bsmnt 0.4.3 → 0.6.0

package/dist/infrastructure/create/setup-agent.js

@@ -1,11 +1,13 @@
 import { execSync } from "node:child_process";
 import path from "node:path";
 import fs from "fs-extra";
+import ora from "ora";
 import prompts from "prompts";
 import { AGENTS } from "../../domain/agents.js";
 import { CMS } from "../../domain/cms.js";
-import { BASE_SKILL_IDS, buildSkillInstallCommand, } from "../../domain/skills.js";
+import { BASE_SKILL_IDS, buildSkillInstallCommand, LOCAL_SKILLS, SKILLS, } from "../../domain/skills.js";
 import { TEMPLATES } from "../../domain/templates.js";
+import { AGENT_SKILLS_DIR } from "../../paths.js";
 import { registerSanityMcp } from "../agents/register-sanity-mcp.js";
 /**
  * Set up AI agent skills and configuration in the target project.
@@ -21,12 +23,17 @@ export async function setupAgent(targetDir, options) {
     const selectedAgents = [...new Set(options.agents)];
     if (selectedAgents.length === 0)
         return;
-    // Create skills directories for each agent
+    // Create skills directories for each agent and copy locally shipped skills
     for (const agent of selectedAgents) {
         const { folder: agentFolder } = AGENTS[agent];
         const skillsPath = path.join(targetDir, agentFolder, "skills");
         await fs.ensureDir(skillsPath);
         await fs.writeFile(path.join(skillsPath, ".gitkeep"), "");
+        for (const skill of Object.values(LOCAL_SKILLS)) {
+            if (skill.dotenvxOnly && !options.dotenvx)
+                continue;
+            await fs.copy(path.join(AGENT_SKILLS_DIR, skill.dir), path.join(skillsPath, skill.dir));
+        }
     }
     const skillIds = new Set(BASE_SKILL_IDS);
     if (options.templateType !== null) {
@@ -34,14 +41,24 @@ export async function setupAgent(targetDir, options) {
             skillIds.add(skillId);
         }
     }
-    if (options.cms !== null) {
-        for (const skillId of CMS[options.cms].skills) {
+    // The page-builder preset bundles Sanity even though `cms` is null, so treat
+    // it as a Sanity project for skills + MCP setup.
+    const hasSanity = options.cms === "sanity" || options.templateType === "next-pagebuilder";
+    if (hasSanity) {
+        for (const skillId of CMS.sanity.skills) {
             skillIds.add(skillId);
         }
     }
+    const skillList = [...skillIds];
+    const totalInstalls = selectedAgents.length * skillList.length;
+    const failed = [];
+    let installed = 0;
+    const spinner = ora("Installing agent skills...").start();
     for (const agent of selectedAgents) {
-        const { cliArg: agentArg } = AGENTS[agent];
-        for (const skillId of skillIds) {
+        const { cliArg: agentArg, label: agentLabel } = AGENTS[agent];
+        for (const skillId of skillList) {
+            installed += 1;
+            spinner.text = `Installing agent skills: ${SKILLS[skillId].name} for ${agentLabel} (${installed}/${totalInstalls})`;
             const command = buildSkillInstallCommand(skillId, {
                 agentArg,
             });
@@ -53,10 +70,17 @@ export async function setupAgent(targetDir, options) {
             }
             catch {
                 // Non-fatal: skills install may fail due to network issues
+                failed.push(`${SKILLS[skillId].name} (${agentLabel})`);
             }
         }
     }
-    if (options.cms === "sanity" && selectedAgents.length > 0) {
+    if (failed.length > 0) {
+        spinner.warn(`Agent skills installed, ${failed.length} skipped (network): ${failed.join(", ")}`);
+    }
+    else {
+        spinner.succeed("Agent skills installed.");
+    }
+    if (hasSanity) {
         const { mcpAgents } = (await prompts({
             type: "multiselect",
             name: "mcpAgents",
@@ -67,7 +91,7 @@ export async function setupAgent(targetDir, options) {
                 selected: true,
             })),
             min: 1,
-            hint: "Space to select, Enter to confirm",
+            instructions: false,
         }));
         if (mcpAgents && mcpAgents.length > 0) {
             await registerSanityMcp(targetDir, mcpAgents);

package/dist/infrastructure/create/setup-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-agent.js","sourceRoot":"","sources":["../../../src/infrastructure/create/setup-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAgB,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,GAAG,EAAc,MAAM,qBAAqB,CAAC;AACtD,OAAO,EACN,cAAc,EACd,wBAAwB,GAExB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAmB,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAYrE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,SAAiB,EACjB,OAAqB;IAErB,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAExC,2CAA2C;IAC3C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAU,cAAc,CAAC,CAAC;IAElD,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YAC9D,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;YAC/C,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAE3C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,EAAE;gBACjD,QAAQ;aACR,CAAC,CAAC;YACH,IAAI,CAAC;gBACJ,QAAQ,CAAC,OAAO,EAAE;oBACjB,GAAG,EAAE,SAAS;oBACd,KAAK,EAAE,QAAQ;iBACf,CAAC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACR,2DAA2D;YAC5D,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC;YACpC,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,+CAA+C;YACxD,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACvC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK;gBAC1B,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,IAAI;aACd,CAAC,CAAC;YACH,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,mCAAmC;SACzC,CAAC,CAA8B,CAAC;QAEjC,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"setup-agent.js","sourceRoot":"","sources":["../../../src/infrastructure/create/setup-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAgB,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,GAAG,EAAc,MAAM,qBAAqB,CAAC;AACtD,OAAO,EACN,cAAc,EACd,wBAAwB,EACxB,YAAY,EAEZ,MAAM,GAEN,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAmB,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAcrE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,SAAiB,EACjB,OAAqB;IAErB,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAExC,2EAA2E;IAC3E,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAuB,YAAY,CAAC,EAAE,CAAC;YACvE,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,SAAS;YACpD,MAAM,EAAE,CAAC,IAAI,CACZ,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,EACtC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAChC,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAU,cAAc,CAAC,CAAC;IAElD,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YAC9D,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IAED,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,SAAS,GACd,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY,KAAK,kBAAkB,CAAC;IAEzE,IAAI,SAAS,EAAE,CAAC;QACf,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACzC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,MAAM,OAAO,GAAG,GAAG,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAAC;IAE1D,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAE9D,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YACjC,SAAS,IAAI,CAAC,CAAC;YACf,OAAO,CAAC,IAAI,GAAG,4BAA4B,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,QAAQ,UAAU,KAAK,SAAS,IAAI,aAAa,GAAG,CAAC;YACpH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,EAAE;gBACjD,QAAQ;aACR,CAAC,CAAC;YACH,IAAI,CAAC;gBACJ,QAAQ,CAAC,OAAO,EAAE;oBACjB,GAAG,EAAE,SAAS;oBACd,KAAK,EAAE,QAAQ;iBACf,CAAC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACR,2DAA2D;gBAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,GAAG,CAAC,CAAC;YACxD,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CACX,2BAA2B,MAAM,CAAC,MAAM,uBAAuB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClF,CAAC;IACH,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC;YACpC,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,+CAA+C;YACxD,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACvC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK;gBAC1B,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,IAAI;aACd,CAAC,CAAC;YACH,GAAG,EAAE,CAAC;YACN,YAAY,EAAE,KAAK;SACnB,CAAC,CAA8B,CAAC;QAEjC,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/infrastructure/create/setup-dotenvx.d.ts

@@ -0,0 +1,41 @@
+/** Wrap runtime scripts with `dotenvx run --`. Skips already-wrapped scripts. */
+export declare function wrapDotenvxScripts(scripts: Record<string, string>): Record<string, string>;
+/**
+ * Chain dotenvx's onboarding restore after any preinstall the scaffold already
+ * owns (e.g. the Node-version guard) instead of replacing it. Idempotent: a
+ * preinstall that already runs setup-env is returned untouched.
+ */
+export declare function composePreinstall(existing: string | undefined): string;
+export declare function applyGitignoreRules(content: string): string;
+export declare function applyDotenvxArtifacts(targetDir: string): Promise<void>;
+/** Parse `KEY=value` assignments from a `.env`-style file (ignores comments). */
+export declare function parseEnvKeys(content: string): Set<string>;
+/** `KEY=value` lines with a non-empty value (multiline-aware; via dotenv parser). */
+export declare function nonEmptyAssignments(content: string): {
+    key: string;
+    line: string;
+}[];
+export declare function isEncryptableSecret(key: string): boolean;
+export type NextConfigTracingStatus = "patched" | "present" | "manual";
+/**
+ * Decide whether/how to add `outputFileTracingIncludes` to next.config source.
+ * Pure: returns the (possibly rewritten) content and a status — "present" if it
+ * already has the key, "manual" if the shape can't be safely extended.
+ */
+export declare function patchNextConfigContent(content: string): {
+    status: NextConfigTracingStatus;
+    content: string;
+};
+/**
+ * Add `outputFileTracingIncludes` to an existing `next.config` so the encrypted
+ * `.env*` is readable by `instrumentation.ts` at runtime on Vercel. Best-effort:
+ * returns "manual" (caller should print the snippet) when no config is found or
+ * its shape can't be safely extended.
+ */
+export declare function ensureNextConfigTracing(targetDir: string): Promise<{
+    status: NextConfigTracingStatus;
+    file: string | null;
+}>;
+/** Migrate plaintext, encrypt `.env`, print the key + next steps. Idempotent. */
+export declare function setupDotenvx(targetDir: string): Promise<boolean>;
+//# sourceMappingURL=setup-dotenvx.d.ts.map

package/dist/infrastructure/create/setup-dotenvx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-dotenvx.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/create/setup-dotenvx.ts"],"names":[],"mappings":"AAyCA,iFAAiF;AACjF,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBxB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AA8ED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAc3D;AAoFD,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5E;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAEzD;AAgBD,qFAAqF;AACrF,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,MAAM,GACb;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAOjC;AAkED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD;AAgCD,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEvE;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,MAAM,EAAE,uBAAuB,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;CAChB,CAcA;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC5C,SAAS,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,uBAAuB,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAYnE;AAsJD,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBtE"}

package/dist/infrastructure/create/setup-dotenvx.js

@@ -0,0 +1,502 @@
+import { execFileSync, execSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import path from "node:path";
+import { parse as parseDotenv } from "dotenv";
+import fs from "fs-extra";
+import ora from "ora";
+import pc from "picocolors";
+import prompts from "prompts";
+import { dotenvxConfig } from "../../modules/features/env/dotenvx/config.js";
+import { DOTENVX_FILES_DIR } from "../../paths.js";
+// Env file first (first-match wins), then the shared `.env` base. VERCEL_ENV is
+// set by Vercel; unset locally → `.env.` is skipped, leaving the base.
+const DOTENVX_RUN_FILES = "-f .env.$VERCEL_ENV -f .env";
+const DOTENVX_RUN_PREFIX = `dotenvx run ${DOTENVX_RUN_FILES} -- `;
+// Compound commands (`a && b`, `a; b`, `cd … && …`) must run through `sh -c`,
+// else only the first command inherits the decrypted env and the rest run bare.
+const COMPOUND_COMMAND_RE = /\bcd\s|&&|\|\||;/;
+function wrapWithDotenvx(command) {
+    if (COMPOUND_COMMAND_RE.test(command)) {
+        return `dotenvx run ${DOTENVX_RUN_FILES} -- sh -c '${command.replaceAll("'", "'\\''")}'`;
+    }
+    return DOTENVX_RUN_PREFIX + command;
+}
+// dotenvx injects decrypted env, so drop the now-redundant `--env-file`.
+function wrapSanityScript(value) {
+    if (value.startsWith("dotenvx run"))
+        return value;
+    return wrapWithDotenvx(value.replaceAll(" --env-file ../../../.env.local", ""));
+}
+/** Wrap runtime scripts with `dotenvx run --`. Skips already-wrapped scripts. */
+export function wrapDotenvxScripts(scripts) {
+    const next = { ...scripts };
+    for (const key of dotenvxConfig.wrapScripts) {
+        const value = next[key];
+        if (typeof value === "string" &&
+            value.length > 0 &&
+            !value.startsWith("dotenvx run")) {
+            next[key] = wrapWithDotenvx(value);
+        }
+    }
+    for (const key of dotenvxConfig.sanityScripts) {
+        const value = next[key];
+        if (typeof value === "string" && value.length > 0) {
+            next[key] = wrapSanityScript(value);
+        }
+    }
+    return next;
+}
+/**
+ * Chain dotenvx's onboarding restore after any preinstall the scaffold already
+ * owns (e.g. the Node-version guard) instead of replacing it. Idempotent: a
+ * preinstall that already runs setup-env is returned untouched.
+ */
+export function composePreinstall(existing) {
+    const onboarding = dotenvxConfig.addScripts.preinstall;
+    if (!onboarding)
+        return existing ?? "";
+    if (!existing || existing === onboarding)
+        return onboarding;
+    if (existing.includes("scripts/setup-env.mjs"))
+        return existing;
+    return `${existing} && ${onboarding}`;
+}
+/** Add the dotenvx dependency, wrap scripts, and add the `env:setup` script. */
+async function applyPackageJson(targetDir) {
+    const pkgPath = path.join(targetDir, "package.json");
+    if (!fs.existsSync(pkgPath))
+        return;
+    const pkg = (await fs.readJson(pkgPath));
+    // Capture the preinstall the scaffold set (e.g. the Node-version guard)
+    // before the merge below, so chaining ours onto it doesn't drop it.
+    const existingPreinstall = pkg.scripts?.preinstall;
+    pkg.dependencies = { ...dotenvxConfig.dependencies, ...pkg.dependencies };
+    pkg.scripts = {
+        ...dotenvxConfig.addScripts,
+        ...wrapDotenvxScripts(pkg.scripts ?? {}),
+    };
+    pkg.scripts.preinstall = composePreinstall(existingPreinstall);
+    await fs.writeJson(pkgPath, pkg, { spaces: 2 });
+}
+// Printed when a project already has its own instrumentation.ts: we won't touch
+// it, but without this call serverless functions on Vercel never decrypt.
+const INSTRUMENTATION_SNIPPET = `export async function register() {
+  if (process.env.NEXT_RUNTIME !== "nodejs") return
+  const { config } = await import("@dotenvx/dotenvx")
+  const vercelEnv = process.env.VERCEL_ENV
+  config({
+    path: vercelEnv ? [".env", \`.env.\${vercelEnv}\`] : [".env"],
+    overload: true,
+    ignore: ["MISSING_ENV_FILE"],
+  })
+}`;
+function warnExistingInstrumentation(content) {
+    if (content.includes("@dotenvx/dotenvx"))
+        return; // already wired
+    console.log(pc.yellow("\n  ⚠ instrumentation.ts already exists — left untouched. Without dotenvx's"));
+    console.log(pc.yellow("    register() your encrypted .env won't decrypt in Vercel serverless functions."));
+    console.log(pc.dim("    Add this to your register() (Node runtime only):\n"));
+    console.log(INSTRUMENTATION_SNIPPET.split("\n")
+        .map((line) => `    ${line}`)
+        .join("\n"));
+    console.log();
+}
+/** Copy the gitleaks workflow + helper scripts (skip if already present). */
+async function copyArtifacts(targetDir) {
+    for (const [dest, source] of Object.entries(dotenvxConfig.files)) {
+        const destPath = path.join(targetDir, dest);
+        if (fs.existsSync(destPath)) {
+            // Silently skipping our scripts is fine, but a pre-existing
+            // instrumentation.ts means dotenvx never gets wired — flag it.
+            if (dest === "instrumentation.ts") {
+                warnExistingInstrumentation(await fs.readFile(destPath, "utf-8"));
+            }
+            continue;
+        }
+        await fs.ensureDir(path.dirname(destPath));
+        await fs.copy(path.join(DOTENVX_FILES_DIR, source), destPath);
+    }
+}
+// Commit the encrypted `.env`: drop the exact lines that ignore it, re-ensure the
+// private keys and plaintext local files stay ignored, then append a `!.env`
+// negation so broader globs an existing project may use (`**/.env`, `*.env`)
+// can't keep it ignored — the negation is last, so it wins. Pure.
+export function applyGitignoreRules(content) {
+    const ignoresEnv = new Set([".env", "/.env", ".env*", "/.env*"]);
+    const kept = content
+        .split("\n")
+        .filter((line) => !ignoresEnv.has(line.trim()));
+    const present = new Set(kept.map((line) => line.trim()));
+    for (const entry of [".env.keys", ".env.local", ".env*.local", "!.env"]) {
+        if (!present.has(entry))
+            kept.push(entry);
+    }
+    let next = kept.join("\n");
+    if (!next.endsWith("\n"))
+        next += "\n";
+    return next;
+}
+async function ensureGitignore(targetDir) {
+    const gitignorePath = path.join(targetDir, ".gitignore");
+    const content = fs.existsSync(gitignorePath)
+        ? await fs.readFile(gitignorePath, "utf-8")
+        : "";
+    await fs.writeFile(gitignorePath, applyGitignoreRules(content));
+}
+// gitleaks (a Go binary, not an npm dep) must be on PATH; the hook fails with an
+// install hint if missing. Flags only real secrets, so plaintext vars commit fine.
+const GITLEAKS_HOOK_RUN = 'command -v gitleaks >/dev/null || { echo "✖ gitleaks required — install: https://github.com/gitleaks/gitleaks#installing"; exit 1; }; gitleaks git --pre-commit --redact --staged --verbose';
+/** Add the gitleaks secret scan to lefthook's pre-commit stage. */
+async function ensureGitleaksHook(targetDir) {
+    const lefthookPath = path.join(targetDir, "lefthook.yml");
+    const hook = ["    gitleaks:", `      run: '${GITLEAKS_HOOK_RUN}'`];
+    if (!fs.existsSync(lefthookPath)) {
+        await fs.writeFile(lefthookPath, `pre-commit:\n  commands:\n${hook.join("\n")}\n`);
+        return;
+    }
+    const content = await fs.readFile(lefthookPath, "utf-8");
+    if (content.includes("gitleaks git --pre-commit"))
+        return; // idempotent
+    const lines = content.split("\n");
+    const preCommitIdx = lines.findIndex((l) => l.trimEnd() === "pre-commit:");
+    if (preCommitIdx === -1) {
+        const suffix = content.endsWith("\n") ? "" : "\n";
+        await fs.writeFile(lefthookPath, `${content}${suffix}\npre-commit:\n  commands:\n${hook.join("\n")}\n`);
+        return;
+    }
+    // Find `commands:` inside the pre-commit section (before the next top-level key).
+    let commandsIdx = -1;
+    for (let i = preCommitIdx + 1; i < lines.length; i++) {
+        const line = lines[i] ?? "";
+        if (/^\S/.test(line))
+            break;
+        if (line.trim() === "commands:") {
+            commandsIdx = i;
+            break;
+        }
+    }
+    if (commandsIdx === -1) {
+        lines.splice(preCommitIdx + 1, 0, "  commands:", ...hook);
+    }
+    else {
+        lines.splice(commandsIdx + 1, 0, ...hook);
+    }
+    await fs.writeFile(lefthookPath, lines.join("\n"));
+}
+const OP_REF_BLOCK = `# 1Password ref to .env.keys for \`bun run env:setup\`. Format: op://Development/<item>/<field>
+DOTENV_PRIVATE_KEY_OP_REF=
+`;
+// Seed the committed `.env` with the shared 1Password pointer so `env:setup`
+// finds it (Bun auto-loads .env). Kept plaintext by runEncrypt's --exclude-key,
+// so it's readable without the keys it points to. Non-destructive + idempotent.
+async function ensureEnvOpRef(targetDir) {
+    const envPath = path.join(targetDir, ".env");
+    if (!fs.existsSync(envPath)) {
+        await fs.writeFile(envPath, OP_REF_BLOCK);
+        return;
+    }
+    const content = await fs.readFile(envPath, "utf-8");
+    if (content.includes("DOTENV_PRIVATE_KEY_OP_REF"))
+        return;
+    const sep = content.length > 0 && !content.endsWith("\n") ? "\n" : "";
+    await fs.appendFile(envPath, `${sep}\n${OP_REF_BLOCK}`);
+}
+// Idempotent; shared by the create flow and `bsmnt integrate --dotenvx` so the
+// generated output never drifts between the two.
+export async function applyDotenvxArtifacts(targetDir) {
+    await applyPackageJson(targetDir);
+    await copyArtifacts(targetDir);
+    await ensureGitignore(targetDir);
+    await ensureGitleaksHook(targetDir);
+}
+/** Parse `KEY=value` assignments from a `.env`-style file (ignores comments). */
+export function parseEnvKeys(content) {
+    return new Set(Object.keys(parseDotenv(content)));
+}
+// Re-serialize a parsed value into a `.env` line. Double-quote (escaping `\`, `"`
+// and newlines) when the value spans lines or has whitespace edges, so multiline
+// secrets like PEM keys survive the round-trip instead of being truncated.
+function serializeEnvValue(value) {
+    if (/[\n"\\]/.test(value) || value.trim() !== value) {
+        const escaped = value
+            .replaceAll("\\", "\\\\")
+            .replaceAll('"', '\\"')
+            .replaceAll("\n", "\\n");
+        return `"${escaped}"`;
+    }
+    return value;
+}
+/** `KEY=value` lines with a non-empty value (multiline-aware; via dotenv parser). */
+export function nonEmptyAssignments(content) {
+    const out = [];
+    for (const [key, value] of Object.entries(parseDotenv(content))) {
+        if (value === "")
+            continue;
+        out.push({ key, line: `${key}=${serializeEnvValue(value)}` });
+    }
+    return out;
+}
+// Copy real `.env.local` values into `.env` for encryption without clobbering
+// existing keys; `.env.local` stays as plaintext local overrides.
+async function migratePlaintextEnv(targetDir) {
+    const envPath = path.join(targetDir, ".env");
+    const localPath = path.join(targetDir, ".env.local");
+    if (!fs.existsSync(localPath))
+        return;
+    const envContent = fs.existsSync(envPath)
+        ? await fs.readFile(envPath, "utf-8")
+        : "";
+    const existingKeys = parseEnvKeys(envContent);
+    const localContent = await fs.readFile(localPath, "utf-8");
+    const linesToAdd = nonEmptyAssignments(localContent)
+        // `DOTENV_*` are dotenvx's own keys/pointers (e.g. the op ref) — never
+        // encrypt them into the committed `.env`.
+        .filter(({ key }) => !existingKeys.has(key) && !key.startsWith("DOTENV_"))
+        .map(({ line }) => line);
+    if (linesToAdd.length === 0)
+        return;
+    let merged = envContent;
+    if (merged.length > 0 && !merged.endsWith("\n"))
+        merged += "\n";
+    merged += `${linesToAdd.join("\n")}\n`;
+    await fs.writeFile(envPath, merged);
+}
+const ENV_HEADER = "# Encrypted with dotenvx — safe to commit.\n";
+// dotenvx can't initialize an empty `.env` (0-byte → dummy sample secrets;
+// comment-only → no public key bound), so encrypt only once it has ≥1 real value.
+// Migrate from `.env.local`, else seed `.env.example`. False = nothing to encrypt.
+async function prepareEnvForEncryption(targetDir) {
+    await migratePlaintextEnv(targetDir);
+    const envPath = path.join(targetDir, ".env");
+    const examplePath = path.join(targetDir, ".env.example");
+    const content = fs.existsSync(envPath)
+        ? await fs.readFile(envPath, "utf-8")
+        : "";
+    if (parseEnvKeys(content).size > 0)
+        return true;
+    const seed = fs.existsSync(examplePath)
+        ? nonEmptyAssignments(await fs.readFile(examplePath, "utf-8")).map(({ line }) => line)
+        : [];
+    if (seed.length === 0)
+        return false;
+    await fs.writeFile(envPath, `${ENV_HEADER}${seed.join("\n")}\n`);
+    return true;
+}
+// A throwaway key whose only job is to give `dotenvx encrypt` something to
+// encrypt so it mints the keypair and binds the public key to `.env`. Needed
+// when every committed value is plaintext (NEXT_PUBLIC_*) — without it dotenvx
+// writes a private key but no public key, leaving a malformed half-keypair.
+const KEYGEN_SEED_KEY = "BSMNT_KEYGEN_SEED";
+// Keys dotenvx leaves plaintext (mirrors runEncrypt's --exclude-key flags):
+// its own DOTENV_* machinery and browser-public NEXT_PUBLIC_*. A key outside
+// these is a real secret that encryption would bind the keypair to.
+export function isEncryptableSecret(key) {
+    return !key.startsWith("DOTENV_") && !key.startsWith("NEXT_PUBLIC_");
+}
+async function hasEncryptableSecret(targetDir) {
+    const envPath = path.join(targetDir, ".env");
+    if (!fs.existsSync(envPath))
+        return false;
+    const content = await fs.readFile(envPath, "utf-8");
+    for (const key of parseEnvKeys(content)) {
+        if (isEncryptableSecret(key))
+            return true;
+    }
+    return false;
+}
+const NEXT_CONFIG_CANDIDATES = [
+    "next.config.ts",
+    "next.config.mts",
+    "next.config.js",
+    "next.config.mjs",
+    "next.config.cjs",
+];
+// Bundle the committed encrypted .env* into serverless functions so
+// instrumentation.ts can decrypt them at runtime (templates ship this baked in;
+// integrate has to add it to the project's existing config).
+const TRACING_PROPERTY = `  // dotenvx: bundle the committed encrypted .env* into serverless functions
+  // so instrumentation.ts can decrypt them at runtime.
+  outputFileTracingIncludes: { "/**": ["./.env", "./.env.production", "./.env.preview"] },`;
+// Matches the opening brace of a top-level config object we can safely extend:
+// `const x[: Type] = {`, `export default {`, or `module.exports = {`.
+const CONFIG_OBJECT_RE = /(const\s+\w+\s*(?::[^=]+)?=\s*\{|export\s+default\s*\{|module\.exports\s*=\s*\{)/;
+/**
+ * Decide whether/how to add `outputFileTracingIncludes` to next.config source.
+ * Pure: returns the (possibly rewritten) content and a status — "present" if it
+ * already has the key, "manual" if the shape can't be safely extended.
+ */
+export function patchNextConfigContent(content) {
+    if (content.includes("outputFileTracingIncludes")) {
+        return { status: "present", content };
+    }
+    if (!CONFIG_OBJECT_RE.test(content)) {
+        return { status: "manual", content };
+    }
+    return {
+        status: "patched",
+        content: content.replace(CONFIG_OBJECT_RE, (match) => `${match}\n${TRACING_PROPERTY}`),
+    };
+}
+/**
+ * Add `outputFileTracingIncludes` to an existing `next.config` so the encrypted
+ * `.env*` is readable by `instrumentation.ts` at runtime on Vercel. Best-effort:
+ * returns "manual" (caller should print the snippet) when no config is found or
+ * its shape can't be safely extended.
+ */
+export async function ensureNextConfigTracing(targetDir) {
+    const file = NEXT_CONFIG_CANDIDATES.find((name) => fs.existsSync(path.join(targetDir, name)));
+    if (!file)
+        return { status: "manual", file: null };
+    const configPath = path.join(targetDir, file);
+    const result = patchNextConfigContent(await fs.readFile(configPath, "utf-8"));
+    if (result.status === "patched") {
+        await fs.writeFile(configPath, result.content);
+    }
+    return { status: result.status, file };
+}
+/**
+ * Append a random throwaway secret when `.env` has nothing encryptable, so the
+ * encrypt pass mints a keypair. Returns whether a seed was added (the caller
+ * strips it once the keypair exists). No-op when a real secret is present.
+ */
+async function ensureKeygenSeed(targetDir) {
+    if (await hasEncryptableSecret(targetDir))
+        return false;
+    const envPath = path.join(targetDir, ".env");
+    let content = fs.existsSync(envPath)
+        ? await fs.readFile(envPath, "utf-8")
+        : ENV_HEADER;
+    if (content.length > 0 && !content.endsWith("\n"))
+        content += "\n";
+    content += `${KEYGEN_SEED_KEY}=${randomBytes(16).toString("hex")}\n`;
+    await fs.writeFile(envPath, content);
+    return true;
+}
+/** Drop a single `KEY=…` line from `.env` (removes the keygen seed post-encrypt). */
+async function removeEnvKey(targetDir, key) {
+    const envPath = path.join(targetDir, ".env");
+    if (!fs.existsSync(envPath))
+        return;
+    const content = await fs.readFile(envPath, "utf-8");
+    const pattern = new RegExp(`^\\s*${key}\\s*=`);
+    const kept = content.split("\n").filter((line) => !pattern.test(line));
+    await fs.writeFile(envPath, kept.join("\n").replace(/\n+$/, "\n"));
+}
+/** Resolve the project-local dotenvx binary, or null if not installed yet. */
+function resolveDotenvxBin(targetDir) {
+    const localBin = path.join(targetDir, "node_modules", ".bin", process.platform === "win32" ? "dotenvx.cmd" : "dotenvx");
+    return fs.existsSync(localBin) ? localBin : null;
+}
+/** Run `dotenvx encrypt` in the target project (idempotent — re-runs are safe). */
+function runEncrypt(targetDir) {
+    // Keep two kinds of key plaintext:
+    //   - the op ref, so it's readable without the keys it points to;
+    //   - NEXT_PUBLIC_*, which ship to the browser anyway — encrypting buys
+    //     nothing, and plaintext lets keyless builds (CI, fresh clones) read
+    //     them at build time instead of choking on an `encrypted:…` string.
+    const args = [
+        "encrypt",
+        "--exclude-key",
+        "DOTENV_PRIVATE_KEY_OP_REF",
+        "NEXT_PUBLIC_*",
+    ];
+    const bin = resolveDotenvxBin(targetDir);
+    if (bin) {
+        execFileSync(bin, args, { cwd: targetDir, stdio: "pipe" });
+        return;
+    }
+    // Fallback when the local bin isn't present (e.g. install was skipped).
+    // Quote glob args so the shell doesn't expand them.
+    const quoted = args.map((a) => (/[*?]/.test(a) ? `'${a}'` : a)).join(" ");
+    execSync(`bunx @dotenvx/dotenvx ${quoted}`, {
+        cwd: targetDir,
+        stdio: "pipe",
+    });
+}
+/** Print the one-time private keys and the 1Password / CI / Vercel next steps. */
+async function printKeyAndNextSteps(targetDir) {
+    const keysPath = path.join(targetDir, ".env.keys");
+    const keysContent = fs.existsSync(keysPath)
+        ? await fs.readFile(keysPath, "utf-8")
+        : "";
+    console.log(`\n  ${pc.bold("🔐 dotenvx — your .env is encrypted and committable.")}`);
+    console.log();
+    if (keysContent) {
+        const indented = keysContent
+            .trimEnd()
+            .split("\n")
+            .map((line) => (line ? `  ${line}` : line))
+            .join("\n");
+        console.log(pc.dim("  Private keys (.env.keys):"));
+        console.log(pc.yellow(indented));
+    }
+    console.log(pc.red("  ⚠ Save the private key in 1Password now — it is the ONLY way to decrypt .env."));
+    console.log();
+    console.log("  Then wire it up:");
+    console.log(pc.cyan("    - 1Password: `bun run env:save` (stores the key + sets the op-ref; teammates restore with `bun run env:setup`)"));
+    console.log(pc.cyan("    - GitHub (CI): `bun run env:setup-remote github` (needs the gh CLI, signed in)"));
+    console.log(pc.cyan("    - Vercel: `bun run env:setup-remote vercel`, then redeploy (needs the vercel CLI, linked)"));
+    console.log();
+    console.log(pc.dim("  Per-environment secrets (development/preview/production) layer on top of .env:"));
+    console.log(pc.cyan("    - Add one: bun run env:set KEY value --prod  (creates an encrypted"));
+    console.log(pc.cyan("      .env.production + a DOTENV_PRIVATE_KEY_PRODUCTION in .env.keys)"));
+    console.log(pc.cyan("    - Then set DOTENV_PRIVATE_KEY_PRODUCTION on Vercel's Production env (and the"));
+    console.log(pc.cyan("      _PREVIEW key on Preview)."));
+    console.log();
+    console.log(pc.dim("  A gitleaks pre-commit hook guards against leaking secrets — install the CLI:"));
+    console.log(pc.cyan("    - macOS:   brew install gitleaks"));
+    console.log(pc.cyan("    - Windows: scoop install gitleaks (or choco install gitleaks)"));
+    console.log(pc.cyan("    - other:   https://github.com/gitleaks/gitleaks/releases"));
+    console.log();
+}
+/** Migrate plaintext, encrypt `.env`, print the key + next steps. Idempotent. */
+export async function setupDotenvx(targetDir) {
+    const spinner = ora("Encrypting .env with dotenvx...").start();
+    try {
+        // Migrate any plaintext `.env.local` and ensure the op-ref exists, then
+        // always mint a keypair: when there's nothing real to encrypt yet,
+        // ensureKeygenSeed encrypts a throwaway value just to bind the keys.
+        await prepareEnvForEncryption(targetDir);
+        await ensureEnvOpRef(targetDir);
+        const seeded = await ensureKeygenSeed(targetDir);
+        runEncrypt(targetDir);
+        if (seeded)
+            await removeEnvKey(targetDir, KEYGEN_SEED_KEY);
+        spinner.succeed(pc.green(".env encrypted with dotenvx."));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        spinner.fail(pc.yellow(`dotenvx encryption skipped: ${message}`));
+        return false;
+    }
+    await printKeyAndNextSteps(targetDir);
+    await offerSaveToOnePassword(targetDir);
+    return true;
+}
+// Offer to save the key to 1Password now (runs `env:save`). Skipped when
+// non-interactive or `op` isn't installed — the printed steps cover that.
+async function offerSaveToOnePassword(targetDir) {
+    if (!process.stdin.isTTY)
+        return;
+    try {
+        execFileSync("op", ["--version"], { stdio: "ignore" });
+    }
+    catch {
+        return;
+    }
+    const { save } = (await prompts({
+        type: "confirm",
+        name: "save",
+        message: "Save the private key to 1Password now?",
+        initial: true,
+    }));
+    if (!save)
+        return;
+    try {
+        execSync("bun run env:save", { cwd: targetDir, stdio: "inherit" });
+    }
+    catch {
+        // env:save prints its own guidance; don't fail the scaffold.
+    }
+}
+//# sourceMappingURL=setup-dotenvx.js.map