+      - name: Test
+        run: |
+          if git ls-files '*.test.*' '*.spec.*' '*_test.*' '*_spec.*' | grep -q .; then
+            bun test
+          else
+            echo "No test files found — skipping bun test."
+          fi
+
+      - name: Knip
+        run: bun run knip

package/src/templates/next-webgl/.vscode/extensions.json

@@ -10,6 +10,9 @@
     // Sanity CMS (GROQ syntax + validation)
     "sanity-io.vscode-sanity",
 
+    // Env (dotenvx — view decrypted .env values inline)
+    "dotenv.dotenvx-vscode",
+
     // DX Enhancements
     "yoavbls.pretty-ts-errors"
   ]

package/src/templates/next-webgl/README.md

@@ -22,6 +22,35 @@ bun dev
 | `bun format` | Format the codebase |
 | `bun typecheck` | Run TypeScript |
 | `bun analyze` | Analyze the Next.js bundle |
+| `bun env:set KEY value` | Encrypt one value into `.env` (`--plain`, `--preview`/`--prod`) |
+| `bun env:encrypt-all` | Bulk-encrypt every plaintext value in a file (`--preview`/`--prod`) |
+| `bun env:setup` | Restore `.env.keys` from 1Password |
+| `bun env:view` | Print the decrypted `.env` (`--preview` / `--prod`) |
+| `bun env:setup-remote` | Push private keys to GitHub / Vercel (`github`/`vercel`, or pick) |
+| `bun env:save` | Save the private key to 1Password (Development vault) |
+
+## Environment variables
+
+Secrets are encrypted at rest with [dotenvx](https://dotenvx.com): the committed `.env` holds encrypted values, the private keys live in `.env.keys` (gitignored), and dev/build run through `dotenvx run` so values decrypt automatically.
+
+**First run.** `bun install` restores `.env.keys` from 1Password (via `DOTENV_PRIVATE_KEY_OP_REF` in `.env`), or run `bun run env:setup`. Needs 1Password access + the `op` CLI:
+
+- macOS: `brew install --cask 1password-cli`
+- Windows: `winget install 1password-cli`
+- Linux / other: [1Password CLI docs](https://developer.1password.com/docs/cli/get-started/)
+
+**Add or change a variable** (in `.env`):
+
+- Secret: `bun run env:set KEY value` (`--preview`/`--prod` to target an environment)
+- Public / `NEXT_PUBLIC_*`: `bun run env:set KEY value --plain`
+- Bulk-encrypt a hand-edited file: `bun run env:encrypt-all`
+- Inspect: `bun run env:view` (`--preview`/`--prod`)
+
+**Per environment.** Scripts load `.env.$VERCEL_ENV` over `.env`. After adding a per-env file, push its key with `bun run env:setup-remote vercel` — `instrumentation.ts` uses it to decrypt at runtime.
+
+**Edge runtime.** dotenvx decrypts only in the Node runtime; secrets read in `middleware.ts` or a `runtime = "edge"` route must be set as plain Vercel env vars.
+
+A gitleaks pre-commit hook + CI scan block committed plaintext secrets (install: `brew install gitleaks`).
 
 ## Project Structure
 
@@ -49,3 +78,27 @@ lib/
 - Edit `lib/styles/tokens.css` for theme variables, breakpoints, and custom Tailwind utilities.
 - Edit `lib/styles/global.css` for reset rules and app-wide global styles.
 - `lib/styles/fonts.ts` handles font variables.
+
+## Continuous Integration
+
+A GitHub Actions workflow (`.github/workflows/ci.yml`) runs on every pull request to `main` and on pushes to `main`. It runs type checking, linting, the production build, tests, and `knip`.
+
+The workflow takes its runtime versions from your manifests, so there's a single source of truth and nothing to keep in sync by hand:
+
+- **Node** comes from `.nvmrc`.
+- **Bun** comes from the `packageManager` field in `package.json`.
+
+It also caches Bun's install cache between runs, and the test step is a no-op until you add real test files.
+
+The build decrypts the committed `.env` with the dotenvx private key, pulled from 1Password: set an **org-level** `OP_SERVICE_ACCOUNT_TOKEN` (a read-only [service account](https://developer.1password.com/docs/service-accounts/) scoped to the `Development` vault) — one secret for every repo — and CI reads the key via the op-ref committed in `.env`. A per-repo `DOTENV_PRIVATE_KEY` secret (`bun run env:setup-remote github`) works as a fallback; builds pass without either (only plaintext / `NEXT_PUBLIC_*` is read).
+
+### Branch protection
+
+To block merges when CI fails, enable branch protection on `main`:
+
+1. Go to **Settings → Branches → Add branch ruleset** (or **Add rule**).
+2. Target the `main` branch.
+3. Enable **Require status checks to pass before merging** and select the **CI** check.
+4. (Recommended) Enable **Require a pull request before merging**.
+
+Pull requests then cannot be merged until the CI workflow passes.

package/src/templates/next-webgl/knip.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://unpkg.com/knip@6/schema.json",
+  "entry": [
+    "lib/scripts/**/*.{ts,tsx}",
+    "lib/hooks/**/*.{ts,tsx}",
+    "lib/utils/**/*.{ts,tsx}",
+    "components/**/*.{ts,tsx}"
+  ],
+  "ignoreDependencies": [
+    "zod",
+    "@svgr/webpack"
+  ]
+}

package/src/templates/next-webgl/lefthook.yml

@@ -14,6 +14,11 @@ pre-commit:
       run: bunx tsgo --noEmit --incremental false
       stage_fixed: false
 
+pre-push:
+  commands:
+    knip:
+      run: bun run knip
+
 post-merge:
   commands:
     install-deps: