bsmnt 0.5.0 → 0.6.0

package/src/modules/features/cms/sanity-pagebuilder/files/lib/utils/json-ld.tsx

@@ -1,8 +1,14 @@
 import type {
 	Article,
 	BreadcrumbList,
+	Event as EventSchema,
+	FAQPage,
+	ItemList,
+	JobPosting,
 	Organization,
+	SoftwareApplication,
 	Thing,
+	VideoObject,
 	WebPage,
 	WebSite,
 	WithContext,
@@ -27,8 +33,8 @@ export const JsonLd = <T extends Thing>({ data }: JsonLdProps<T>) => (
 
 interface WebSiteJsonLdOptions {
 	name: string;
-	url?: string;
-	description?: string;
+	url?: string | undefined;
+	description?: string | undefined;
 }
 
 export const generateWebSiteJsonLd = (
@@ -44,27 +50,95 @@ export const generateWebSiteJsonLd = (
 	};
 };
 
+// Sanity asset URLs are already absolute (cdn.sanity.io); only prefix the
+// origin for app-relative paths like "/logo.svg".
+const toAbsoluteUrl = (value: string) =>
+	/^https?:\/\//.test(value) ? value : `${BASE_URL}${value}`;
+
+interface OrganizationContactPoint {
+	email?: string | null;
+	telephone?: string | null;
+	contactType?: string | null;
+}
+
+interface OrganizationAddress {
+	streetAddress?: string | null;
+	locality?: string | null;
+	region?: string | null;
+	postalCode?: string | null;
+	country?: string | null;
+}
+
 interface OrganizationJsonLdOptions {
 	name: string;
-	url?: string;
-	logo?: string;
-	description?: string;
-	sameAs?: string[];
+	url?: string | undefined;
+	logo?: string | undefined;
+	description?: string | undefined;
+	sameAs?: string[] | undefined;
+	legalName?: string | undefined;
+	contactPoint?: OrganizationContactPoint | null | undefined;
+	address?: OrganizationAddress | null | undefined;
 }
 
 export const generateOrganizationJsonLd = (
 	options: OrganizationJsonLdOptions,
 ): WithContext<Organization> => {
-	const { name, url = BASE_URL, logo, description, sameAs } = options;
+	const {
+		name,
+		url = BASE_URL,
+		logo,
+		description,
+		sameAs,
+		legalName,
+		contactPoint,
+		address,
+	} = options;
+
+	const contactPointNode =
+		contactPoint &&
+		(contactPoint.email || contactPoint.telephone || contactPoint.contactType)
+			? {
+					"@type": "ContactPoint" as const,
+					...(contactPoint.email && { email: contactPoint.email }),
+					...(contactPoint.telephone && {
+						telephone: contactPoint.telephone,
+					}),
+					...(contactPoint.contactType && {
+						contactType: contactPoint.contactType,
+					}),
+				}
+			: undefined;
+
+	const addressNode =
+		address &&
+		(address.streetAddress ||
+			address.locality ||
+			address.region ||
+			address.postalCode ||
+			address.country)
+			? {
+					"@type": "PostalAddress" as const,
+					...(address.streetAddress && {
+						streetAddress: address.streetAddress,
+					}),
+					...(address.locality && { addressLocality: address.locality }),
+					...(address.region && { addressRegion: address.region }),
+					...(address.postalCode && { postalCode: address.postalCode }),
+					...(address.country && { addressCountry: address.country }),
+				}
+			: undefined;
 
 	return {
 		"@context": "https://schema.org",
 		"@type": "Organization",
 		name,
 		...(url ? { url } : {}),
-		...(logo && { logo: `${BASE_URL}${logo}` }),
+		...(logo && { logo: toAbsoluteUrl(logo) }),
 		...(description && { description }),
-		...(sameAs && { sameAs }),
+		...(legalName && { legalName }),
+		...(sameAs?.length && { sameAs }),
+		...(contactPointNode && { contactPoint: contactPointNode }),
+		...(addressNode && { address: addressNode }),
 	};
 };
 
@@ -160,12 +234,7 @@ export function generateBreadcrumbJsonLd(
 	};
 }
 
-/* ——————————————————————————————————————————————————————————
- * Sanity helpers
- *
- * Accept flat options instead of a document shape so they
- * work with any Sanity type without interface mismatches.
- * —————————————————————————————————————————————————————————— */
+// Sanity helpers — flat options instead of document shapes, so they fit any type.
 
 interface SanityArticleJsonLdOptions {
 	title: string;
@@ -210,3 +279,243 @@ export function generateSanityWebPageJsonLd(
 	if (options.dateModified) opts.dateModified = options.dateModified;
 	return generateWebPageJsonLd(opts);
 }
+
+// Page-level generators for the schema.org blocks editors attach via
+// `metadata.jsonLd`. Plain options keep them CMS-independent.
+
+export interface FaqJsonLdItem {
+	question: string;
+	answer: string;
+}
+
+export function generateFaqJsonLd(
+	items: FaqJsonLdItem[],
+): WithContext<FAQPage> {
+	return {
+		"@context": "https://schema.org",
+		"@type": "FAQPage",
+		mainEntity: items.map((item) => ({
+			"@type": "Question" as const,
+			name: item.question,
+			acceptedAnswer: {
+				"@type": "Answer" as const,
+				text: item.answer,
+			},
+		})),
+	};
+}
+
+export interface JobPostingJsonLdOptions {
+	title: string;
+	description: string;
+	datePosted: string;
+	validThrough?: string | undefined;
+	employmentType?: string | undefined;
+	organizationName?: string | undefined;
+	organizationUrl?: string | undefined;
+	remote?: boolean | undefined;
+	locality?: string | undefined;
+	region?: string | undefined;
+	country?: string | undefined;
+}
+
+export function generateJobPostingJsonLd(
+	options: JobPostingJsonLdOptions,
+): WithContext<JobPosting> {
+	const {
+		title,
+		description,
+		datePosted,
+		validThrough,
+		employmentType,
+		organizationName,
+		organizationUrl,
+		remote,
+		locality,
+		region,
+		country,
+	} = options;
+
+	const hiringOrganization = organizationName
+		? {
+				"@type": "Organization" as const,
+				name: organizationName,
+				...(organizationUrl && { url: toAbsoluteUrl(organizationUrl) }),
+			}
+		: undefined;
+
+	const jobLocation =
+		locality || region || country
+			? {
+					"@type": "Place" as const,
+					address: {
+						"@type": "PostalAddress" as const,
+						...(locality && { addressLocality: locality }),
+						...(region && { addressRegion: region }),
+						...(country && { addressCountry: country }),
+					},
+				}
+			: undefined;
+
+	return {
+		"@context": "https://schema.org",
+		"@type": "JobPosting",
+		title,
+		description,
+		datePosted,
+		...(validThrough && { validThrough }),
+		...(employmentType && { employmentType }),
+		...(hiringOrganization && { hiringOrganization }),
+		...(remote && { jobLocationType: "TELECOMMUTE" }),
+		...(jobLocation && { jobLocation }),
+	};
+}
+
+export interface SoftwareApplicationJsonLdOptions {
+	name: string;
+	description?: string | undefined;
+	applicationCategory?: string | undefined;
+	operatingSystem?: string | undefined;
+	price?: number | undefined;
+	currency?: string | undefined;
+	url?: string | undefined;
+	image?: string | undefined;
+}
+
+export function generateSoftwareApplicationJsonLd(
+	options: SoftwareApplicationJsonLdOptions,
+): WithContext<SoftwareApplication> {
+	const {
+		name,
+		description,
+		applicationCategory,
+		operatingSystem,
+		price,
+		currency,
+		url,
+		image,
+	} = options;
+
+	const offers =
+		typeof price === "number"
+			? {
+					"@type": "Offer" as const,
+					price: price.toString(),
+					...(currency && { priceCurrency: currency }),
+				}
+			: undefined;
+
+	return {
+		"@context": "https://schema.org",
+		"@type": "SoftwareApplication",
+		name,
+		...(description && { description }),
+		...(applicationCategory && { applicationCategory }),
+		...(operatingSystem && { operatingSystem }),
+		...(url && { url: toAbsoluteUrl(url) }),
+		...(image && { image: toAbsoluteUrl(image) }),
+		...(offers && { offers }),
+	};
+}
+
+export interface ItemListEntry {
+	name: string;
+	url?: string | undefined;
+}
+
+export interface ItemListJsonLdOptions {
+	name?: string | undefined;
+	items: ItemListEntry[];
+}
+
+export function generateItemListJsonLd(
+	options: ItemListJsonLdOptions,
+): WithContext<ItemList> {
+	const { name, items } = options;
+
+	return {
+		"@context": "https://schema.org",
+		"@type": "ItemList",
+		...(name && { name }),
+		itemListElement: items.map((item, index) => ({
+			"@type": "ListItem" as const,
+			position: index + 1,
+			name: item.name,
+			...(item.url && { url: toAbsoluteUrl(item.url) }),
+		})),
+	};
+}
+
+export interface EventJsonLdOptions {
+	name: string;
+	description?: string | undefined;
+	startDate: string;
+	endDate?: string | undefined;
+	locationName?: string | undefined;
+	locationAddress?: string | undefined;
+	url?: string | undefined;
+	image?: string | undefined;
+}
+
+export function generateEventJsonLd(
+	options: EventJsonLdOptions,
+): WithContext<EventSchema> {
+	const {
+		name,
+		description,
+		startDate,
+		endDate,
+		locationName,
+		locationAddress,
+		url,
+		image,
+	} = options;
+
+	const location =
+		locationName || locationAddress
+			? {
+					"@type": "Place" as const,
+					...(locationName && { name: locationName }),
+					...(locationAddress && { address: locationAddress }),
+				}
+			: undefined;
+
+	return {
+		"@context": "https://schema.org",
+		"@type": "Event",
+		name,
+		startDate,
+		...(endDate && { endDate }),
+		...(description && { description }),
+		...(url && { url: toAbsoluteUrl(url) }),
+		...(image && { image: toAbsoluteUrl(image) }),
+		...(location && { location }),
+	};
+}
+
+export interface VideoJsonLdOptions {
+	name: string;
+	description: string;
+	thumbnail: string;
+	uploadDate: string;
+	contentUrl?: string | undefined;
+	embedUrl?: string | undefined;
+}
+
+export function generateVideoJsonLd(
+	options: VideoJsonLdOptions,
+): WithContext<VideoObject> {
+	const { name, description, thumbnail, uploadDate, contentUrl, embedUrl } =
+		options;
+
+	return {
+		"@context": "https://schema.org",
+		"@type": "VideoObject",
+		name,
+		description,
+		thumbnailUrl: toAbsoluteUrl(thumbnail),
+		uploadDate,
+		...(contentUrl && { contentUrl }),
+		...(embedUrl && { embedUrl }),
+	};
+}

package/src/modules/features/env/dotenvx/files/decrypt-env.mjs

@@ -0,0 +1,45 @@
+// Print a decrypted env file to the terminal (read-only — never writes).
+//
+//   bun run env:view              # .env (shared / development)
+//   bun run env:view --preview    # .env.preview
+//   bun run env:view --prod       # .env.production
+
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+
+// This prints decrypted secrets to stdout — never where logs are captured. Most
+// CI sets `CI`; Vercel builds set `VERCEL` (not `CI`), so check both.
+if (process.env.CI || process.env.VERCEL) {
+  console.error(
+    "env:view prints decrypted secrets — refusing to run in CI / on Vercel.",
+  );
+  process.exit(1);
+}
+
+const args = process.argv.slice(2);
+const file =
+  args.includes("--prod") || args.includes("--production")
+    ? ".env.production"
+    : args.includes("--preview")
+      ? ".env.preview"
+      : ".env";
+
+// Friendlier than dotenvx's MISSING_ENV_FILE error when the file isn't created yet.
+if (!existsSync(file)) {
+  const flag =
+    file === ".env.production"
+      ? " --prod"
+      : file === ".env.preview"
+        ? " --preview"
+        : "";
+  console.error(
+    `No ${file} yet. Add values with: bun run env:set KEY value${flag}`,
+  );
+  process.exit(1);
+}
+
+// `dotenvx` resolves from node_modules/.bin when run via `bun run`.
+const res = spawnSync("dotenvx", ["decrypt", "-f", file, "--stdout"], {
+  stdio: "inherit",
+});
+process.exit(res.status ?? 1);

package/src/modules/features/env/dotenvx/files/gitleaks.yml

@@ -0,0 +1,25 @@
+name: gitleaks
+
+# Scans the PR diff for committed secrets. Encrypted values and non-secret config
+# pass; runs with --redact so values never reach the logs.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write # gitleaks comments findings on the PR
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: gitleaks/gitleaks-action@v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # The action reads GITLEAKS_LICENSE; source it from your org secret.
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE_KEY }}

package/src/modules/features/env/dotenvx/files/instrumentation.ts

@@ -0,0 +1,14 @@
+// Decrypt env at runtime on Vercel serverless, where the `dotenvx run` wrapper
+// doesn't run. Node only (dotenvx can't run on the edge).
+export async function register() {
+  if (process.env.NEXT_RUNTIME !== "nodejs") return
+
+  const { config } = await import("@dotenvx/dotenvx")
+  const vercelEnv = process.env.VERCEL_ENV
+
+  config({
+    path: vercelEnv ? [".env", `.env.${vercelEnv}`] : [".env"],
+    overload: true, // Next pre-loads the encrypted .env; overwrite with decrypted values
+    ignore: ["MISSING_ENV_FILE"], // env-specific file may not exist
+  })
+}

package/src/modules/features/env/dotenvx/files/push-keys.mjs

@@ -0,0 +1,129 @@
+// Push the dotenvx private keys from .env.keys to GitHub / Vercel so encrypted
+// envs decrypt in CI and at runtime. Each value is piped via stdin — never as a
+// CLI argument — so it doesn't land in process listings or shell history.
+//
+//   bun run env:setup-remote          # pick a target from a menu
+//   bun run env:setup-remote github   # gh secret set   for each DOTENV_PRIVATE_KEY*
+//   bun run env:setup-remote vercel   # vercel env add  for each DOTENV_PRIVATE_KEY*
+
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { createInterface } from "node:readline/promises";
+
+const TARGETS = ["github", "vercel"];
+
+// Collect every DOTENV_PRIVATE_KEY* assignment (base + per-environment) from
+// .env.keys content, stripping surrounding quotes. Skips empty values.
+export function parsePrivateKeys(content) {
+  const keys = [];
+  for (const raw of content.split("\n")) {
+    const match = raw.match(/^\s*(DOTENV_PRIVATE_KEY[A-Z_]*)\s*=\s*(.+?)\s*$/);
+    if (!match) continue;
+    const value = match[2].replace(/^["']|["']$/g, "");
+    if (value) keys.push({ name: match[1], value });
+  }
+  return keys;
+}
+
+// The base key decrypts the shared .env (loaded in every environment); a
+// suffixed key (…_PRODUCTION / …_PREVIEW) decrypts only that environment's file.
+export function vercelEnvsFor(name) {
+  const suffix = name.slice("DOTENV_PRIVATE_KEY".length).replace(/^_/, "");
+  return suffix
+    ? [suffix.toLowerCase()]
+    : ["production", "preview", "development"];
+}
+
+// Ask which remote when no arg was given. Never hang a non-interactive shell.
+async function promptTarget() {
+  if (!process.stdin.isTTY) {
+    console.error("Usage: bun run env:setup-remote github | vercel");
+    process.exit(1);
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (
+      await rl.question(
+        "Push private keys to:\n  1) GitHub secrets (CI)\n  2) Vercel env (runtime)\nSelect [1/2]: ",
+      )
+    )
+      .trim()
+      .toLowerCase();
+    if (answer === "1" || answer === "github") return "github";
+    if (answer === "2" || answer === "vercel") return "vercel";
+    console.error("Cancelled — choose 1 (GitHub) or 2 (Vercel).");
+    process.exit(1);
+  } finally {
+    rl.close();
+  }
+}
+
+// Pipe the value through stdin so it never appears in argv.
+function pipe(cmd, args, input) {
+  const res = spawnSync(cmd, args, {
+    input,
+    stdio: ["pipe", "inherit", "inherit"],
+  });
+  if (res.error?.code === "ENOENT") {
+    console.error(`\n${cmd} not found — install its CLI and sign in first.`);
+    process.exit(1);
+  }
+  return res.status === 0;
+}
+
+async function main() {
+  // Validate an explicit arg up front so a typo fails before anything else.
+  const arg = process.argv[2];
+  if (arg && !TARGETS.includes(arg)) {
+    console.error(`Unknown target "${arg}". Use: github | vercel`);
+    process.exit(1);
+  }
+
+  if (!existsSync(".env.keys")) {
+    console.error(
+      "No .env.keys found — run `bun run env:setup` to restore it first.",
+    );
+    process.exit(1);
+  }
+
+  const keys = parsePrivateKeys(readFileSync(".env.keys", "utf-8"));
+  if (keys.length === 0) {
+    console.error("No DOTENV_PRIVATE_KEY* entries found in .env.keys.");
+    process.exit(1);
+  }
+
+  const target = arg ?? (await promptTarget());
+
+  let ok = true;
+  for (const { name, value } of keys) {
+    if (target === "github") {
+      console.log(`→ gh secret set ${name}`);
+      ok = pipe("gh", ["secret", "set", name], value) && ok;
+    } else {
+      for (const env of vercelEnvsFor(name)) {
+        console.log(`→ vercel env add ${name} ${env}`);
+        ok = pipe("vercel", ["env", "add", name, env], value) && ok;
+      }
+    }
+  }
+
+  if (!ok) {
+    console.error(
+      target === "github"
+        ? "\nSome secrets failed. Check the GitHub CLI is authenticated (`gh auth login`) and the repo exists on GitHub."
+        : "\nSome env vars failed. Check the Vercel CLI is linked (`vercel link`); a var that already exists must be removed first (`vercel env rm NAME ENV`).",
+    );
+    process.exit(1);
+  }
+
+  console.log(
+    target === "vercel"
+      ? "\nDone. Redeploy for the new env vars to take effect."
+      : "\nDone.",
+  );
+}
+
+// Only run the script when invoked directly (not when imported by a test).
+if (import.meta.main) {
+  await main();
+}

package/src/modules/features/env/dotenvx/files/save-key.mjs

@@ -0,0 +1,108 @@
+// Save the private key to 1Password (Development vault) and point .env's op-ref
+// at it, so teammates restore with `bun run env:setup`. The key is piped via
+// stdin (JSON template), never passed as an argument.
+//
+//   bun run env:save
+
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { createInterface } from "node:readline/promises";
+
+const VAULT = "Development";
+
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+
+// Write the op-ref into .env (it's a plaintext line, never encrypted).
+function setOpRef(ref) {
+  let content = existsSync(".env") ? readFileSync(".env", "utf-8") : "";
+  if (/^DOTENV_PRIVATE_KEY_OP_REF=.*$/m.test(content)) {
+    content = content.replace(
+      /^DOTENV_PRIVATE_KEY_OP_REF=.*$/m,
+      `DOTENV_PRIVATE_KEY_OP_REF=${ref}`,
+    );
+  } else {
+    if (content.length > 0 && !content.endsWith("\n")) content += "\n";
+    content += `DOTENV_PRIVATE_KEY_OP_REF=${ref}\n`;
+  }
+  writeFileSync(".env", content);
+}
+
+// 1. Read the base private key from .env.keys.
+if (!existsSync(".env.keys")) {
+  fail("No .env.keys found — set up dotenvx (or run `bun run env:setup`) first.");
+}
+const keyMatch = readFileSync(".env.keys", "utf-8").match(
+  /^\s*DOTENV_PRIVATE_KEY\s*=\s*(.+?)\s*$/m,
+);
+const privateKey = keyMatch?.[1]?.replace(/^["']|["']$/g, "");
+if (!privateKey) fail("No DOTENV_PRIVATE_KEY found in .env.keys.");
+
+// 2. Require the 1Password CLI, signed in.
+const whoami = spawnSync("op", ["whoami"], { stdio: "ignore" });
+if (whoami.error?.code === "ENOENT") {
+  fail("1Password CLI not found — install `op` and run `op signin` first.");
+}
+if (whoami.status !== 0) {
+  fail("Not signed in to 1Password — run `op signin` first.");
+}
+
+// 3. Prompt for the item title (default: package.json name) and an optional tag.
+if (!process.stdin.isTTY) fail("env:save is interactive — run it in a terminal.");
+let defaultTitle = "";
+try {
+  defaultTitle = JSON.parse(readFileSync("package.json", "utf-8")).name ?? "";
+} catch {
+  // no package.json name — leave the title prompt empty
+}
+const rl = createInterface({ input: process.stdin, output: process.stdout });
+const title =
+  (
+    await rl.question(
+      `1Password item title${defaultTitle ? ` [${defaultTitle}]` : ""}: `,
+    )
+  ).trim() || defaultTitle;
+const tag = (await rl.question("Tag (optional): ")).trim();
+rl.close();
+if (!title) fail("A title is required.");
+
+// 4. Refuse if an item with that title already exists in the vault.
+const existing = spawnSync("op", ["item", "get", title, "--vault", VAULT], {
+  stdio: "ignore",
+});
+if (existing.status === 0) {
+  fail(
+    `An item "${title}" already exists in ${VAULT} — rename or remove it first.`,
+  );
+}
+
+// 5. Create the item from a JSON template piped via stdin.
+const template = {
+  title,
+  category: "SECURE_NOTE",
+  ...(tag ? { tags: [tag] } : {}),
+  fields: [{ label: "private-key", type: "CONCEALED", value: privateKey }],
+};
+const created = spawnSync(
+  "op",
+  ["item", "create", "--vault", VAULT, "--format", "json", "-"],
+  { input: JSON.stringify(template), encoding: "utf-8", stdio: ["pipe", "pipe", "inherit"] },
+);
+if (created.status !== 0) fail("\nFailed to create the 1Password item.");
+
+// 6. Reference the item by id (stable; survives renames), falling back to title.
+let itemRef = title;
+try {
+  const id = JSON.parse(created.stdout)?.id;
+  if (id) itemRef = id;
+} catch {
+  // non-JSON output — keep the title-based ref
+}
+const ref = `op://${VAULT}/${itemRef}/private-key`;
+setOpRef(ref);
+
+console.log(`\n✓ Saved to 1Password (${VAULT} / "${title}").`);
+console.log(`  Set DOTENV_PRIVATE_KEY_OP_REF=${ref} in .env.`);
+console.log("  Teammates can now restore with `bun run env:setup`.");