@decocms/blocks-cli 8.0.0 → 8.1.0-next.0

package/scripts/migrate/templates/playwright-yml.ts

@@ -0,0 +1,127 @@
+/**
+ * Scaffolds the E2E harness and its config/smoke companions:
+ *   .github/workflows/playwright.yml  — GitHub Actions workflow (chromium + webkit)
+ *   playwright.config.ts              — self-contained config (no support helpers)
+ *   tests/e2e/smoke.spec.ts           — harness smoke, no app boot, no network
+ *
+ * Design rationale:
+ *   - The smoke proves the Playwright harness runs in CI (chromium + webkit)
+ *     without the app booting or hitting the network — it renders inline HTML
+ *     via page.setContent. Real storefront specs (page.goto("/")) need a VCR
+ *     layer so CI does not hit the commerce API; add a `webServer` block to the
+ *     config and specs that navigate the app once that harness exists.
+ *   - webkit is included because the storefront audience is majority iOS Safari.
+ *   - The workflow needs `@playwright/test` + the `test:e2e` script, both in the
+ *     scaffolded package.json.
+ *
+ * @param bunVersion  Bun version for setup-bun (= CANONICAL_BUN_VERSION).
+ */
+export function generatePlaywrightFiles(bunVersion: string): Record<string, string> {
+  const bun = bunVersion.replace(/^bun@/, "");
+  return {
+    ".github/workflows/playwright.yml": generatePlaywrightYml(bun),
+    "playwright.config.ts": PLAYWRIGHT_CONFIG,
+    "tests/e2e/smoke.spec.ts": SMOKE_SPEC,
+  };
+}
+
+function generatePlaywrightYml(bunVersion: string): string {
+  return `name: Playwright
+
+# Functional E2E (chromium + webkit). Today only a harness smoke that renders
+# inline HTML — no app boot, no network — so it runs on a plain ubuntu runner.
+# When specs navigate the real app (via VCR), pin the container and add a
+# webServer block to playwright.config.ts.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: playwright-\${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  e2e:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "${bunVersion}"
+
+      - name: bun install --frozen-lockfile
+        run: bun install --frozen-lockfile
+
+      - name: Install browsers (chromium + webkit)
+        run: bunx playwright install --with-deps chromium webkit
+
+      - name: E2E
+        run: bun run test:e2e
+
+      - name: Upload HTML report
+        if: \${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 14
+`;
+}
+
+const PLAYWRIGHT_CONFIG = `/**
+ * Playwright config — E2E base.
+ *
+ * Today only a harness smoke (tests/e2e/smoke.spec.ts) that renders inline HTML,
+ * proving the harness runs in CI without the app booting or hitting the network.
+ * Real app E2E (page.goto("/")) needs a VCR layer so CI does not call the
+ * commerce API — add a \`webServer\` block (e.g. { command: "bun run build && bun
+ * run preview", url: "http://localhost:4173" }) and the navigating specs then.
+ *
+ * chromium + webkit (webkit because the storefront audience is majority iOS
+ * Safari). 1 worker, 0 retries on purpose: retry masks flake instead of exposing it.
+ */
+
+import { defineConfig, devices } from "@playwright/test";
+
+export default defineConfig({
+  testDir: "./tests/e2e",
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: 0,
+  workers: 1,
+  reporter: [["html", { open: "never" }], ["list"]],
+  use: {
+    trace: "retain-on-failure",
+    screenshot: "only-on-failure",
+  },
+  projects: [
+    { name: "chromium", use: { ...devices["Desktop Chrome"] } },
+    { name: "webkit", use: { ...devices["Desktop Safari"] } },
+  ],
+});
+`;
+
+const SMOKE_SPEC = `/**
+ * Smoke E2E — proves the Playwright harness runs (chromium + webkit) in CI
+ * without the app booting or hitting the network. Does not test the real app;
+ * the storefront E2E (page.goto("/")) comes with the VCR + cassettes harness.
+ */
+
+import { expect, test } from "@playwright/test";
+
+test("harness renders inline content", async ({ page }) => {
+  await page.setContent(
+    '<title>e2e smoke</title><h1>ok</h1><div data-testid="marker">ready</div>',
+  );
+
+  await expect(page).toHaveTitle("e2e smoke");
+  await expect(page.getByRole("heading", { name: "ok" })).toBeVisible();
+  await expect(page.getByTestId("marker")).toHaveText("ready");
+});
+`;

package/scripts/migrate/templates/react-doctor-yml.ts

@@ -0,0 +1,46 @@
+/**
+ * Scaffolds `.github/workflows/react-doctor.yml` — flags React
+ * security/perf/correctness/a11y/bundle-size/architecture issues on PRs.
+ *
+ * Advisory by construction (the action's default: comments, never fails the
+ * build). Separate workflow from ci.yml on purpose — zero coupling with the
+ * blocking gates. `fetch-depth: 0` gives the merge-base so it reports only what
+ * the PR introduces.
+ *
+ * Fully generic — no per-site parameters. Docs: https://www.react.doctor/ci
+ */
+export function generateReactDoctorYml(): string {
+  return `name: React Doctor
+
+# Flags React security/perf/correctness/a11y/bundle-size/architecture issues.
+# Advisory by construction (comments, never fails the check). To make it a hard
+# gate, add \`with: { blocking: error }\` to the action step below.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  statuses: write
+
+concurrency:
+  group: react-doctor-\${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  react-doctor:
+    runs-on: ubuntu-latest
+    steps:
+      # fetch-depth: 0 gives the merge-base so it reports only PR-introduced findings.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: millionco/react-doctor@v2
+`;
+}

package/scripts/migrate/templates/routes.test.ts

@@ -57,3 +57,34 @@ describe("scaffolded deco admin routes use HMR-safe factories", () => {
     });
   }
 });
+
+/**
+ * Regression guard: the page renderers must wire `loadDeferredSectionFn` to the
+ * `deferredSectionLoader` shim, never the raw `loadDeferredSection` server fn.
+ * `loadDeferredSection` is a createServerFn with an inputValidator, so it must
+ * be called as `fn({ data })`; DeferredSectionWrapper calls `loadFn(bareArgs)`,
+ * so passing the raw fn leaves `ctx.data` undefined and the deferred section
+ * renders blank. The shim wraps the `{ data }` envelope.
+ */
+describe("scaffolded page routes wire the deferred-loader shim, not the raw server fn", () => {
+  for (const platform of ["vtex", "custom"] as const) {
+    describe(`platform: ${platform}`, () => {
+      const files = generateRoutes(makeCtx(platform));
+
+      for (const file of ["src/routes/index.tsx", "src/routes/$.tsx"] as const) {
+        it(`${file} passes deferredSectionLoader from the sdk subpath`, () => {
+          const content = files[file];
+          expect(content, `${file} must be emitted`).toBeTypeOf("string");
+
+          expect(content).toContain(
+            'import { deferredSectionLoader } from "@decocms/tanstack/sdk/deferredSectionLoader"',
+          );
+          expect(content).toContain("loadDeferredSectionFn={deferredSectionLoader}");
+
+          // The broken form: the raw server fn passed directly.
+          expect(content).not.toContain("loadDeferredSectionFn={loadDeferredSection}");
+        });
+      }
+    });
+  }
+});

package/scripts/migrate/templates/routes.ts

@@ -46,22 +46,31 @@ function generateRoot(ctx: MigrationContext, siteTitle: string, vtexAccount: str
 
   // Build preconnect list based on platform
   const preconnects: string[] = [];
-  preconnects.push(`      { rel: "preconnect", href: "https://decoims.com", crossOrigin: "anonymous" as const },`);
+  preconnects.push(`      { rel: "preconnect", href: "https://assets.decocms.com", crossOrigin: "anonymous" as const },`);
   if (isVtex) {
     preconnects.push(`      { rel: "preconnect", href: "https://${vtexAccount}.vtexassets.com", crossOrigin: "anonymous" as const },`);
   }
 
-  // Font preloads
+  const googleFontLinks = [
+    ...ctx.googleFonts.preconnects.map((href) =>
+      `      { rel: "preconnect", href: "${href}"${href.includes("gstatic") ? ', crossOrigin: "anonymous" as const' : ""} },`
+    ),
+    ...ctx.googleFonts.stylesheets.map((href) =>
+      `      { rel: "stylesheet", href: "${href}" },`
+    ),
+  ];
+
   const fontPreloads = fonts.map((f) =>
     `      { rel: "preload", href: "${f}", as: "font", type: "font/woff2", crossOrigin: "anonymous" as const },`
   );
 
-  // DNS prefetch for common third-party services
   const dnsPrefetch: string[] = [];
   if (isVtex) {
     dnsPrefetch.push(`      { rel: "dns-prefetch", href: "https://sp.vtex.com" },`);
   }
 
+  const linkLines = [...preconnects, ...googleFontLinks, ...fontPreloads].filter(Boolean);
+
   return `import { createRootRoute } from "@tanstack/react-router";
 import { DecoRootLayout } from "@decocms/tanstack";
 // @ts-ignore Vite ?url import
@@ -83,8 +92,7 @@ export const Route = createRootRoute({
       { property: "og:locale", content: "pt_BR" },
     ],
     links: [
-${preconnects.join("\n")}
-${fontPreloads.join("\n")}
+${linkLines.join("\n")}
       { rel: "stylesheet", href: appCss },
       { rel: "icon", href: "/favicon.ico" },
 ${dnsPrefetch.join("\n")}
@@ -107,7 +115,8 @@ function RootLayout() {
 
 function generateIndex(ctx: MigrationContext, siteTitle: string): string {
   return `import { createFileRoute } from "@tanstack/react-router";
-import { cmsHomeRouteConfig, DecoPageRenderer, loadDeferredSection } from "@decocms/tanstack";
+import { cmsHomeRouteConfig, DecoPageRenderer } from "@decocms/tanstack";
+import { deferredSectionLoader } from "@decocms/tanstack/sdk/deferredSectionLoader";
 
 // MIGRATION TODO: customize defaultTitle / defaultDescription / fallback
 // copy below for ${siteTitle}. CMS \`Site.seo\` overrides these once block
@@ -143,7 +152,7 @@ function HomePage() {
       deferredPromises={data.deferredPromises}
       pagePath={data.pagePath}
       pageUrl={data.pageUrl}
-      loadDeferredSectionFn={loadDeferredSection}
+      loadDeferredSectionFn={deferredSectionLoader}
     />
   );
 }
@@ -152,7 +161,8 @@ function HomePage() {
 
 function generateCatchAll(ctx: MigrationContext, siteTitle: string): string {
   return `import { createFileRoute } from "@tanstack/react-router";
-import { cmsRouteConfig, DecoPageRenderer, loadDeferredSection } from "@decocms/tanstack";
+import { cmsRouteConfig, DecoPageRenderer } from "@decocms/tanstack";
+import { deferredSectionLoader } from "@decocms/tanstack/sdk/deferredSectionLoader";
 
 // MIGRATION TODO: customize defaultTitle / defaultDescription for ${siteTitle}
 // (CMS \`Site.seo\` overrides these per-page once block resolution kicks in).
@@ -180,7 +190,7 @@ function CmsPage() {
       deferredPromises={data.deferredPromises}
       pagePath={data.pagePath}
       pageUrl={data.pageUrl}
-      loadDeferredSectionFn={loadDeferredSection}
+      loadDeferredSectionFn={deferredSectionLoader}
     />
   );
 }

package/scripts/migrate/templates/section-loaders.ts

@@ -139,8 +139,8 @@ export function generateSectionLoaders(ctx: MigrationContext): string {
   // returned.
   //
   // The previous template chose mixins XOR own-loader and silently dropped
-  // the section's loader when both were present — see als-tanstack
-  // SearchContainerV2 SSR regression.
+  // the section's loader when both were present — see a production
+  // storefront's SearchContainer SSR regression.
   for (const meta of ctx.sectionMetas) {
     if (meta.isHeader || meta.isAccountSection || meta.isStatusOnly) continue;
     // Skip sections with no loader AND no device needs
@@ -418,7 +418,7 @@ export function generateSectionLoaders(ctx: MigrationContext): string {
   // ---------- Privacy cookie check ----------
   if (isVtex && hasPrivacyPolice) {
     entries.push(``);
-    const vtexAccount = ctx.vtexAccount || "casaevideonewio";
+    const vtexAccount = ctx.vtexAccount || "acme";
     entries.push(`  "site/sections/Account/PrivacyPolice.tsx": (props: any, req) => {`);
     entries.push(`    const cookies = req.headers.get("cookie") ?? "";`);
     entries.push(`    const logged = cookies.includes("VtexIdclientAutCookie_${vtexAccount}");`);

package/scripts/migrate/templates/server-entry-vtex-invoke.test.ts

@@ -49,3 +49,22 @@ describe("VTEX invoke scaffold wires vtex.loaders + wishlist actions (#368)", ()
     expect(invokeSrc).toContain("parseVtexAuthJwt");
   });
 });
+
+describe("scaffolds ?renderJson / ?asJson OFF by default (opt-in)", () => {
+  const workerKey = "src/worker-entry.ts";
+
+  it("VTEX worker-entry disables both page-as-JSON endpoints", () => {
+    const worker = generateServerEntry(makeVtexCtx())[workerKey];
+    expect(worker).toContain("renderJson: false");
+    expect(worker).toContain("asJson: false");
+  });
+
+  it("non-VTEX worker-entry disables both too", () => {
+    const ctx = createContext("/tmp/custom-scaffold-fixture-site");
+    ctx.siteName = "acme-custom";
+    ctx.platform = "custom";
+    const worker = generateServerEntry(ctx)[workerKey];
+    expect(worker).toContain("renderJson: false");
+    expect(worker).toContain("asJson: false");
+  });
+});

package/scripts/migrate/templates/server-entry.ts

@@ -86,6 +86,11 @@ ${isCommerce ? `
 const serverEntry = createServerEntry({ fetch: handler.fetch });
 
 const decoWorker = createDecoWorkerEntry(serverEntry, {
+  // Page-as-JSON endpoints are OFF by default — opt in when you build a mobile
+  // app that consumes the storefront (see the renderJson docs). ?asJson is the
+  // legacy raw path; ?renderJson is the lean per-section one.
+  renderJson: false,
+  asJson: false,
   admin: {
     handleMeta,
     handleDecofileRead,
@@ -93,14 +98,10 @@ const decoWorker = createDecoWorkerEntry(serverEntry, {
     handleRender,
     corsHeaders,
   },
-  // Region splits the cache so a RJ-cached response isn't served to SP visitors
-  // when pages use the website/matchers/location.ts matcher. Without this, the
-  // first geo-resolved response leaks across regions.
-  buildSegment: (request) => {
-    const cf = (request as unknown as { cf?: { regionCode?: string } }).cf;
-    const regionCode = request.headers.get("cf-region-code") ?? cf?.regionCode ?? "";
-    return regionCode ? { regionId: regionCode } : {};
-  },
+  // No geo in buildSegment: createDecoWorkerEntry's geoCacheKey: "auto" already
+  // backfills the region into the segment — but only when the decofile has a
+  // website/matchers/location.ts block. Setting it here unconditionally split
+  // every page's cache per state (~27 copies per URL in Brazil) for nothing.
 });
 
 export default instrumentWorker(decoWorker, {
@@ -161,19 +162,23 @@ const serverEntry = createServerEntry({ fetch: handler.fetch });
 const MOBILE_RE = /mobile|android|iphone/i;
 
 const decoWorker = createDecoWorkerEntry(serverEntry, {
+  // Page-as-JSON endpoints are OFF by default — opt in when you build a mobile
+  // app that consumes the storefront (see the renderJson docs). ?asJson is the
+  // legacy raw path; ?renderJson is the lean per-section one.
+  renderJson: false,
+  asJson: false,
   csp: CSP_DIRECTIVES,
   buildSegment: (request) => {
     const vtx = extractVtexContext(request);
-    const cf = (request as unknown as { cf?: { regionCode?: string } }).cf;
-    const geoRegion = request.headers.get("cf-region-code") ?? cf?.regionCode ?? "";
     return {
       device: MOBILE_RE.test(request.headers.get("user-agent") ?? "") ? "mobile" : "desktop",
       loggedIn: vtx.isLoggedIn,
       salesChannel: vtx.salesChannel,
-      // Prefer VTEX regionalization regionId when present; otherwise fall back
-      // to Cloudflare geo so the website/matchers/location.ts matcher gets a
-      // properly segmented cache.
-      regionId: (vtx as any).regionId ?? (geoRegion || undefined),
+      // VTEX regionalization only. Don't fall back to Cloudflare geo here:
+      // geoCacheKey: "auto" adds the region only when a
+      // website/matchers/location.ts block exists; doing it unconditionally
+      // splits every page's cache per state.
+      regionId: (vtx as any).regionId,
     };
   },
   admin: {

package/scripts/migrate/templates/setup.ts

@@ -11,7 +11,7 @@ function discoverFonts(ctx: MigrationContext): string[] {
   const staticFonts = path.join(ctx.sourceDir, "static", "fonts");
   if (fs.existsSync(staticFonts)) return scanFontDir(staticFonts);
 
-  // Check static-*/fonts/ (multi-brand sites like casaevideo)
+  // Check static-*/fonts/ (multi-brand sites)
   try {
     const entries = fs.readdirSync(ctx.sourceDir, { withFileTypes: true });
     for (const e of entries) {
@@ -103,8 +103,8 @@ import { createInstrumentedFetch } from "@decocms/blocks/sdk/instrumentedFetch";
 import { initVtexFromBlocks, setVtexFetch } from "@decocms/apps-vtex";` : ""}${hasLocationMatcher ? `
 import { registerLocationMatcher } from "./matchers/location";` : ""}
 import { blocks as generatedBlocks } from "../.deco/blocks.gen";
-import { sectionMeta, syncComponents, loadingFallbacks } from "../.deco/sections.gen";
-import { PreviewProviders } from "@decocms/tanstack";
+import { sectionMeta, syncComponents, loadingFallbacks, renderJsons } from "../.deco/sections.gen";
+import { PreviewProviders, setupTanstackFastDeploy } from "@decocms/tanstack";
 // @ts-ignore Vite ?url import
 import appCss from "./styles/app.css?url";
 
@@ -131,6 +131,13 @@ createSiteSetup({
     return null;
   },
 });
+
+// -- Fast Deploy --
+// Hands the KV binding resolver to @decocms/blocks-admin, which cannot import
+// @decocms/tanstack itself (wrong direction in the package graph). Without this
+// call a Studio publish silently no-ops instead of writing through to KV.
+// Inert unless the worker has DECO_FAST_DEPLOY=1 + a DECO_KV binding.
+setupTanstackFastDeploy();
 ${isVtex ? `
 // -- VTEX wiring --
 setVtexFetch(createInstrumentedFetch("vtex"));
@@ -140,6 +147,7 @@ applySectionConventions({
   meta: sectionMeta,
   syncComponents,
   loadingFallbacks,
+  renderJsons,
   sectionGlob: import.meta.glob("./sections/**/*.tsx") as Record<string, () => Promise<any>>,
 });
 

package/scripts/migrate/templates/sync-blocks-bot-yml.ts

@@ -0,0 +1,201 @@
+/**
+ * Scaffolds `.github/workflows/sync-blocks-bot.yml` — the secure content channel
+ * from the still-live Fresh/Deno storefront into the migrated repo.
+ *
+ * Replaces the legacy push-based sync (a workflow in the *legacy* repo holding a
+ * cross-repo PAT, `rsync --delete` + `git push` straight into this repo's main).
+ * That token is a code-write door, not a content channel: whoever controls the
+ * legacy repo or the token can land arbitrary files here, unreviewed.
+ *
+ * Direction is inverted — this repo pulls, on its own schedule, with its own
+ * `GITHUB_TOKEN`, and gates the result:
+ *   - `sync-blocks-bot.ts` fetches `<origin>/.decofile` (public, unauthenticated)
+ *     and writes `.deco/blocks/`, denying the `Site` block and anything holding
+ *     encrypted credentials, and aborting on a plaintext credential;
+ *   - a path guard fails the run if anything outside `.deco/blocks/` changed;
+ *   - `bun run generate && bun run build` runs IN THIS JOB, before the PR. It
+ *     has to be here: a PR opened with `GITHUB_TOKEN` does not trigger
+ *     `pull_request` workflows, so gating on the PR's own CI would need a PAT
+ *     and would never fire on its own.
+ *
+ * Inert until the operator sets the repo variable `SYNC_BLOCKS_ORIGIN` (same
+ * one-knob pattern as parity.yml's `PARITY_PROD_URL`) — the job skips cleanly.
+ *
+ * Docs: docs/sync-blocks-bot.md
+ *
+ * @param bunVersion  Pinned bun version, in lockstep with package.json.
+ * @param cliVersion  Optional `@decocms/blocks-cli` version to run the pull
+ *   with. Omit for a freshly scaffolded site: the site's own installed copy is
+ *   by definition in-version, so the local file path is used. Pass a version
+ *   for a site still on an older `@decocms/*` — pinning only the sync step gets
+ *   the script without bumping the runtime the site builds against (blocks-cli
+ *   pins `@decocms/blocks` exactly, so bumping the devDep drags a second
+ *   runtime version into the tree). Drop it when the site bumps.
+ *
+ *   GOTCHA: the pinned form uses `npx --package=<pkg> <bin>`, NOT
+ *   `bunx <pkg> <bin>`. `bunx pkg@ver some-bin` treats `some-bin` as an
+ *   *argument* and runs the package's first bin instead — in this package that
+ *   is `deco-migrate`, which rewrites the whole site and exits 0 in dry-run, so
+ *   the job goes green having run the wrong tool. Observed on a real run. The
+ *   `--json`-report assertion below is the second line of defence.
+ */
+export function generateSyncBlocksBotYml(bunVersion: string, cliVersion?: string): string {
+  const bun = bunVersion.replace(/^bun@/, "");
+  const pullCmd = cliVersion
+    ? `npx --yes --package=@decocms/blocks-cli@${cliVersion} deco-sync-blocks-bot`
+    : "bunx tsx node_modules/@decocms/blocks-cli/scripts/sync-blocks-bot.ts";
+  return `name: sync-blocks-bot
+
+# Puxa o conteúdo publicado na loja de produção (Fresh/Deno) para \`.deco/blocks\`
+# e abre um PR. Sem token cross-repo: o repo legado não tem permissão nenhuma
+# aqui — este repo busca sozinho, valida e só então mergeia.
+#
+# Configuração (uma vez): variável de repo \`SYNC_BLOCKS_ORIGIN\` = origin da
+# loja de produção (ex.: https://www.minhaloja.com.br). Sem ela o job pula limpo.
+# Para revisão humana em vez de merge automático, mude \`AUTO_MERGE\` para "false".
+#
+# Depois de ligar isto, APAGUE o workflow de push no repo legado e REVOGUE o
+# token cross-repo — o pull não fecha aquela porta sozinho. Ver docs/sync-blocks-bot.md.
+
+on:
+  schedule:
+    # 06:00 UTC = 03:00 BRT, fora do horário de publicação do CMS.
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+    inputs:
+      origin:
+        description: "Origin da loja de produção (sobrepõe SYNC_BLOCKS_ORIGIN)"
+        required: false
+      prune:
+        description: "Apagar blocos que não existem mais em produção"
+        type: boolean
+        default: true
+      dry_run:
+        description: "Só relatório, não escreve nem abre PR"
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+# Publicações do CMS acontecem em rajada; uma sync por vez, sem cancelar a que
+# já está no gate de build.
+concurrency:
+  group: sync-blocks-bot
+  cancel-in-progress: false
+
+env:
+  BUN_VERSION: "${bun}"
+  AUTO_MERGE: "true"
+  # Chaves de bloco que a sync NUNCA sobrescreve. Blocos com secret encriptado
+  # já são protegidos por shape pelo script (as credenciais deste repo vivem no
+  # bloco de app dele, que não existe nesse layout em produção).
+  DENY_KEYS: "Site,site"
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Resolve origin
+        id: cfg
+        env:
+          INPUT_ORIGIN: \${{ github.event.inputs.origin }}
+          VAR_ORIGIN: \${{ vars.SYNC_BLOCKS_ORIGIN }}
+        run: |
+          origin="\${INPUT_ORIGIN:-$VAR_ORIGIN}"
+          if [ -z "$origin" ]; then
+            echo "::notice::variável de repo SYNC_BLOCKS_ORIGIN não configurada — sync-blocks-bot inerte."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "origin=$origin" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/checkout@v4
+        if: steps.cfg.outputs.skip != 'true'
+
+      - uses: oven-sh/setup-bun@v2
+        if: steps.cfg.outputs.skip != 'true'
+        with:
+          bun-version: \${{ env.BUN_VERSION }}
+
+      - name: Install
+        if: steps.cfg.outputs.skip != 'true'
+        run: bun install --frozen-lockfile
+
+      - name: Pull decofile de produção
+        if: steps.cfg.outputs.skip != 'true'
+        env:
+          ORIGIN: \${{ steps.cfg.outputs.origin }}
+          PRUNE: \${{ github.event.inputs.prune == 'false' && ' ' || '--prune' }}
+          DRY_RUN: \${{ github.event.inputs.dry_run == 'true' && '--dry-run' || ' ' }}
+        run: |
+          # pipefail é obrigatório: sem ele o \`| tee\` mascara o exit 1 do gate
+          # de plaintext secret e o job passa mesmo tendo abortado o pull.
+          set -o pipefail
+          ${pullCmd} \\
+            --origin "$ORIGIN" \\
+            --out .deco/blocks \\
+            --deny "$DENY_KEYS" \\
+            --fail-on-plaintext-secret \\
+            --json --github $PRUNE $DRY_RUN | tee /tmp/sync-blocks-report.json
+          # Prova de que foi ESTE script que rodou, e que ele viu conteúdo. Sem
+          # isso, uma invocação errada que resolva para outro bin do pacote
+          # termina 0 e o job fica verde tendo rodado a ferramenta errada.
+          grep -q '"remoteBlocks"' /tmp/sync-blocks-report.json || {
+            echo "::error::o passo de pull não produziu o relatório esperado — comando errado?"
+            exit 1
+          }
+
+      - name: Guard — só .deco/blocks pode mudar
+        id: guard
+        if: steps.cfg.outputs.skip != 'true' && github.event.inputs.dry_run != 'true'
+        run: |
+          {
+            git -c core.quotepath=false diff --name-only HEAD
+            git -c core.quotepath=false ls-files --others --exclude-standard
+          } | sort -u > /tmp/sync-blocks-changed.txt
+          offending="$(grep -v '^\\.deco/blocks/' /tmp/sync-blocks-changed.txt || true)"
+          if [ -n "$offending" ]; then
+            echo "::error::a sync mexeu fora de .deco/blocks — abortando:"
+            echo "$offending"
+            exit 1
+          fi
+          if [ ! -s /tmp/sync-blocks-changed.txt ]; then
+            echo "::notice::conteúdo já está em dia, nada a sincronizar."
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "$(wc -l < /tmp/sync-blocks-changed.txt) arquivo(s) de bloco alterado(s)"
+          fi
+
+      # Gate de verdade. Roda AQUI porque PR aberto com GITHUB_TOKEN não dispara
+      # o workflow de \`pull_request\` — gatear no CI do PR exigiria um PAT.
+      - name: Validar (generate + build)
+        if: steps.guard.outputs.changed == 'true'
+        run: bun run generate && bun run build
+
+      - name: Abrir PR (e mergear se AUTO_MERGE)
+        if: steps.guard.outputs.changed == 'true'
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          ORIGIN: \${{ steps.cfg.outputs.origin }}
+        run: |
+          branch="sync-blocks/$(date -u +%Y-%m-%dT%H%M%SZ)"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$branch"
+          git add .deco/blocks
+          git commit -m "chore(content): sync .deco/blocks de $ORIGIN"
+          git push origin "$branch"
+          url="$(gh pr create \\
+            --title "chore(content): sync .deco/blocks de produção" \\
+            --body "Conteúdo puxado de \\\`$ORIGIN/.decofile\\\` pelo workflow \\\`sync-blocks-bot\\\`. Só \\\`.deco/blocks/**\\\` mudou (guard) e \\\`generate + build\\\` passou antes deste PR existir." \\
+            --head "$branch")"
+          echo "PR: $url"
+          if [ "$AUTO_MERGE" = "true" ]; then
+            gh pr merge "$url" --squash --delete-branch || \\
+              echo "::notice::merge automático bloqueado (branch protection?) — PR aberto para revisão: $url"
+          fi
+`;
+}

package/scripts/migrate/templates/ui-components.ts

@@ -10,9 +10,12 @@ export function generateUiComponents(_ctx: MigrationContext): Record<string, str
   getSrcSet,
   registerImageCdnDomain,
   getImageCdnDomain,
+  registerImageQuality,
+  getImageQuality,
   FACTORS,
   type ImageProps,
   type FitOptions,
+  type ImageQuality,
 } from "@decocms/blocks/hooks";
 `;