bsmnt 0.5.0 → 0.6.0

package/src/templates/next-pagebuilder/components/layout/json-ld/index.tsx

@@ -1,7 +1,7 @@
 import { stegaClean } from "next-sanity"
 import {
-  getCompanyData,
   getNavbarData,
+  getStructuredData,
 } from "@/lib/integrations/sanity/fetchers/layout"
 import {
   generateOrganizationJsonLd,
@@ -9,35 +9,48 @@ import {
   JsonLd as JsonLdBase,
 } from "@/lib/utils/json-ld"
 
-const APP_DESCRIPTION =
-  "Basement is the AI-native platform for audit and advisory firms. Automate engagement workflows using AI agents trusted by 50% of top 100 firms."
+const nonEmpty = (value: unknown): string | undefined =>
+  typeof value === "string" && value.trim() !== "" ? value : undefined
 
 export const JsonLd = async () => {
-  const [navbar, companyData] = await Promise.all([
+  const [structuredData, navbar] = await Promise.all([
+    getStructuredData(),
     getNavbarData(),
-    getCompanyData(),
   ])
 
-  const sameAs = companyData?.socialLinks
-    ?.map((link) => stegaClean(link.url))
-    .filter((url): url is string => Boolean(url))
+  // Deep-clean stega artifacts before any value reaches the emitted markup.
+  const data = stegaClean(structuredData)
 
-  const logoUrl = navbar?.logo?.asset?.url
+  const name = nonEmpty(data?.name)
+
+  // Without an organization name there's nothing meaningful to emit. Editors
+  // fill in Layout -> Structured Data to enable site-wide JSON-LD.
+  if (!name) return null
+
+  const description = nonEmpty(data?.description)
+  const url = nonEmpty(data?.url)
+
+  // Prefer the structured-data logo, fall back to the navbar logo.
+  const logo = nonEmpty(data?.logo) ?? nonEmpty(navbar?.logo?.asset?.url)
+
+  // Merged and deduped in GROQ (flagged Company Data links + manual profiles).
+  const sameAs = (data?.sameAs ?? [])
+    .map(nonEmpty)
+    .filter((value): value is string => Boolean(value))
 
   return (
     <>
-      <JsonLdBase
-        data={generateWebSiteJsonLd({
-          name: "Basement",
-          description: APP_DESCRIPTION,
-        })}
-      />
+      <JsonLdBase data={generateWebSiteJsonLd({ name, url, description })} />
       <JsonLdBase
         data={generateOrganizationJsonLd({
-          name: "Basement",
-          ...(logoUrl ? { logo: logoUrl } : {}),
-          description: APP_DESCRIPTION,
-          ...(sameAs?.length ? { sameAs } : {}),
+          name,
+          url,
+          logo,
+          description,
+          legalName: nonEmpty(data?.legalName),
+          sameAs: sameAs.length ? sameAs : undefined,
+          contactPoint: data?.contactPoint,
+          address: data?.address,
         })}
       />
     </>

package/src/templates/next-pagebuilder/components/page-document/index.tsx

@@ -3,8 +3,10 @@ import type { ContentCollectionSearchParams } from "@/components/page-builder/co
 import { Renderer } from "@/components/page-builder/renderer"
 import type { PAGE_QUERY_RESULT } from "@/lib/integrations/sanity/sanity.types"
 import { urlForImage } from "@/lib/integrations/sanity/utils/image"
+import { buildPageJsonLd } from "@/lib/integrations/sanity/utils/page-json-ld"
 import {
   generateBreadcrumbJsonLd,
+  generateSanityArticleJsonLd,
   generateSanityWebPageJsonLd,
   JsonLd,
 } from "@/lib/utils/json-ld"
@@ -15,6 +17,11 @@ type PageDocumentProps = {
   searchParams: ContentCollectionSearchParams
 }
 
+type PageBuilderBlock = NonNullable<
+  NonNullable<PAGE_QUERY_RESULT>["pageBuilder"]
+>[number]
+type BlogContentBlock = Extract<PageBuilderBlock, { _type: "blogContent" }>
+
 export const getPageSections = (
   page: NonNullable<PAGE_QUERY_RESULT>,
   searchParams: ContentCollectionSearchParams
@@ -79,6 +86,33 @@ export const PageDocument = ({
   const breadcrumbs = buildBreadcrumbs(path, cleanTitle)
   const hasBreadcrumbs = breadcrumbs.length > 1
 
+  // Editor-selected page-level structured data (FAQ, Event, custom, etc.).
+  const pageJsonLd = buildPageJsonLd(page.metadata?.jsonLd)
+
+  // Blog posts (pages with a Blog Content block) emit Article JSON-LD with
+  // fields derived from the post — no Custom block needed. Skipped when the
+  // editor already supplied an Article (via a Custom block) to avoid duplicates.
+  const blogBlock = page.pageBuilder?.find(
+    (block): block is BlogContentBlock => block?._type === "blogContent"
+  )
+  const hasManualArticle = pageJsonLd.some(
+    ({ data }) => (data as { "@type"?: unknown })["@type"] === "Article"
+  )
+  const articleJsonLd =
+    blogBlock && !hasManualArticle
+      ? generateSanityArticleJsonLd({
+          title: cleanTitle,
+          url: pageUrl,
+          description: cleanDescription || undefined,
+          image: blogBlock.thumbnail
+            ? urlForImage(blogBlock.thumbnail).width(1200).height(630).url()
+            : undefined,
+          datePublished: stegaClean(blogBlock.date) || undefined,
+          dateModified: page._updatedAt,
+          authorName: stegaClean(blogBlock.author?.name) || undefined,
+        })
+      : null
+
   return (
     <>
       <JsonLd
@@ -90,9 +124,13 @@ export const PageDocument = ({
           dateModified: page._updatedAt,
         })}
       />
+      {articleJsonLd ? <JsonLd data={articleJsonLd} /> : null}
       {hasBreadcrumbs ? (
         <JsonLd data={generateBreadcrumbJsonLd(breadcrumbs)} />
       ) : null}
+      {pageJsonLd.map(({ key, data }) => (
+        <JsonLd key={key} data={data} />
+      ))}
       <article className="mx-auto flex w-full max-w-6xl flex-1 flex-col gap-14 px-4 py-14 md:px-6 md:py-20">
         <h1>{title}</h1>
         {sections.length ? (

package/src/templates/next-pagebuilder/lib/integrations/sanity/sanity.types.ts

@@ -9,11 +9,18 @@ type SanityImageField = {
 
 type SanitySlug = { current?: string | null } | null
 
+type JsonLdBlock = {
+  _type: string
+  _key: string
+  [key: string]: unknown
+}
+
 type SanityPageMetadata = {
   metaTitle?: string | null
   metaDescription?: string | null
   og?: { image?: SanityImageField | null } | null
   index?: boolean | null
+  jsonLd?: JsonLdBlock[] | null
   title?: string | null
   description?: string | null
   image?: SanityImageField | null
@@ -89,6 +96,7 @@ type SocialLink = {
   icon?: unknown
   url?: string | null
   label?: string | null
+  includeInStructuredData?: boolean | null
 }
 
 type BlogCategory = {
@@ -194,13 +202,39 @@ export type PAGE_QUERY_RESULT = PageDocument | null
 export type PAGE_SITEMAP_QUERY_RESULT = PageSitemap[]
 export type ALL_BLOG_ARTICLES_QUERY_RESULT = BlogArticle[]
 export type P_REF_PB_COMP_QUERY_RESULT = PageRef[]
-export type COMPANY_DATA_QUERY_RESULT = { socialLinks?: SocialLink[] | null } | null
+export type COMPANY_DATA_QUERY_RESULT = {
+  socialLinks?: SocialLink[] | null
+} | null
+export type STRUCTURED_DATA_QUERY_RESULT = {
+  name?: string | null
+  legalName?: string | null
+  description?: string | null
+  url?: string | null
+  logo?: string | null
+  contactPoint?: {
+    email?: string | null
+    telephone?: string | null
+    contactType?: string | null
+  } | null
+  address?: {
+    streetAddress?: string | null
+    locality?: string | null
+    region?: string | null
+    postalCode?: string | null
+    country?: string | null
+  } | null
+  sameAs?: string[] | null
+} | null
 export type FOOTER_QUERY_RESULT = { links?: FooterLinkGroup[] | null } | null
 export type NAVBAR_QUERY_RESULT = {
   logo?: {
     url?: string | null
     metadata?: { dimensions?: unknown } | null
-    asset?: { _id: string; url: string; metadata?: { dimensions?: unknown } | null } | null
+    asset?: {
+      _id: string
+      url: string
+      metadata?: { dimensions?: unknown } | null
+    } | null
     [key: string]: unknown
   } | null
   navigationItems?: NavItem[] | null

package/src/templates/next-pagebuilder/next.config.ts

@@ -5,6 +5,12 @@ const nextConfig: NextConfig = {
   reactStrictMode: true,
   reactCompiler: true,
   typedRoutes: true,
+  // Bundle the committed encrypted env files into serverless functions so
+  // instrumentation.ts can decrypt them at runtime. .env.keys is never listed
+  // (and is git/vercel-ignored); missing files are skipped.
+  outputFileTracingIncludes: {
+    "/**": ["./.env", "./.env.production", "./.env.preview"],
+  },
   turbopack: {
     rules: {
       "*.svg": {

package/src/templates/next-webgl/.env.example

@@ -1,11 +1,19 @@
 # ============================================
 # Basement Next Starter - Environment Variables
 # ============================================
-# Copy this file to .env.local and fill in the values
-# Run: cp .env.example .env.local
+# This project uses dotenvx (https://dotenvx.com): the committed `.env` holds
+# shared values, with secrets encrypted there. The private keys live in
+# `.env.keys` (gitignored) — restore them with `bun run env:setup`.
 #
-# Only configure the integrations you need.
-# Remove unused sections to keep your env file clean.
+# Add or change a variable in `.env` (not .env.local):
+#   - Secret (API key, token, …):  bun run env:set KEY value   (--preview / --prod)
+#   - Trivial / NEXT_PUBLIC_*:      bun run env:set KEY value --plain
+#   - Bulk-encrypt a file edited by hand:  bun run env:encrypt-all  (--preview / --prod)
+#
+# Edge runtime (middleware, `runtime = "edge"`): dotenvx can't decrypt there.
+# Set any secret those read directly in Vercel's env vars, not here.
+#
+# This file just documents the available variables; real values live in `.env`.
 # ============================================
 
 
@@ -16,7 +24,7 @@
 # Base URL for your site (used for SEO, canonical URLs, etc.)
 # Development: http://localhost:3000
 # Production: https://your-domain.com
-NEXT_PUBLIC_BASE_URL="http://localhost:3000"
+NEXT_PUBLIC_BASE_URL=""
 
 # Draft mode secret for preview functionality
 # Generate a random string: openssl rand -base64 32
@@ -32,7 +40,7 @@ DRAFT_MODE_TOKEN=""
 
 # Required for Sanity
 NEXT_PUBLIC_SANITY_PROJECT_ID=""
-NEXT_PUBLIC_SANITY_DATASET="production"
+NEXT_PUBLIC_SANITY_DATASET=""
 NEXT_PUBLIC_SANITY_API_READ_TOKEN=""
 
 # Optional - for server-side mutations and visual editing

package/src/templates/next-webgl/.github/workflows/ci.yml

@@ -46,8 +46,29 @@ jobs:
       - name: Lint
         run: bun run lint
 
+      # dotenvx needs the private key to decrypt secrets at build time. It's
+      # pulled from 1Password via an org-wide service-account token + the op-ref
+      # committed in .env. Optional: builds pass without it (only plaintext /
+      # NEXT_PUBLIC_* is read), and a per-repo DOTENV_PRIVATE_KEY secret still
+      # works as a fallback.
+      - name: Install 1Password CLI
+        if: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN != '' }}
+        uses: 1password/install-cli-action@v1
+
       - name: Build
-        run: bun run build
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          DOTENV_PRIVATE_KEY: ${{ secrets.DOTENV_PRIVATE_KEY }}
+        run: |
+          if [ -n "$OP_SERVICE_ACCOUNT_TOKEN" ]; then
+            ref="$(grep -m1 '^DOTENV_PRIVATE_KEY_OP_REF=' .env | cut -d= -f2-)"
+            if [ -n "$ref" ]; then
+              DOTENV_PRIVATE_KEY="$(op read "$ref")"
+              echo "::add-mask::$DOTENV_PRIVATE_KEY"
+              export DOTENV_PRIVATE_KEY
+            fi
+          fi
+          bun run build
 
       # Runs your tests if any exist; a fresh project with none passes cleanly.
       - name: Test

package/src/templates/next-webgl/.vscode/extensions.json

@@ -10,6 +10,9 @@
     // Sanity CMS (GROQ syntax + validation)
     "sanity-io.vscode-sanity",
 
+    // Env (dotenvx — view decrypted .env values inline)
+    "dotenv.dotenvx-vscode",
+
     // DX Enhancements
     "yoavbls.pretty-ts-errors"
   ]

package/src/templates/next-webgl/README.md

@@ -22,6 +22,35 @@ bun dev
 | `bun format` | Format the codebase |
 | `bun typecheck` | Run TypeScript |
 | `bun analyze` | Analyze the Next.js bundle |
+| `bun env:set KEY value` | Encrypt one value into `.env` (`--plain`, `--preview`/`--prod`) |
+| `bun env:encrypt-all` | Bulk-encrypt every plaintext value in a file (`--preview`/`--prod`) |
+| `bun env:setup` | Restore `.env.keys` from 1Password |
+| `bun env:view` | Print the decrypted `.env` (`--preview` / `--prod`) |
+| `bun env:setup-remote` | Push private keys to GitHub / Vercel (`github`/`vercel`, or pick) |
+| `bun env:save` | Save the private key to 1Password (Development vault) |
+
+## Environment variables
+
+Secrets are encrypted at rest with [dotenvx](https://dotenvx.com): the committed `.env` holds encrypted values, the private keys live in `.env.keys` (gitignored), and dev/build run through `dotenvx run` so values decrypt automatically.
+
+**First run.** `bun install` restores `.env.keys` from 1Password (via `DOTENV_PRIVATE_KEY_OP_REF` in `.env`), or run `bun run env:setup`. Needs 1Password access + the `op` CLI:
+
+- macOS: `brew install --cask 1password-cli`
+- Windows: `winget install 1password-cli`
+- Linux / other: [1Password CLI docs](https://developer.1password.com/docs/cli/get-started/)
+
+**Add or change a variable** (in `.env`):
+
+- Secret: `bun run env:set KEY value` (`--preview`/`--prod` to target an environment)
+- Public / `NEXT_PUBLIC_*`: `bun run env:set KEY value --plain`
+- Bulk-encrypt a hand-edited file: `bun run env:encrypt-all`
+- Inspect: `bun run env:view` (`--preview`/`--prod`)
+
+**Per environment.** Scripts load `.env.$VERCEL_ENV` over `.env`. After adding a per-env file, push its key with `bun run env:setup-remote vercel` — `instrumentation.ts` uses it to decrypt at runtime.
+
+**Edge runtime.** dotenvx decrypts only in the Node runtime; secrets read in `middleware.ts` or a `runtime = "edge"` route must be set as plain Vercel env vars.
+
+A gitleaks pre-commit hook + CI scan block committed plaintext secrets (install: `brew install gitleaks`).
 
 ## Project Structure
 
@@ -61,6 +90,8 @@ The workflow takes its runtime versions from your manifests, so there's a single
 
 It also caches Bun's install cache between runs, and the test step is a no-op until you add real test files.
 
+The build decrypts the committed `.env` with the dotenvx private key, pulled from 1Password: set an **org-level** `OP_SERVICE_ACCOUNT_TOKEN` (a read-only [service account](https://developer.1password.com/docs/service-accounts/) scoped to the `Development` vault) — one secret for every repo — and CI reads the key via the op-ref committed in `.env`. A per-repo `DOTENV_PRIVATE_KEY` secret (`bun run env:setup-remote github`) works as a fallback; builds pass without either (only plaintext / `NEXT_PUBLIC_*` is read).
+
 ### Branch protection
 
 To block merges when CI fails, enable branch protection on `main`: