@decocms/start 2.28.2 → 2.30.0

package/deploy/sites/lebiscuit-tanstack.jsonc

@@ -0,0 +1,19 @@
+// Per-site overrides for `lebiscuit-tanstack`.
+//
+// NOTE: `kv_namespaces[].id` is shared with `casaevideo-storefront`. See the
+// note in casaevideo's site file. R4 will add CI validation for this.
+//
+// `version_metadata` and `analytics_engine_datasets` are consumed by
+// @decocms/start's `instrumentWorker`:
+//   - version_metadata populates `service.version` on the OTel resource.
+//   - analytics_engine_datasets is the dual-emit metrics target.
+{
+  "worker_name": "lebiscuit-tanstack",
+  "kv_namespaces": [
+    { "binding": "SITES_KV", "id": "ad0b74fc4d9341c9af9149c4ab85132f" }
+  ],
+  "version_metadata": { "binding": "CF_VERSION_METADATA" },
+  "analytics_engine_datasets": [
+    { "binding": "DECO_METRICS", "dataset": "deco_metrics_lebiscuit" }
+  ]
+}

package/deploy/sites/miess-01-tanstack.jsonc

@@ -0,0 +1,8 @@
+// Per-site overrides for `miess-01-tanstack`.
+//
+// Worker name keeps the historical `miess-tanstack` (no "-01") so the deploy
+// continues to land on the existing Cloudflare worker. The repo name has the
+// `-01-` suffix; the worker name does not.
+{
+  "worker_name": "miess-tanstack"
+}

package/deploy/wrangler-template.jsonc

@@ -0,0 +1,28 @@
+// Canonical wrangler.jsonc template for every storefront on the platform.
+//
+// Per-site overrides live in `deploy/sites/<repo-name>.jsonc`. The deploy
+// workflow deep-merges site overrides on top of this template at runtime and
+// writes the result to `wrangler.jsonc` in the caller checkout. Site overrides
+// always win. Arrays are replaced (not concatenated).
+//
+// Notes on what is INTENTIONALLY missing here:
+//   - "name" -- always derived from the per-site `worker_name`.
+//   - "account_id" -- never lives in the JSON. Wrangler reads it from the
+//     CLOUDFLARE_ACCOUNT_ID env var in CI and from local config otherwise.
+//     This way, a typo in JSON cannot misroute a deploy.
+//
+// To upgrade compatibility flags, observability, or worker-entry path across
+// every site at once, change this file and tag a new deco-start release.
+{
+  "compatibility_date": "2026-02-14",
+  "compatibility_flags": ["nodejs_compat", "no_handle_cross_request_promise_resolution"],
+  "main": "./src/worker-entry.ts",
+  "workers_dev": true,
+  "preview_urls": true,
+  "observability": {
+    "logs": {
+      "enabled": true,
+      "invocation_logs": true
+    }
+  }
+}

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@decocms/start",
-  "version": "2.28.2",
+  "version": "2.30.0",
   "type": "module",
   "description": "Deco framework for TanStack Start - CMS bridge, admin protocol, hooks, schema generation",
   "main": "./src/index.ts",
   "bin": {
     "deco-migrate": "./scripts/migrate.ts",
     "deco-post-cleanup": "./scripts/migrate-post-cleanup.ts",
-    "deco-htmx-analyze": "./scripts/htmx-analyze.ts"
+    "deco-htmx-analyze": "./scripts/htmx-analyze.ts",
+    "deco-wrangler": "./scripts/deploy/wrangler-wrapper.mjs"
   },
   "exports": {
     ".": "./src/index.ts",
@@ -35,6 +36,11 @@
     "./sdk/invoke": "./src/sdk/invoke.ts",
     "./sdk/instrumentedFetch": "./src/sdk/instrumentedFetch.ts",
     "./sdk/otel": "./src/sdk/otel.ts",
+    "./sdk/logger": "./src/sdk/logger.ts",
+    "./sdk/composite": "./src/sdk/composite.ts",
+    "./sdk/otelAdapters": "./src/sdk/otelAdapters.ts",
+    "./sdk/sampler": "./src/sdk/sampler.ts",
+    "./sdk/observability": "./src/sdk/observability.ts",
     "./sdk/workerEntry": "./src/sdk/workerEntry.ts",
     "./sdk/abTesting": "./src/sdk/abTesting.ts",
     "./sdk/redirects": "./src/sdk/redirects.ts",
@@ -99,6 +105,15 @@
   },
   "dependencies": {
     "@deco-cx/warp-node": "^0.3.16",
+    "@microlabs/otel-cf-workers": "^1.0.0-rc.52",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/api-logs": "^0.200.0",
+    "@opentelemetry/exporter-logs-otlp-http": "^0.200.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "^0.200.0",
+    "@opentelemetry/resources": "^2.6.1",
+    "@opentelemetry/sdk-logs": "^0.200.0",
+    "@opentelemetry/sdk-metrics": "^2.0.0",
+    "@opentelemetry/sdk-trace-base": "^2.6.1",
     "clsx": "^2.1.1",
     "fast-json-patch": "^3.1.0",
     "tailwind-merge": "^3.3.1",
@@ -106,8 +121,6 @@
     "ws": "^8.18.0"
   },
   "peerDependencies": {
-    "@microlabs/otel-cf-workers": ">=1.0.0-rc.0",
-    "@opentelemetry/api": ">=1.9.0",
     "@tanstack/react-query": ">=5.0.0",
     "@tanstack/react-start": ">=1.0.0",
     "@tanstack/store": ">=0.7.0",
@@ -115,25 +128,15 @@
     "react-dom": "^19.0.0",
     "vite": ">=6.0.0 || >=7.0.0 || >=8.0.0"
   },
-  "peerDependenciesMeta": {
-    "@microlabs/otel-cf-workers": {
-      "optional": true
-    },
-    "@opentelemetry/api": {
-      "optional": true
-    }
-  },
   "devDependencies": {
     "@biomejs/biome": "^2.4.6",
-    "@microlabs/otel-cf-workers": "^1.0.0-rc.52",
-    "@opentelemetry/api": "^1.9.1",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^10.0.1",
     "@tanstack/react-query": "^5.96.0",
     "@tanstack/store": "^0.9.1",
     "@types/react": "^19.0.0",
-    "@types/ws": "^8.18.0",
     "@types/react-dom": "^19.0.0",
+    "@types/ws": "^8.18.0",
     "jsdom": "^29.0.0",
     "knip": "^5.86.0",
     "ts-morph": "^27.0.0",

package/scripts/deploy/build-wrangler-config.mjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+// build-wrangler-config.mjs
+//
+// Materializes a `wrangler.jsonc` from the canonical template + the site's
+// per-site overrides. The output file is what `wrangler deploy` /
+// `wrangler versions upload` / `wrangler secret put` will read.
+//
+// Required env:
+//   DECO_START_PATH  - path to a checked-out deco-start (e.g. ".deco-start")
+//   SITE_NAME        - the registry key (== caller repo name)
+//   OUTPUT_PATH      - where to write the merged wrangler.jsonc
+//                      (e.g. "./wrangler.jsonc" in the caller checkout)
+
+import { writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { loadSiteManifest, loadTemplate, mergeWithTemplate } from "./site-registry.mjs";
+
+function fail(message) {
+  console.error(`::error::${message}`);
+  process.exit(1);
+}
+
+const decoStartPath = process.env.DECO_START_PATH;
+const siteName = process.env.SITE_NAME;
+const outputPath = process.env.OUTPUT_PATH;
+
+if (!decoStartPath) fail("DECO_START_PATH env var is required");
+if (!siteName) fail("SITE_NAME env var is required");
+if (!outputPath) fail("OUTPUT_PATH env var is required");
+
+let merged;
+try {
+  const template = loadTemplate(decoStartPath);
+  const manifest = loadSiteManifest(decoStartPath, siteName);
+  merged = mergeWithTemplate(template, manifest);
+} catch (err) {
+  fail(err instanceof Error ? err.message : String(err));
+}
+
+const header = `// AUTOGENERATED by @decocms/start at deploy time.
+// Do not edit -- changes will be overwritten on the next deploy.
+// Source: decocms/deco-start deploy/sites/${siteName}.jsonc
+//         + decocms/deco-start deploy/wrangler-template.jsonc
+`;
+
+const body = JSON.stringify(merged, null, 2);
+writeFileSync(resolve(outputPath), `${header}${body}\n`);
+
+console.log(`Wrote ${outputPath} for site "${siteName}" (worker "${merged.name}")`);

package/scripts/deploy/jsonc.mjs

@@ -0,0 +1,76 @@
+// Minimal JSONC -> JSON parser used by the deploy scripts.
+//
+// Strips // line comments and /* block comments */ outside of string literals
+// and tolerates trailing commas in objects/arrays. Dependency-free so the
+// deploy scripts can run with vanilla `node` in CI.
+
+import { readFileSync } from "node:fs";
+
+/**
+ * @param {string} input
+ * @returns {string}
+ */
+function stripComments(input) {
+  let out = "";
+  let i = 0;
+  let inStr = false;
+  let strChar = "";
+  while (i < input.length) {
+    const c = input[i];
+    const n = input[i + 1];
+    if (inStr) {
+      out += c;
+      if (c === "\\" && i + 1 < input.length) {
+        out += input[i + 1];
+        i += 2;
+        continue;
+      }
+      if (c === strChar) inStr = false;
+      i++;
+      continue;
+    }
+    if (c === '"') {
+      inStr = true;
+      strChar = c;
+      out += c;
+      i++;
+      continue;
+    }
+    if (c === "/" && n === "/") {
+      while (i < input.length && input[i] !== "\n") i++;
+      continue;
+    }
+    if (c === "/" && n === "*") {
+      i += 2;
+      while (i < input.length && !(input[i] === "*" && input[i + 1] === "/")) i++;
+      i += 2;
+      continue;
+    }
+    out += c;
+    i++;
+  }
+  return out;
+}
+
+/**
+ * @param {string} text
+ * @returns {unknown}
+ */
+export function parseJsonc(text) {
+  const stripped = stripComments(text).replace(/,\s*([}\]])/g, "$1");
+  return JSON.parse(stripped);
+}
+
+/**
+ * @param {string} path
+ * @returns {unknown}
+ */
+export function readJsoncFile(path) {
+  const raw = readFileSync(path, "utf8");
+  try {
+    return parseJsonc(raw);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Failed to parse JSONC at ${path}: ${message}`);
+  }
+}

package/scripts/deploy/resolve-site.mjs

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+// resolve-site.mjs
+//
+// Validates that the calling repository has a registered site manifest in
+// deco-start, and emits the resolved fields to GITHUB_OUTPUT for downstream
+// steps (wrangler tail, status comments, etc.).
+//
+// Required env:
+//   DECO_START_PATH  - path to a checked-out deco-start (e.g. ".deco-start")
+//   SITE_NAME        - typically `${GITHUB_REPOSITORY#*/}` set by the workflow
+//
+// Optional env:
+//   GITHUB_OUTPUT    - if set, emit `key=value` lines here (CI mode).
+//                      If unset, prints a human-readable summary to stdout.
+
+import { appendFileSync } from "node:fs";
+import { loadSiteManifest } from "./site-registry.mjs";
+
+function fail(message) {
+  console.error(`::error::${message}`);
+  process.exit(1);
+}
+
+const decoStartPath = process.env.DECO_START_PATH;
+const siteName = process.env.SITE_NAME;
+const ghOutput = process.env.GITHUB_OUTPUT;
+
+if (!decoStartPath) fail("DECO_START_PATH env var is required");
+if (!siteName) fail("SITE_NAME env var is required");
+
+let manifest;
+try {
+  manifest = loadSiteManifest(decoStartPath, siteName);
+} catch (err) {
+  fail(err instanceof Error ? err.message : String(err));
+}
+
+const summary = {
+  site_name: siteName,
+  worker_name: manifest.worker_name,
+  has_routes: String(Array.isArray(manifest.routes) && manifest.routes.length > 0),
+  has_kv: String(Array.isArray(manifest.kv_namespaces) && manifest.kv_namespaces.length > 0),
+  has_analytics: String(
+    Array.isArray(manifest.analytics_engine_datasets) &&
+      manifest.analytics_engine_datasets.length > 0,
+  ),
+  has_version_metadata: String(Boolean(manifest.version_metadata)),
+};
+
+if (ghOutput) {
+  const lines = Object.entries(summary).map(([k, v]) => `${k}=${v}`);
+  appendFileSync(ghOutput, `${lines.join("\n")}\n`);
+}
+
+console.log(`Resolved site "${siteName}" -> worker "${manifest.worker_name}"`);
+for (const [k, v] of Object.entries(summary)) {
+  console.log(`  ${k}: ${v}`);
+}

package/scripts/deploy/site-registry.mjs

@@ -0,0 +1,142 @@
+// Shared registry helpers for the deploy scripts.
+//
+// `loadSiteManifest(decoStartPath, siteName)` returns the validated
+// per-site manifest object. `mergeWithTemplate(template, site)` deep-merges a
+// site manifest on top of the canonical template and returns the wrangler
+// config object ready for serialization.
+//
+// Trust model: `siteName` is always derived from `${{ github.repository }}` in
+// CI (or from the local git remote in the wrapper CLI), never from a
+// user-supplied input. A site that is not registered in `deploy/sites/` cannot
+// be deployed -- this is enforced here.
+
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { readJsoncFile } from "./jsonc.mjs";
+
+/** @typedef {{
+ *   worker_name: string;
+ *   routes?: Array<{ pattern: string; zone_name?: string; custom_domain?: boolean }>;
+ *   kv_namespaces?: Array<{ binding: string; id: string; preview_id?: string }>;
+ *   analytics_engine_datasets?: Array<{ binding: string; dataset: string }>;
+ *   version_metadata?: { binding: string };
+ * }} SiteManifest
+ */
+
+const ALLOWED_SITE_KEYS = new Set([
+  "worker_name",
+  "routes",
+  "kv_namespaces",
+  "analytics_engine_datasets",
+  "version_metadata",
+]);
+
+/**
+ * @param {string} decoStartPath
+ * @returns {string}
+ */
+export function templatePath(decoStartPath) {
+  return join(decoStartPath, "deploy", "wrangler-template.jsonc");
+}
+
+/**
+ * @param {string} decoStartPath
+ * @param {string} siteName
+ * @returns {string}
+ */
+export function siteManifestPath(decoStartPath, siteName) {
+  return join(decoStartPath, "deploy", "sites", `${siteName}.jsonc`);
+}
+
+/**
+ * @param {string} decoStartPath
+ * @param {string} siteName
+ * @returns {SiteManifest}
+ */
+export function loadSiteManifest(decoStartPath, siteName) {
+  if (!siteName || !/^[a-z0-9][a-z0-9-]*$/.test(siteName)) {
+    throw new Error(
+      `Refusing to load manifest for invalid site name: ${JSON.stringify(siteName)}. Site names must be lowercase, hyphen-separated.`,
+    );
+  }
+  const path = siteManifestPath(decoStartPath, siteName);
+  if (!existsSync(path)) {
+    throw new Error(
+      `No registry entry for site "${siteName}" at ${path}.\n` +
+        `Add deploy/sites/${siteName}.jsonc to decocms/deco-start before deploying.`,
+    );
+  }
+  const raw = readJsoncFile(path);
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(`Site manifest at ${path} must be a JSON object.`);
+  }
+  const manifest = /** @type {Record<string, unknown>} */ (raw);
+  if (typeof manifest.worker_name !== "string" || manifest.worker_name.length === 0) {
+    throw new Error(`Site manifest at ${path} is missing the required "worker_name" string.`);
+  }
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(/** @type {string} */ (manifest.worker_name))) {
+    throw new Error(
+      `Site manifest at ${path} has an invalid "worker_name": ${JSON.stringify(manifest.worker_name)}. Use lowercase, hyphen-separated.`,
+    );
+  }
+  for (const key of Object.keys(manifest)) {
+    if (!ALLOWED_SITE_KEYS.has(key)) {
+      throw new Error(
+        `Site manifest at ${path} contains unsupported key "${key}". Allowed: ${[...ALLOWED_SITE_KEYS].join(", ")}.`,
+      );
+    }
+  }
+  return /** @type {SiteManifest} */ (manifest);
+}
+
+/**
+ * @param {string} decoStartPath
+ * @returns {Record<string, unknown>}
+ */
+export function loadTemplate(decoStartPath) {
+  const path = templatePath(decoStartPath);
+  if (!existsSync(path)) {
+    throw new Error(`wrangler-template.jsonc not found at ${path}.`);
+  }
+  const raw = readJsoncFile(path);
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(`Template at ${path} must be a JSON object.`);
+  }
+  return /** @type {Record<string, unknown>} */ (raw);
+}
+
+/**
+ * Deep-merge `source` on top of `target`. Arrays in `source` REPLACE arrays in
+ * `target` (they are not concatenated) -- this matches the semantics wrangler
+ * itself expects for `routes`, `kv_namespaces`, etc.
+ *
+ * @template T
+ * @param {T} target
+ * @param {unknown} source
+ * @returns {T}
+ */
+function deepMerge(target, source) {
+  if (source === null || source === undefined) return target;
+  if (Array.isArray(source)) return /** @type {T} */ (source);
+  if (typeof source !== "object") return /** @type {T} */ (source);
+  const base = target && typeof target === "object" && !Array.isArray(target) ? target : {};
+  const out = /** @type {Record<string, unknown>} */ ({ ...base });
+  for (const [k, v] of Object.entries(source)) {
+    out[k] = deepMerge(out[k], v);
+  }
+  return /** @type {T} */ (out);
+}
+
+/**
+ * Produce the wrangler config object by deep-merging a site manifest on top of
+ * the canonical template. The site's `worker_name` becomes wrangler's `name`.
+ *
+ * @param {Record<string, unknown>} template
+ * @param {SiteManifest} site
+ * @returns {Record<string, unknown>}
+ */
+export function mergeWithTemplate(template, site) {
+  const { worker_name, ...rest } = site;
+  const merged = deepMerge(template, rest);
+  return { name: worker_name, ...merged };
+}

package/scripts/deploy/wrangler-wrapper.mjs

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+// deco-wrangler
+//
+// Local-dev wrapper around `wrangler` for storefront repos that no longer
+// commit a `wrangler.jsonc`. Generates the canonical config from
+// `@decocms/start`'s registry into `./wrangler.jsonc` (gitignored), then
+// optionally execs the real `wrangler` with that config in cwd.
+//
+// Usage from a customer repo (after `npm i -D @decocms/start@latest`):
+//
+//   npx deco-wrangler gen          # generate ./wrangler.jsonc and exit
+//                                  # (used by predev/prebuild/prepare hooks)
+//   npx deco-wrangler tail         # tail prod logs (worker name resolved automatically)
+//   npx deco-wrangler types        # regenerate worker-configuration.d.ts
+//   npx deco-wrangler deploy       # discouraged in dev; deploys go via CI
+//   npx deco-wrangler --help       # passes through to wrangler
+//
+// All non-`gen` invocations also (re)generate ./wrangler.jsonc first so the
+// file is always in sync with the registry before wrangler runs. The
+// `@cloudflare/vite-plugin` and the `wrangler` CLI both auto-discover
+// ./wrangler.jsonc in cwd, so no extra config plumbing is required.
+//
+// Site identity (which entry of `deploy/sites/` to load) resolves in this
+// order:
+//
+//   1. DECO_SITE_NAME env var (explicit override)
+//   2. git remote `origin` URL parsed for the GitHub repo name
+//   3. package.json `name` field
+//
+// Fails loudly if none of these match a registered site -- no implicit "guess
+// the worker" behavior. The local wrapper enforces the same trust model the CI
+// pipeline does.
+
+import { execSync, spawnSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadSiteManifest, loadTemplate, mergeWithTemplate } from "./site-registry.mjs";
+
+const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
+// scripts/deploy/wrangler-wrapper.mjs -> deco-start root
+const DECO_START_PATH = resolve(SCRIPT_DIR, "..", "..");
+
+function eprintln(msg) {
+  process.stderr.write(`[deco-wrangler] ${msg}\n`);
+}
+
+function tryGitRemoteSiteName() {
+  try {
+    const url = execSync("git remote get-url origin", {
+      stdio: ["ignore", "pipe", "ignore"],
+    })
+      .toString()
+      .trim();
+    // matches both git@github.com:org/repo(.git) and https://github.com/org/repo(.git)
+    const m = url.match(/github\.com[:/][^/]+\/([^/]+?)(?:\.git)?$/);
+    return m?.[1];
+  } catch {
+    return undefined;
+  }
+}
+
+function tryPackageJsonName() {
+  try {
+    const pkg = JSON.parse(readFileSync(resolve(process.cwd(), "package.json"), "utf8"));
+    return typeof pkg.name === "string" ? pkg.name : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function resolveSiteName() {
+  const envName = process.env.DECO_SITE_NAME?.trim();
+  if (envName) return { name: envName, source: "DECO_SITE_NAME env var" };
+  const gitName = tryGitRemoteSiteName();
+  if (gitName) return { name: gitName, source: "git remote origin" };
+  const pkgName = tryPackageJsonName();
+  if (pkgName) return { name: pkgName, source: "package.json name" };
+  return undefined;
+}
+
+const resolved = resolveSiteName();
+if (!resolved) {
+  eprintln(
+    "Could not determine site name. Set DECO_SITE_NAME or run from a repo with a github.com 'origin' remote.",
+  );
+  process.exit(1);
+}
+
+let manifest;
+try {
+  manifest = loadSiteManifest(DECO_START_PATH, resolved.name);
+} catch (err) {
+  eprintln(err instanceof Error ? err.message : String(err));
+  eprintln(`Site name "${resolved.name}" was inferred from ${resolved.source}.`);
+  eprintln(
+    `If this is a personal sandbox, set DECO_SITE_NAME=<registered-site> or open a PR to deco-start adding deploy/sites/${resolved.name}.jsonc.`,
+  );
+  process.exit(1);
+}
+
+const merged = mergeWithTemplate(loadTemplate(DECO_START_PATH), manifest);
+
+const outputPath = resolve(process.cwd(), "wrangler.jsonc");
+const header = `// AUTOGENERATED by deco-wrangler -- DO NOT COMMIT.
+// Add wrangler.jsonc to .gitignore. Regenerated on every \`deco-wrangler\` run.
+// Source: @decocms/start deploy/sites/${resolved.name}.jsonc + wrangler-template.jsonc
+`;
+writeFileSync(outputPath, `${header}${JSON.stringify(merged, null, 2)}\n`);
+
+eprintln(
+  `Resolved site "${resolved.name}" -> worker "${manifest.worker_name}" (via ${resolved.source})`,
+);
+eprintln(`Generated ${outputPath}`);
+
+const argv = process.argv.slice(2);
+// `gen` mode: just write the config and exit. Used by package.json
+// predev/prebuild/prepare hooks to keep wrangler.jsonc in sync with the
+// registry without invoking wrangler itself.
+if (argv[0] === "gen" || argv[0] === "generate") {
+  process.exit(0);
+}
+
+const wranglerArgs = ["wrangler", ...argv];
+const result = spawnSync("npx", wranglerArgs, { stdio: "inherit" });
+process.exit(result.status ?? 1);

package/scripts/migrate/phase-scaffold.ts

@@ -5,7 +5,7 @@ import { log, logPhase } from "./types";
 import { generatePackageJson } from "./templates/package-json";
 import { generateTsconfig } from "./templates/tsconfig";
 import { generateViteConfig } from "./templates/vite-config";
-import { generateWrangler } from "./templates/wrangler";
+import { generateGithubWorkflows } from "./templates/github-workflows";
 import { generateKnipConfig } from "./templates/knip-config";
 import { generateRoutes } from "./templates/routes";
 import { generateSetup } from "./templates/setup";
@@ -50,13 +50,20 @@ function writeMultiFile(ctx: MigrationContext, files: Record<string, string>) {
 export function scaffold(ctx: MigrationContext): void {
   logPhase("Scaffold");
 
-  // Root config files
+  // Root config files. wrangler.jsonc is INTENTIONALLY not generated --
+  // per D6, the canonical wrangler config lives in decocms/deco-start under
+  // deploy/wrangler-template.jsonc and per-site overrides under
+  // deploy/sites/<repo>.jsonc; the file is materialized locally by
+  // `deco-wrangler gen` and gitignored.
   writeFile(ctx, "package.json", generatePackageJson(ctx));
   writeFile(ctx, "tsconfig.json", generateTsconfig());
   writeFile(ctx, "vite.config.ts", generateViteConfig(ctx));
-  writeFile(ctx, "wrangler.jsonc", generateWrangler(ctx));
   writeFile(ctx, "knip.config.ts", generateKnipConfig());
   writeFile(ctx, ".gitignore", generateGitignore());
+
+  // Caller workflow stubs that delegate to decocms/deco-start's reusable
+  // workflows. The customer repo holds no deploy logic of its own.
+  writeMultiFile(ctx, generateGithubWorkflows());
   writeFile(ctx, ".prettierrc", JSON.stringify({
     semi: true,
     singleQuote: false,
@@ -209,6 +216,9 @@ dist/
 # Cloudflare Workers
 .wrangler/
 .dev.vars
+# Generated by \`deco-wrangler\` from @decocms/start's central registry.
+# Source of truth lives in decocms/deco-start under deploy/sites/<repo>.jsonc.
+wrangler.jsonc
 
 # TanStack Router (auto-generated)
 src/routeTree.gen.ts

package/scripts/migrate/phase-verify.ts

@@ -13,7 +13,12 @@ const REQUIRED_FILES = [
   "package.json",
   "tsconfig.json",
   "vite.config.ts",
-  "wrangler.jsonc",
+  // wrangler.jsonc is INTENTIONALLY absent -- D6: it lives in decocms/deco-start
+  // under deploy/sites/<repo>.jsonc and is generated locally by `deco-wrangler gen`.
+  ".github/workflows/deploy.yml",
+  ".github/workflows/preview.yml",
+  ".github/workflows/regen-blocks.yml",
+  ".github/workflows/sync-secrets.yml",
   "knip.config.ts",
   ".prettierrc",
   "src/server.ts",