dot_profile

#!/bin/sh

# NOTE: env vars that should always be available are declared directly in this file.
# Those that need encryption are decrypted in ~/.environment and loaded here
# Those that are tied to graphical environment are loaded from ~/.xsessionrc
# Those that are shell-specific (nushell, fish...) are loaded from there specific shell conf

export PNPM_HOME="${HOME}/.local/share/pnpm"
export MISE_DATA_DIR="${HOME}/.local/share/mise"

# 1. Add mise shims first
if [ -d "$MISE_DATA_DIR/shims" ]; then
  PATH="$MISE_DATA_DIR/shims:$PATH"
fi

# 2. Add other tool paths
PATH="${PATH}:${PNPM_HOME}"
if [ -d "${HOME}/.iximiuz/labctl/bin" ]; then
  PATH="${PATH}:${HOME}/.iximiuz/labctl/bin"
fi

# 3. Add Nix profile
if [ -d "${HOME}/.nix-profile/bin" ];then
  PATH="${PATH}:${HOME}/.nix-profile/bin"
fi

# 4. Prepend ~/.local/bin LAST so it overrides everything else (including mise shims)
# This ensures our custom wrappers (like age-plugin-tpm) take precedence over mise-installed binaries
if [ -d "${HOME}/.local/bin" ];then
  PATH="${HOME}/.local/bin:${PATH}"
fi

export PATH

# First login: decrypt encrypted chezmoi files
if command -v chezmoi >/dev/null 2>&1; then
  if command -v gpg >/dev/null 2>&1 && gpg --list-secret-keys >/dev/null 2>&1; then
    if [ ! -f "$HOME/.environment" ]; then
      printf '\033[32m>> First connection detected: Decrypting chezmoi secrets...\033[0m\n'
      if chezmoi apply --include=encrypted; then
        printf '\033[32m>> Secrets decrypted successfully.\033[0m\n'
      else
        printf '\033[31m>> Failed to decrypt secrets.\033[0m\n'
      fi
    fi
  fi
fi

# Source the secrets so they are available to the current shell environment
if [ -f "$HOME/.environment" ]; then
  . "$HOME/.environment"
fi

if [ -t 0 ]; then
  if command -v fish > /dev/null 2>&1; then
    exec fish
  fi
fi

# if running bash, source .bashrc
if [ -n "$BASH_VERSION" ]; then
  if [ -f "$HOME/.bashrc" ]; then
    . "$HOME/.bashrc"
  fi
fi