bsmnt 0.6.4 → 0.7.1

package/src/modules/features/cms/sanity/files/app/blog/[slug]/page.tsx

@@ -34,11 +34,12 @@ export default async function BlogArticlePage({ params }: Props) {
 	if (!article) return notFound();
 
 	const articleUrl = `/blog/${slug}`;
-	const articleImage = article.featuredImage
-		? urlForImage(article.featuredImage).url()
-		: article.metadata?.image
-			? urlForImage(article.metadata.image).url()
-			: undefined;
+	let articleImage: string | undefined;
+	if (article.featuredImage) {
+		articleImage = urlForImage(article.featuredImage).url();
+	} else if (article.metadata?.image) {
+		articleImage = urlForImage(article.metadata.image).url();
+	}
 	const pageJsonLd = buildPageJsonLd(article.metadata?.jsonLd);
 
 	return (
@@ -57,13 +58,13 @@ export default async function BlogArticlePage({ params }: Props) {
 			{pageJsonLd.map(({ key, data }) => (
 				<JsonLd key={key} data={data} />
 			))}
-			<article className="container mx-auto px-4 py-8 max-w-4xl">
+			<article className="container mx-auto max-w-4xl px-4 py-8">
 				<header className="mb-8">
-					<h1 className="text-4xl font-bold mb-4">{article.title}</h1>
+					<h1 className="mb-4 font-bold text-4xl">{article.title}</h1>
 					{article.excerpt && (
-						<p className="text-lg text-gray-600">{article.excerpt}</p>
+						<p className="text-gray-600 text-lg">{article.excerpt}</p>
 					)}
-					<div className="flex gap-4 mt-4 text-sm text-gray-500">
+					<div className="mt-4 flex gap-4 text-gray-500 text-sm">
 						{article.author && <span>By {article.author}</span>}
 						{article.publishedAt && (
 							<time dateTime={article.publishedAt}>

package/src/modules/features/cms/sanity/files/app/blog/page.tsx

@@ -13,8 +13,8 @@ export default async function BlogIndexPage() {
 	const { data: articles } = await sanityFetch({ query: ALL_ARTICLES_QUERY });
 
 	return (
-		<main className="container mx-auto px-4 py-8 max-w-4xl">
-			<h1 className="text-4xl font-bold mb-8">Blog</h1>
+		<main className="container mx-auto max-w-4xl px-4 py-8">
+			<h1 className="mb-8 font-bold text-4xl">Blog</h1>
 
 			{articles && articles.length > 0 ? (
 				<ul className="flex flex-col gap-8">
@@ -25,15 +25,15 @@ export default async function BlogIndexPage() {
 						return (
 							<li key={article._id}>
 								<article>
-									<h2 className="text-2xl font-semibold mb-2">
+									<h2 className="mb-2 font-semibold text-2xl">
 										<Link href={`/blog/${slug}`} className="hover:underline">
 											{article.title}
 										</Link>
 									</h2>
 									{article.excerpt && (
-										<p className="text-gray-600 mb-2">{article.excerpt}</p>
+										<p className="mb-2 text-gray-600">{article.excerpt}</p>
 									)}
-									<div className="flex gap-4 text-sm text-gray-500">
+									<div className="flex gap-4 text-gray-500 text-sm">
 										{article.author && <span>By {article.author}</span>}
 										{article.publishedAt && (
 											<time dateTime={article.publishedAt}>

package/src/modules/features/cms/sanity/files/lib/integrations/sanity/sanity.config.ts

@@ -36,6 +36,9 @@ export default defineConfig({
 	projectId,
 	dataset,
 	schema,
+	// Content Releases is an Enterprise-only feature; hide it from the Studio.
+	releases: { enabled: false },
+	scheduledDrafts: { enabled: false },
 	plugins: [
 		structureTool({ structure }),
 		// Presentation tool for visual editing

package/src/modules/features/cms/sanity/files/lib/scripts/copy-sanity-mcp.ts

@@ -10,14 +10,14 @@ const link =
 
 const copied = await copyToClipboard(link);
 
-console.log("\n🔗 Sanity MCP Setup for Cursor\n");
+console.info("\n🔗 Sanity MCP Setup for Cursor\n");
 
 if (copied) {
-	console.log("✅ Link copied to clipboard!");
-	console.log("   Paste it in your browser or Cursor address bar.\n");
+	console.info("✅ Link copied to clipboard!");
+	console.info("   Paste it in your browser or Cursor address bar.\n");
 } else {
-	console.log("📋 Copy this link manually:\n");
-	console.log(`   ${link}\n`);
+	console.info("📋 Copy this link manually:\n");
+	console.info(`   ${link}\n`);
 }
 
-console.log("This will install the Sanity MCP server in Cursor.");
+console.info("This will install the Sanity MCP server in Cursor.");

package/src/modules/features/cms/sanity-pagebuilder/files/lib/integrations/sanity/page-tree-pane.tsx

@@ -198,12 +198,10 @@ export const PageTreePane = ({ options }: PageTreePaneProps) => {
 			{showPinned && (
 				<Stack>
 					{PINNED_PAGE_ENTRIES.map((entry) => {
-						const activeState: ActiveState =
-							activeChildId === entry.id
-								? isLeafPane
-									? "leaf"
-									: "ancestor"
-								: "none";
+						let activeState: ActiveState = "none";
+						if (activeChildId === entry.id) {
+							activeState = isLeafPane ? "leaf" : "ancestor";
+						}
 						return (
 							<PinnedRow
 								key={entry.id}

package/src/modules/features/cms/sanity-pagebuilder/files/lib/integrations/sanity/sanity.config.ts

@@ -28,6 +28,9 @@ export default defineConfig({
 	basePath: "/studio",
 	projectId,
 	dataset,
+	// Content Releases is an Enterprise-only feature; hide it from the Studio.
+	releases: { enabled: false },
+	scheduledDrafts: { enabled: false },
 	schema: {
 		...schema,
 		templates: (previousTemplates) => [

package/src/modules/features/cms/sanity-pagebuilder/files/lib/integrations/sanity/schemas/layout/redirect.ts

@@ -106,11 +106,12 @@ export const redirect = defineType({
 			permanent: "permanent",
 		},
 		prepare({ source, destination, permanent }) {
-			const target = destination
-				? /^https?:\/\//.test(destination)
+			let target = "?";
+			if (destination) {
+				target = /^https?:\/\//.test(destination)
 					? destination
-					: `/${destination}`
-				: "?";
+					: `/${destination}`;
+			}
 			return {
 				title: source ? `/${source}` : "Untitled redirect",
 				subtitle: `→ ${target} (${permanent ? "308" : "307"})`,

package/src/modules/features/cms/sanity-pagebuilder/files/lib/scripts/sanity-typegen.ts

@@ -1,43 +1,34 @@
 /**
- * Wrapper around `sanity schema extract && sanity typegen generate`
- * that gracefully skips when Sanity is not configured.
+ * Wrapper around `sanity schema extract && sanity typegen generate`; skips when
+ * Sanity isn't configured. Reads the project id from `process.env` — the
+ * dotenvx-wrapped script already decrypted `.env` into it — so it runs on Vercel
+ * too, which has no `.env.local`.
  */
 import { execSync } from "node:child_process";
-import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 
 const sanityDir = resolve(import.meta.dir, "../integrations/sanity");
-const envFile = resolve(import.meta.dir, "../../.env.local");
 
-// Check if Sanity project ID is configured
-const hasEnvFile = existsSync(envFile);
-
-if (!hasEnvFile) {
-	console.log("  Skipping sanity:typegen — .env.local not found");
-	process.exit(0);
-}
-
-// Read .env.local to check for project ID
-const envContent = Bun.file(envFile);
-const text = await envContent.text();
-const hasProjectId = text
-	.split("\n")
-	.some(
-		(line) =>
-			line.startsWith("NEXT_PUBLIC_SANITY_PROJECT_ID=") &&
-			line.split("=")[1]?.trim() !== "",
-	);
-
-if (!hasProjectId) {
-	console.log(
+if (!process.env.NEXT_PUBLIC_SANITY_PROJECT_ID) {
+	console.info(
 		"  Skipping sanity:typegen — NEXT_PUBLIC_SANITY_PROJECT_ID not set",
 	);
 	process.exit(0);
 }
 
+// Format the generated file to the project's biome style so the committed types
+// match lint — but only locally. In CI/Vercel the build discards the formatted
+// result, so running biome there is pure per-deploy waste. (Scoped to the one
+// file; linting the whole dir would rewrite unrelated source.)
+const format =
+	process.env.CI || process.env.VERCEL
+		? ""
+		: " && bun biome check --write --unsafe sanity.types.ts";
+
 try {
+	// No `--env-file` — dotenvx already injected the env into process.env.
 	execSync(
-		`cd ${sanityDir} && bun --env-file ../../../.env.local sanity schema extract && bun --env-file ../../../.env.local sanity typegen generate && bun biome check --write --unsafe`,
+		`cd ${sanityDir} && bun sanity schema extract && bun sanity typegen generate${format}`,
 		{ stdio: "inherit" },
 	);
 } catch {

package/src/modules/features/cms/sanity-pagebuilder/files/lib/utils/json-ld.tsx

@@ -27,6 +27,7 @@ const serializeJsonLd = <T extends Thing>(data: WithContext<T>) =>
 export const JsonLd = <T extends Thing>({ data }: JsonLdProps<T>) => (
 	<script
 		type="application/ld+json"
+		// biome-ignore lint/security/noDangerouslySetInnerHtml: serialized JSON-LD, not user HTML; `<` is escaped
 		dangerouslySetInnerHTML={{ __html: serializeJsonLd(data) }}
 	/>
 );

package/src/modules/features/env/dotenvx/files/decrypt-env.mjs

@@ -17,21 +17,21 @@ if (process.env.CI || process.env.VERCEL) {
 }
 
 const args = process.argv.slice(2);
-const file =
-  args.includes("--prod") || args.includes("--production")
-    ? ".env.production"
-    : args.includes("--preview")
-      ? ".env.preview"
-      : ".env";
+let file = ".env";
+if (args.includes("--prod") || args.includes("--production")) {
+  file = ".env.production";
+} else if (args.includes("--preview")) {
+  file = ".env.preview";
+}
 
 // Friendlier than dotenvx's MISSING_ENV_FILE error when the file isn't created yet.
 if (!existsSync(file)) {
-  const flag =
-    file === ".env.production"
-      ? " --prod"
-      : file === ".env.preview"
-        ? " --preview"
-        : "";
+  let flag = "";
+  if (file === ".env.production") {
+    flag = " --prod";
+  } else if (file === ".env.preview") {
+    flag = " --preview";
+  }
   console.error(
     `No ${file} yet. Add values with: bun run env:set KEY value${flag}`,
   );

package/src/modules/features/env/dotenvx/files/push-keys.mjs

@@ -25,13 +25,12 @@ export function parsePrivateKeys(content) {
   return keys;
 }
 
-// The base key decrypts the shared .env (loaded in every environment); a
-// suffixed key (…_PRODUCTION / …_PREVIEW) decrypts only that environment's file.
+// Base key → Production + Preview (where the server decrypts .env); a suffixed
+// key (…_PRODUCTION / …_PREVIEW) targets just that env. No Development: local
+// dev decrypts with .env.keys, not a Vercel var.
 export function vercelEnvsFor(name) {
   const suffix = name.slice("DOTENV_PRIVATE_KEY".length).replace(/^_/, "");
-  return suffix
-    ? [suffix.toLowerCase()]
-    : ["production", "preview", "development"];
+  return suffix ? [suffix.toLowerCase()] : ["production", "preview"];
 }
 
 // Ask which remote when no arg was given. Never hang a non-interactive shell.
@@ -97,12 +96,13 @@ async function main() {
   let ok = true;
   for (const { name, value } of keys) {
     if (target === "github") {
-      console.log(`→ gh secret set ${name}`);
+      console.info(`→ gh secret set ${name}`);
       ok = pipe("gh", ["secret", "set", name], value) && ok;
     } else {
       for (const env of vercelEnvsFor(name)) {
-        console.log(`→ vercel env add ${name} ${env}`);
-        ok = pipe("vercel", ["env", "add", name, env], value) && ok;
+        console.info(`→ vercel env add ${name} ${env} (sensitive)`);
+        // --sensitive: write-only, never shown in the dashboard.
+        ok = pipe("vercel", ["env", "add", name, env, "--sensitive"], value) && ok;
       }
     }
   }
@@ -116,7 +116,7 @@ async function main() {
     process.exit(1);
   }
 
-  console.log(
+  console.info(
     target === "vercel"
       ? "\nDone. Redeploy for the new env vars to take effect."
       : "\nDone.",

package/src/modules/features/env/dotenvx/files/save-key.mjs

@@ -131,6 +131,6 @@ try {
 const ref = `op://${VAULT}/${itemRef}/private-key`;
 setOpRef(ref);
 
-console.log(`\n✓ Saved to 1Password (${VAULT} / "${title}").`);
-console.log(`  Set DOTENV_PRIVATE_KEY_OP_REF=${ref} in .env.`);
-console.log("  Teammates can now restore with `bun run env:setup`.");
+console.info(`\n✓ Saved to 1Password (${VAULT} / "${title}").`);
+console.info(`  Set DOTENV_PRIVATE_KEY_OP_REF=${ref} in .env.`);
+console.info("  Teammates can now restore with `bun run env:setup`.");

package/src/modules/features/env/dotenvx/files/setup-remote.ts

@@ -0,0 +1,182 @@
+/**
+ * Create the GitHub repo, link a Vercel project to it, and push the dotenvx key
+ * to Vercel env — before the git connection, so the first push-to-deploy can
+ * decrypt the committed `.env`. No GitHub secret: CI reads the key from
+ * 1Password via OP_SERVICE_ACCOUNT_TOKEN.
+ *
+ *   bun setup-remote                # private repo under your account (default)
+ *   bun setup-remote --public       # public repo
+ *   bun setup-remote --org my-org   # create under an org
+ *
+ * The CLI runs the same sequence inline during `bsmnt create`
+ * (src/infrastructure/create/setup-remote.ts); keep the two in sync.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+
+const GH_HINT =
+	"gh CLI not found — install it (https://cli.github.com) and run `gh auth login`.";
+const VERCEL_HINT =
+	"vercel CLI not found — install it (`bun add -g vercel`) and try again.";
+
+/** Run an interactive command, letting the user answer its prompts directly. */
+function run(cmd: string, args: string[], notFoundHint: string): boolean {
+	const res = spawnSync(cmd, args, { stdio: "inherit" });
+	if ((res.error as NodeJS.ErrnoException | undefined)?.code === "ENOENT") {
+		console.error(`\n${notFoundHint}`);
+		process.exit(1);
+	}
+	return res.status === 0;
+}
+
+/**
+ * Push the private keys to Vercel env via the tested push-keys path, rather
+ * than re-implementing the per-key (stdin-piped) upload here.
+ */
+function pushVercelKeys(): boolean {
+	return (
+		spawnSync("bun", ["run", "scripts/push-keys.mjs", "vercel"], {
+			stdio: "inherit",
+		}).status === 0
+	);
+}
+
+function hasOriginRemote(): boolean {
+	return (
+		spawnSync("git", ["remote", "get-url", "origin"], { stdio: "ignore" })
+			.status === 0
+	);
+}
+
+function ghReady(): boolean {
+	const res = spawnSync("gh", ["auth", "status"], { stdio: "ignore" });
+	return (
+		(res.error as NodeJS.ErrnoException | undefined)?.code !== "ENOENT" &&
+		res.status === 0
+	);
+}
+
+/** True when `.env.keys` holds at least one non-empty DOTENV_PRIVATE_KEY*. */
+function hasPrivateKey(): boolean {
+	if (!existsSync(".env.keys")) return false;
+	for (const line of readFileSync(".env.keys", "utf8").split("\n")) {
+		const value = line
+			.match(/^\s*DOTENV_PRIVATE_KEY[A-Z_]*\s*=\s*(.+?)\s*$/)?.[1]
+			?.replace(/^["']|["']$/g, "");
+		if (value) return true;
+	}
+	return false;
+}
+
+function main(): void {
+	// No key means a deploy can't decrypt `.env` — nothing to wire up yet.
+	if (!hasPrivateKey()) {
+		console.error(
+			"No DOTENV_PRIVATE_KEY* in .env.keys — run `bun run env:setup` first so there's a key to push.",
+		);
+		process.exit(1);
+	}
+
+	// GitHub: ensure the repo exists so Vercel can git-connect to it.
+	let connected = hasOriginRemote();
+	if (!connected) {
+		if (ghReady()) {
+			// `--source` forces non-interactive mode, which requires a visibility flag.
+			const visibility = process.argv.includes("--public")
+				? "--public"
+				: "--private";
+			const orgIndex = process.argv.indexOf("--org");
+			const owner = orgIndex !== -1 ? process.argv[orgIndex + 1] : undefined;
+			const nameArg = owner ? [`${owner}/${path.basename(process.cwd())}`] : [];
+			console.info(`→ gh repo create (${visibility})`);
+			// No `--push` here: the push must come after `vercel git connect`, or
+			// the git integration never sees it and skips the first deployment.
+			if (
+				run(
+					"gh",
+					["repo", "create", ...nameArg, "--source=.", "--remote=origin", visibility],
+					GH_HINT,
+				)
+			) {
+				connected = hasOriginRemote();
+			}
+		} else {
+			console.info(
+				"\nNo `origin` remote and the gh CLI isn't ready — skipping GitHub setup.\n" +
+					"  Install gh (https://cli.github.com), run `gh auth login`, then re-run\n" +
+					"  (or create the repo manually and re-run).",
+			);
+		}
+	}
+
+	// Vercel: link the project and push the keys as env vars.
+	if (spawnSync("vercel", ["whoami"], { stdio: "ignore" }).status !== 0) {
+		console.info("→ vercel login");
+		if (!run("vercel", ["login"], VERCEL_HINT)) process.exit(1);
+	}
+	// Pick the scope via Vercel's team picker, then link with `--yes` so the
+	// validated lowercase dir name is used (the `Name?` prompt rejects uppercase).
+	console.info("→ vercel switch + link");
+	run("vercel", ["switch"], VERCEL_HINT);
+	if (!run("vercel", ["link", "--yes"], VERCEL_HINT)) {
+		console.error("\nLink cancelled — re-run `bun setup-remote` when ready.");
+		process.exit(1);
+	}
+	// Pin the Next.js framework so Vercel resolves the .next output (it sometimes
+	// creates the project as "Other"); commit it so the push below ships it.
+	if (!existsSync("vercel.json")) {
+		writeFileSync(
+			"vercel.json",
+			'{\n  "$schema": "https://openapi.vercel.sh/vercel.json",\n  "framework": "nextjs"\n}\n',
+		);
+		spawnSync("git", ["add", "vercel.json"], { stdio: "ignore" });
+		spawnSync(
+			"git",
+			[
+				"commit",
+				"-m",
+				"chore: pin Next.js framework for Vercel",
+				"--no-verify",
+				"--",
+				"vercel.json",
+			],
+			{ stdio: "ignore" },
+		);
+	}
+	console.info("→ uploading private keys to Vercel env");
+	if (!pushVercelKeys()) process.exit(1);
+
+	// Connect the two so pushes build from a clone (keys already in place).
+	if (!connected) {
+		console.info(
+			"\n✓ Vercel linked and keys uploaded. No GitHub repo connected yet — once\n" +
+				"  one exists, run `vercel git connect` for push-to-deploy.",
+		);
+		return;
+	}
+	console.info("→ vercel git connect");
+	if (!run("vercel", ["git", "connect"], VERCEL_HINT)) {
+		console.error(
+			"\nKeys uploaded, but `vercel git connect` failed. If the Git integration\n" +
+				"isn't installed, add it once from the Vercel dashboard (Account/Team →\n" +
+				"Integrations → GitHub), then re-run `vercel git connect`.",
+		);
+		process.exit(1);
+	}
+
+	// Push after connecting so the git integration builds the first deployment.
+	console.info("→ git push");
+	if (!run("git", ["push", "-u", "origin", "HEAD"], "git not found.")) {
+		console.error(
+			"\nConnected, but the push failed — run `git push` to trigger the first deploy.",
+		);
+		process.exit(1);
+	}
+
+	console.info(
+		"\n✓ GitHub + Vercel ready. Pushed — Vercel is building the first deployment.",
+	);
+}
+
+main();

package/src/modules/features/env/dotenvx/files/write-env.mjs

@@ -12,12 +12,12 @@ const [mode, ...rest] = process.argv.slice(2);
 
 // --prod / --preview pick the per-environment file; default is the shared .env.
 const ENV_FLAGS = new Set(["--prod", "--production", "--preview"]);
-const file =
-  rest.includes("--prod") || rest.includes("--production")
-    ? ".env.production"
-    : rest.includes("--preview")
-      ? ".env.preview"
-      : ".env";
+let file = ".env";
+if (rest.includes("--prod") || rest.includes("--production")) {
+  file = ".env.production";
+} else if (rest.includes("--preview")) {
+  file = ".env.preview";
+}
 
 // On bulk encrypt, keep browser-public NEXT_PUBLIC_* and the 1Password pointer
 // plaintext (same exclusions the scaffold uses).

package/src/modules/features/forms/hubspot/files/_sanity-adapter/form-block.ts

@@ -0,0 +1,60 @@
+import { EnvelopeIcon } from "@sanity/icons"
+import { defineField, defineType } from "sanity"
+import {
+  decodeHubSpotFormSelection,
+  getHubSpotFormSelectionLabel,
+} from "../form-selection"
+import { hubspotFormField } from "./form-field"
+
+/**
+ * Sample reusable HubSpot form block. Register it in your schema's document
+ * list (and page-builder config, if you use one), then render its `form` with
+ * <HubSpotForm /> from the integration core:
+ *
+ * @example
+ * import { HubSpotForm } from "@/lib/integrations/hubspot/form"
+ * import { decodeHubSpotFormSelection } from "@/lib/integrations/hubspot/form-selection"
+ *
+ * const selection = decodeHubSpotFormSelection(block.form)
+ * if (!selection) return null
+ * return <HubSpotForm {...selection} />
+ */
+export const hubspotFormBlock = defineType({
+  name: "hubspotFormBlock",
+  title: "HubSpot Form Block",
+  type: "document",
+  icon: EnvelopeIcon,
+  fields: [
+    defineField({
+      name: "name",
+      title: "Name",
+      type: "string",
+      description: "Used to identify this block in the Studio.",
+      validation: (Rule) => Rule.required(),
+    }),
+    hubspotFormField,
+  ],
+  preview: {
+    select: {
+      name: "name",
+      form: "form",
+    },
+    prepare({ name, form }) {
+      const selectedForm = decodeHubSpotFormSelection(form)
+
+      return {
+        title: name || "Untitled",
+        ...(selectedForm
+          ? { subtitle: getHubSpotFormSelectionLabel(selectedForm) }
+          : {}),
+      }
+    },
+  },
+})
+
+export const hubspotFormBlockReference = defineType({
+  name: "hubspotFormBlockReference",
+  title: "HubSpot Form Block",
+  type: "reference",
+  to: [{ type: "hubspotFormBlock" }],
+})

package/src/modules/features/forms/hubspot/files/_sanity-adapter/form-field.ts

@@ -0,0 +1,30 @@
+import { defineField } from "sanity"
+import { decodeHubSpotFormSelection } from "../form-selection"
+import { HubSpotFormSelectInput } from "./form-select-input"
+
+/**
+ * Shared HubSpot form picker field. Stores the selected form as one encoded
+ * string and validates it decodes to a real selection. Reuse it in any block
+ * or document that embeds a HubSpot form.
+ *
+ * @example
+ * defineType({
+ *   name: "contactBlock",
+ *   type: "object",
+ *   fields: [hubspotFormField],
+ * })
+ */
+export const hubspotFormField = defineField({
+  name: "form",
+  title: "HubSpot Form",
+  type: "string",
+  components: {
+    input: HubSpotFormSelectInput,
+  },
+  description:
+    "Fetches HubSpot forms when the dropdown is opened. The selected form is stored as one string.",
+  validation: (Rule) =>
+    Rule.required().custom((value) =>
+      decodeHubSpotFormSelection(value) ? true : "Select a valid HubSpot form."
+    ),
+})