bsmnt 0.7.1 → 0.9.0

package/src/templates/next-default/README.md

@@ -22,6 +22,7 @@ bun dev
 | `bun format` | Format the codebase |
 | `bun typecheck` | Run TypeScript |
 | `bun analyze` | Analyze the Next.js bundle |
+<!-- bsmnt:if dotenvx -->
 | `bun env:set KEY value` | Encrypt one value into `.env` (`--plain`, `--preview`/`--prod`) |
 | `bun env:encrypt-all` | Bulk-encrypt every plaintext value in a file (`--preview`/`--prod`) |
 | `bun env:setup` | Restore `.env.keys` from 1Password |
@@ -29,7 +30,9 @@ bun dev
 | `bun env:setup-remote` | Push private keys to GitHub / Vercel (`github`/`vercel`, or pick) |
 | `bun setup-remote` | Create the GitHub repo, link a Vercel project, and push the key to Vercel env |
 | `bun env:save` | Save the private key to 1Password (Development vault) |
+<!-- bsmnt:endif -->
 
+<!-- bsmnt:if dotenvx -->
 ## Environment variables
 
 Secrets are encrypted at rest with [dotenvx](https://dotenvx.com): the committed `.env` holds encrypted values, the private keys live in `.env.keys` (gitignored), and dev/build run through `dotenvx run` so values decrypt automatically.
@@ -53,6 +56,15 @@ Secrets are encrypted at rest with [dotenvx](https://dotenvx.com): the committed
 
 A gitleaks pre-commit hook + CI scan block committed plaintext secrets (install: `brew install gitleaks`).
 
+<!-- bsmnt:endif -->
+<!-- bsmnt:if !dotenvx -->
+## Environment variables
+
+Copy `.env.example` to `.env.local` and fill in the values you need. `.env.local` is gitignored, so it stays off version control. Only `NEXT_PUBLIC_*` variables are exposed to the browser — everything else is server-only.
+
+For deploys, set the same variables in your host's dashboard (e.g. Vercel → Settings → Environment Variables).
+
+<!-- bsmnt:endif -->
 ## Project Structure
 
 ```txt
@@ -90,8 +102,10 @@ The workflow takes its runtime versions from your manifests, so there's a single
 
 It also caches Bun's install cache between runs, and the test step is a no-op until you add real test files.
 
+<!-- bsmnt:if dotenvx -->
 The build decrypts the committed `.env` with the dotenvx private key, pulled from 1Password: set an **org-level** `OP_SERVICE_ACCOUNT_TOKEN` (a read-only [service account](https://developer.1password.com/docs/service-accounts/) scoped to the `Development` vault) — one secret for every repo — and CI reads the key via the op-ref committed in `.env`. A per-repo `DOTENV_PRIVATE_KEY` secret (`bun run env:setup-remote github`) works as a fallback; builds pass without either (only plaintext / `NEXT_PUBLIC_*` is read).
 
+<!-- bsmnt:endif -->
 ### Branch protection
 
 To block merges when CI fails, enable branch protection on `main`:

package/src/templates/next-default/knip.json

@@ -12,11 +12,13 @@
     "@svgr/webpack",
     "gsap",
     "@gsap/react",
-    "motion"
+    "motion",
+    "detect-gpu",
+    "lodash-es",
+    "@types/lodash-es",
+    "react-device-detect",
+    "zustand"
   ],
-  "ignoreBinaries": [
-    "op",
-    "gh",
-    "vercel"
-  ]
+  "ignoreBinaries": ["op", "gh", "vercel"],
+  "ignoreFiles": [".agents/**", ".claude/**", "hooks/**"]
 }

package/src/templates/next-default/lefthook.yml

@@ -14,11 +14,6 @@ pre-commit:
       run: bunx tsgo --noEmit --incremental false
       stage_fixed: false
 
-pre-push:
-  commands:
-    knip:
-      run: bun run knip
-
 post-merge:
   commands:
     install-deps:

package/src/templates/next-experiments/.env.example

@@ -1,6 +1,7 @@
 # ============================================
 # Basement Next Starter - Environment Variables
 # ============================================
+# bsmnt:if dotenvx
 # This project uses dotenvx (https://dotenvx.com): the committed `.env` holds
 # shared values, with secrets encrypted there. The private keys live in
 # `.env.keys` (gitignored) — restore them with `bun run env:setup`.
@@ -15,6 +16,13 @@
 #
 # This file just documents the available variables; real values live in `.env`.
 # ============================================
+# bsmnt:endif
+# bsmnt:if !dotenvx
+# Copy this file to `.env.local` and fill in the values you need.
+# `.env.local` is gitignored, so real values stay off version control.
+# Only NEXT_PUBLIC_* variables are exposed to the browser.
+# ============================================
+# bsmnt:endif
 
 
 # ============================================

package/src/templates/next-experiments/.github/workflows/ci.yml

@@ -46,6 +46,7 @@ jobs:
       - name: Lint
         run: bun run lint
 
+      # bsmnt:if dotenvx
       # dotenvx needs the private key to decrypt secrets at build time. It's
       # pulled from 1Password via an org-wide service-account token + the op-ref
       # committed in .env. Optional: builds pass without it (only plaintext /
@@ -70,6 +71,12 @@ jobs:
           fi
           bun run build
 
+      # bsmnt:endif
+      # bsmnt:if !dotenvx
+      - name: Build
+        run: bun run build
+
+      # bsmnt:endif
       # Runs your tests if any exist; a fresh project with none passes cleanly.
       - name: Test
         run: |

package/src/templates/next-experiments/README.md

@@ -22,6 +22,7 @@ bun dev
 | `bun format` | Format the codebase |
 | `bun typecheck` | Run TypeScript |
 | `bun analyze` | Analyze the Next.js bundle |
+<!-- bsmnt:if dotenvx -->
 | `bun env:set KEY value` | Encrypt one value into `.env` (`--plain`, `--preview`/`--prod`) |
 | `bun env:encrypt-all` | Bulk-encrypt every plaintext value in a file (`--preview`/`--prod`) |
 | `bun env:setup` | Restore `.env.keys` from 1Password |
@@ -29,7 +30,9 @@ bun dev
 | `bun env:setup-remote` | Push private keys to GitHub / Vercel (`github`/`vercel`, or pick) |
 | `bun setup-remote` | Create the GitHub repo, link a Vercel project, and push the key to Vercel env |
 | `bun env:save` | Save the private key to 1Password (Development vault) |
+<!-- bsmnt:endif -->
 
+<!-- bsmnt:if dotenvx -->
 ## Environment variables
 
 Secrets are encrypted at rest with [dotenvx](https://dotenvx.com): the committed `.env` holds encrypted values, the private keys live in `.env.keys` (gitignored), and dev/build run through `dotenvx run` so values decrypt automatically.
@@ -53,6 +56,15 @@ Secrets are encrypted at rest with [dotenvx](https://dotenvx.com): the committed
 
 A gitleaks pre-commit hook + CI scan block committed plaintext secrets (install: `brew install gitleaks`).
 
+<!-- bsmnt:endif -->
+<!-- bsmnt:if !dotenvx -->
+## Environment variables
+
+Copy `.env.example` to `.env.local` and fill in the values you need. `.env.local` is gitignored, so it stays off version control. Only `NEXT_PUBLIC_*` variables are exposed to the browser — everything else is server-only.
+
+For deploys, set the same variables in your host's dashboard (e.g. Vercel → Settings → Environment Variables).
+
+<!-- bsmnt:endif -->
 ## Project Structure
 
 ```txt
@@ -90,8 +102,10 @@ The workflow takes its runtime versions from your manifests, so there's a single
 
 It also caches Bun's install cache between runs, and the test step is a no-op until you add real test files.
 
+<!-- bsmnt:if dotenvx -->
 The build decrypts the committed `.env` with the dotenvx private key, pulled from 1Password: set an **org-level** `OP_SERVICE_ACCOUNT_TOKEN` (a read-only [service account](https://developer.1password.com/docs/service-accounts/) scoped to the `Development` vault) — one secret for every repo — and CI reads the key via the op-ref committed in `.env`. A per-repo `DOTENV_PRIVATE_KEY` secret (`bun run env:setup-remote github`) works as a fallback; builds pass without either (only plaintext / `NEXT_PUBLIC_*` is read).
 
+<!-- bsmnt:endif -->
 ### Branch protection
 
 To block merges when CI fails, enable branch protection on `main`:

package/src/templates/next-experiments/knip.json

@@ -12,11 +12,13 @@
     "@svgr/webpack",
     "gsap",
     "@gsap/react",
-    "motion"
+    "motion",
+    "detect-gpu",
+    "lodash-es",
+    "@types/lodash-es",
+    "react-device-detect",
+    "zustand"
   ],
-  "ignoreBinaries": [
-    "op",
-    "gh",
-    "vercel"
-  ]
+  "ignoreBinaries": ["op", "gh", "vercel"],
+  "ignoreFiles": [".agents/**", ".claude/**", "hooks/**"]
 }

package/src/templates/next-experiments/lefthook.yml

@@ -14,11 +14,6 @@ pre-commit:
       run: bunx tsgo --noEmit --incremental false
       stage_fixed: false
 
-pre-push:
-  commands:
-    knip:
-      run: bun run knip
-
 post-merge:
   commands:
     install-deps:

package/src/templates/next-pagebuilder/.env.example

@@ -1,6 +1,7 @@
 # ============================================
 # Basement Next Starter - Environment Variables
 # ============================================
+# bsmnt:if dotenvx
 # This project uses dotenvx (https://dotenvx.com): the committed `.env` holds
 # shared values, with secrets encrypted there. The private keys live in
 # `.env.keys` (gitignored) — restore them with `bun run env:setup`.
@@ -15,6 +16,13 @@
 #
 # This file just documents the available variables; real values live in `.env`.
 # ============================================
+# bsmnt:endif
+# bsmnt:if !dotenvx
+# Copy this file to `.env.local` and fill in the values you need.
+# `.env.local` is gitignored, so real values stay off version control.
+# Only NEXT_PUBLIC_* variables are exposed to the browser.
+# ============================================
+# bsmnt:endif
 
 # Base URL
 NEXT_PUBLIC_BASE_URL=

package/src/templates/next-pagebuilder/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,13 @@
+## Summary
+
+<!-- Brief description of what this PR does -->
+
+## Changes
+
+- 
+
+## Checklist
+
+- [ ] `bun lint` passes
+- [ ] Tested locally in dev mode
+- [ ] No breaking changes (or documented in summary)

package/src/templates/next-pagebuilder/.github/workflows/ci.yml

@@ -46,6 +46,7 @@ jobs:
       - name: Lint
         run: bun run lint
 
+      # bsmnt:if dotenvx
       # dotenvx needs the private key to decrypt secrets at build time. It's
       # pulled from 1Password via an org-wide service-account token + the op-ref
       # committed in .env. Optional: builds pass without it (only plaintext /
@@ -77,6 +78,20 @@ jobs:
           fi
           bun run build
 
+      # bsmnt:endif
+      # bsmnt:if !dotenvx
+      - name: Build
+        env:
+          # Sanity project ID and dataset are public (they ship in the client
+          # bundle), so they are stored as repository variables. The Sanity read
+          # token is secret — add it under Settings → Secrets and variables →
+          # Actions. All three are empty (and harmless) until Sanity is set up.
+          NEXT_PUBLIC_SANITY_PROJECT_ID: ${{ vars.NEXT_PUBLIC_SANITY_PROJECT_ID }}
+          NEXT_PUBLIC_SANITY_DATASET: ${{ vars.NEXT_PUBLIC_SANITY_DATASET }}
+          SANITY_API_READ_TOKEN: ${{ secrets.SANITY_API_READ_TOKEN }}
+        run: bun run build
+
+      # bsmnt:endif
       # Runs your tests if any exist; a fresh project with none passes cleanly.
       - name: Test
         run: |

package/src/templates/next-pagebuilder/README.md

@@ -21,6 +21,7 @@ bun dev
 - `bun build` - Production build
 - `bun lint` - Run linter
 - `bun sanity:typegen` - Generate Sanity types
+<!-- bsmnt:if dotenvx -->
 - `bun env:set KEY value` - Encrypt one value into `.env` (`--plain`, `--preview`/`--prod`)
 - `bun env:encrypt-all` - Bulk-encrypt every plaintext value in a file (`--preview`/`--prod`)
 - `bun env:setup` - Restore `.env.keys` from 1Password
@@ -28,7 +29,9 @@ bun dev
 - `bun env:setup-remote` - Push private keys to GitHub / Vercel (`github`/`vercel`, or pick)
 - `bun setup-remote` - Create the GitHub repo, link a Vercel project, and push the key to Vercel env
 - `bun env:save` - Save the private key to 1Password (Development vault)
+<!-- bsmnt:endif -->
 
+<!-- bsmnt:if dotenvx -->
 ## Environment variables
 
 Secrets are encrypted at rest with [dotenvx](https://dotenvx.com): the committed `.env` holds encrypted values, the private keys live in `.env.keys` (gitignored), and dev/build run through `dotenvx run` so values decrypt automatically.
@@ -52,6 +55,15 @@ Secrets are encrypted at rest with [dotenvx](https://dotenvx.com): the committed
 
 A gitleaks pre-commit hook + CI scan block committed plaintext secrets (install: `brew install gitleaks`).
 
+<!-- bsmnt:endif -->
+<!-- bsmnt:if !dotenvx -->
+## Environment variables
+
+Copy `.env.example` to `.env.local` and fill in the values you need. `.env.local` is gitignored, so it stays off version control. Only `NEXT_PUBLIC_*` variables are exposed to the browser — everything else is server-only.
+
+For deploys, set the same variables in your host's dashboard (e.g. Vercel → Settings → Environment Variables).
+
+<!-- bsmnt:endif -->
 ## Continuous Integration
 
 A GitHub Actions workflow (`.github/workflows/ci.yml`) runs on every pull request to `main` and on pushes to `main`. It runs type checking, linting, the production build, tests, and `knip`.
@@ -63,8 +75,10 @@ The workflow takes its runtime versions from your manifests, so there's a single
 
 It also caches Bun's install cache between runs, and the test step is a no-op until you add real test files.
 
+<!-- bsmnt:if dotenvx -->
 The build decrypts the committed `.env` with the dotenvx private key, pulled from 1Password: set an **org-level** `OP_SERVICE_ACCOUNT_TOKEN` (a read-only [service account](https://developer.1password.com/docs/service-accounts/) scoped to the `Development` vault) — one secret for every repo — and CI reads the key via the op-ref committed in `.env`. A per-repo `DOTENV_PRIVATE_KEY` secret (`bun run env:setup-remote github`) works as a fallback; builds pass without either (only plaintext / `NEXT_PUBLIC_*` is read).
 
+<!-- bsmnt:endif -->
 ### Sanity environment
 
 The build reads Sanity config from GitHub Actions variables/secrets (empty and harmless until you configure Sanity). Once your repo is on GitHub, the quickest way to set them is:

package/src/templates/next-pagebuilder/app/(content)/[[...slug]]/page.tsx

@@ -14,7 +14,7 @@ import { checkRedirect } from "@/lib/utils/check-redirect"
 import { generateSanityMetadata } from "@/lib/utils/metadata"
 import { getSlugTag } from "@/lib/utils/slug-tag"
 
-const getPageDocument = async (slug: string | null, stega = true) =>
+const getPageDocument = async (slug: string | null, stega?: boolean) =>
   fetchSanity<PAGE_QUERY_RESULT>({
     query: PAGE_QUERY,
     params: { slug },
@@ -27,7 +27,7 @@ const toPath = (segments?: string[]) =>
 
 const getResolvedPage = async (
   path: string | null,
-  stega = true
+  stega?: boolean
 ): Promise<NonNullable<PAGE_QUERY_RESULT> | null> => {
   const { data: page } = await getPageDocument(path, stega)
   return (page as NonNullable<PAGE_QUERY_RESULT> | null) ?? null

package/src/templates/next-pagebuilder/app/actions/unlock-gated-content.ts

@@ -0,0 +1,39 @@
+"use server"
+
+import { fetchSanity } from "@/lib/integrations/sanity/live"
+import { GATED_CONTENT_QUERY } from "@/lib/integrations/sanity/queries"
+import type { GATED_CONTENT_QUERY_RESULT } from "@/lib/integrations/sanity/sanity.types"
+
+export type GatedContentPayload = NonNullable<GATED_CONTENT_QUERY_RESULT>
+
+export type UnlockResult =
+  | { ok: true; payload: GatedContentPayload }
+  | { ok: false; error: string }
+
+type UnlockInput = { documentId: string; email: string }
+
+export async function unlockGatedContent({
+  documentId,
+  email,
+}: UnlockInput): Promise<UnlockResult> {
+  if (!documentId) return { ok: false, error: "Missing content id." }
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+    return { ok: false, error: "Enter a valid email address." }
+  }
+
+  // Lead-capture seam: forward `email` to your CRM / email provider here.
+  // This is not access control — the payload is withheld from the page until
+  // this action runs, but anyone who submits the form receives it.
+
+  const { data } = await fetchSanity<GATED_CONTENT_QUERY_RESULT>({
+    query: GATED_CONTENT_QUERY,
+    params: { id: documentId },
+    // stega must stay off: it injects invisible characters into strings, which
+    // would corrupt the asset URLs returned for download/playback.
+    stega: false,
+  })
+
+  if (!data) return { ok: false, error: "Content not found." }
+
+  return { ok: true, payload: data }
+}

package/src/templates/next-pagebuilder/components/page-builder/components/gated-content/index.tsx

@@ -0,0 +1,169 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import {
+  type GatedContentPayload,
+  unlockGatedContent,
+} from "@/app/actions/unlock-gated-content"
+import type { PageBuilderBlock } from "@/components/page-builder/types"
+import { RichText } from "@/components/sanity/rich-text"
+import { Link } from "@/components/ui/link"
+
+type GatedContentBlock = Extract<PageBuilderBlock, { _type: "gatedContent" }>
+
+type GatedContentProps = {
+  block: GatedContentBlock
+}
+
+type GateState = "locked" | "loading" | "unlocked"
+
+const STORAGE_PREFIX = "gated-content:"
+
+export function GatedContent({ block }: GatedContentProps) {
+  const storageKey = `${STORAGE_PREFIX}${block._id}`
+  const [state, setState] = useState<GateState>("locked")
+  const [payload, setPayload] = useState<GatedContentPayload | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [justUnlocked, setJustUnlocked] = useState(false)
+
+  // The payload is withheld from the page query, so it never reaches the client
+  // until this action runs. We remember the submitted email so a returning
+  // visitor re-fetches without seeing the form again.
+  const unlock = async (email: string, persist: boolean) => {
+    setState("loading")
+    setError(null)
+
+    const result = await unlockGatedContent({ documentId: block._id, email })
+
+    if (!result.ok) {
+      setError(result.error)
+      setState("locked")
+      if (!persist) window.localStorage.removeItem(storageKey)
+      return
+    }
+
+    setPayload(result.payload)
+    setState("unlocked")
+    if (persist) {
+      window.localStorage.setItem(storageKey, email)
+      setJustUnlocked(true)
+    }
+  }
+
+  // biome-ignore lint/correctness/useExhaustiveDependencies: re-fetch only when the block changes; unlock closes over stable values
+  useEffect(() => {
+    const savedEmail = window.localStorage.getItem(storageKey)
+    if (savedEmail) void unlock(savedEmail, false)
+  }, [storageKey])
+
+  const handleSubmit = (event: React.FormEvent<HTMLFormElement>) => {
+    event.preventDefault()
+    const email =
+      new FormData(event.currentTarget).get("email")?.toString() ?? ""
+    void unlock(email, true)
+  }
+
+  return (
+    <section className="py-8 md:py-12">
+      {block.teaserHeading ? (
+        <h2 className="mb-4 font-semibold text-2xl tracking-tight md:text-4xl">
+          {block.teaserHeading}
+        </h2>
+      ) : null}
+
+      {block.teaserBody ? (
+        <div className="max-w-[62ch] space-y-4 text-base/7 text-current/80 md:text-lg/8">
+          <RichText content={block.teaserBody} />
+        </div>
+      ) : null}
+
+      {state === "unlocked" && payload ? (
+        <div className="mt-8">
+          {justUnlocked && block.successMessage ? (
+            <p className="mb-6 rounded-lg bg-black/[0.04] px-4 py-3 text-current/72 text-sm">
+              {block.successMessage}
+            </p>
+          ) : null}
+          <GatedReveal payload={payload} />
+        </div>
+      ) : (
+        <form
+          onSubmit={handleSubmit}
+          className="mt-8 flex max-w-md flex-col gap-4 rounded-[1.5rem] border border-black/10 bg-black/[0.02] p-6"
+        >
+          {block.gateHeadline ? (
+            <h3 className="font-semibold text-lg">{block.gateHeadline}</h3>
+          ) : null}
+          {block.gateDescription ? (
+            <p className="text-current/72 text-sm">{block.gateDescription}</p>
+          ) : null}
+          <input
+            type="email"
+            name="email"
+            required
+            placeholder="you@example.com"
+            className="rounded-lg border border-black/10 bg-white px-4 py-2.5 text-sm outline-none focus:border-black/40"
+          />
+          {error ? <p className="text-red-600 text-sm">{error}</p> : null}
+          <button
+            type="submit"
+            disabled={state === "loading"}
+            className="rounded-lg bg-black px-4 py-2.5 font-medium text-sm text-white transition-colors hover:bg-black/80 disabled:opacity-60"
+          >
+            {state === "loading" ? "Unlocking…" : block.submitLabel || "Unlock"}
+          </button>
+        </form>
+      )}
+    </section>
+  )
+}
+
+function GatedReveal({ payload }: { payload: GatedContentPayload }) {
+  if (payload.kind === "richText" && payload.content) {
+    return (
+      <div className="max-w-[62ch] space-y-4 text-base/7 text-current/80 md:text-lg/8">
+        <RichText content={payload.content} />
+      </div>
+    )
+  }
+
+  if (payload.kind === "file" && payload.file?.url) {
+    return (
+      <Link
+        href={payload.file.url}
+        download
+        className="inline-flex items-center gap-2 rounded-lg bg-black px-4 py-2.5 font-medium text-sm text-white transition-colors hover:bg-black/80"
+      >
+        Download {payload.file.originalFilename ?? "file"}
+      </Link>
+    )
+  }
+
+  if (payload.kind === "video") {
+    if (payload.video.url) {
+      return (
+        <div className="aspect-video w-full max-w-3xl overflow-hidden rounded-lg">
+          <iframe
+            src={payload.video.url}
+            title="Gated video"
+            allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
+            allowFullScreen
+            className="h-full w-full border-0"
+          />
+        </div>
+      )
+    }
+    if (payload.video.file?.url) {
+      return (
+        // biome-ignore lint/a11y/useMediaCaption: editor-supplied video without a caption track
+        <video
+          controls
+          src={payload.video.file.url}
+          className="w-full max-w-3xl rounded-lg"
+        />
+      )
+    }
+  }
+
+  return null
+}

package/src/templates/next-pagebuilder/components/page-builder/renderer.tsx

@@ -2,6 +2,7 @@ import { ArticleContent } from "./components/article-content"
 import { ContentCollection } from "./components/content-collection"
 import type { ContentCollectionSearchParams } from "./components/content-collection/types"
 import { Description } from "./components/description"
+import { GatedContent } from "./components/gated-content"
 import { Hero } from "./components/hero"
 import type { PageBuilderBlock, PageBuilderBlocks } from "./types"
 
@@ -42,6 +43,8 @@ function PageBuilderNode({
       return <Hero block={block} />
     case "description":
       return <Description block={block} />
+    case "gatedContent":
+      return <GatedContent block={block} />
     default:
       return null
   }

package/src/templates/next-pagebuilder/knip.json

@@ -22,11 +22,13 @@
     "rxjs",
     "gsap",
     "@gsap/react",
-    "motion"
+    "motion",
+    "detect-gpu",
+    "lodash-es",
+    "@types/lodash-es",
+    "react-device-detect",
+    "zustand"
   ],
-  "ignoreBinaries": [
-    "gh",
-    "op",
-    "vercel"
-  ]
+  "ignoreBinaries": ["gh", "op", "vercel"],
+  "ignoreFiles": [".agents/**", ".claude/**", "hooks/**"]
 }

package/src/templates/next-pagebuilder/lefthook.yml

@@ -14,11 +14,6 @@ pre-commit:
       run: bunx tsgo --noEmit --incremental false
       stage_fixed: false
 
-pre-push:
-  commands:
-    knip:
-      run: bun run knip
-
 post-merge:
   commands:
     install-deps: