create-ampless 0.2.0-alpha.9 → 1.0.0-alpha.100

package/dist/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { spinner as spinner2, outro as outro3, log as log5 } from "@clack/prompts";
-import { existsSync as existsSync7 } from "fs";
-import { basename as basename3, resolve as resolve5 } from "path";
+import { spinner as spinner2, outro as outro5, log as log7 } from "@clack/prompts";
+import { existsSync as existsSync9 } from "fs";
+import { basename as basename4, resolve as resolve5 } from "path";
 
 // src/prompts.ts
 import * as p from "@clack/prompts";
@@ -106,6 +106,9 @@ function sharedTemplateDir() {
 function templatePath(theme) {
   return resolve(templatesDir, theme);
 }
+function pluginTemplateDir(mode) {
+  return resolve(templatesDir, mode === "local" ? "plugin-local" : "plugin-standalone");
+}
 
 // src/gitignore.ts
 var DEFAULT_GITIGNORE = `# Dependencies
@@ -269,6 +272,20 @@ async function scaffold(sharedDir, themesRoot, destDir, opts) {
 // src/args.ts
 var VALID_THEMES = ["blog", "minimal", "landing", "corporate", "docs", "dads"];
 var VALID_PLUGINS = ["seo", "rss", "webhook"];
+var VALID_PLUGIN_TRUST_LEVELS = [
+  "untrusted",
+  "trusted",
+  "privileged"
+];
+var VALID_PLUGIN_CAPABILITIES = [
+  "publicHead",
+  "publicBody",
+  "metadata",
+  "eventHooks",
+  "adminSettings",
+  "writePublicAsset",
+  "schema"
+];
 var STRING_FLAGS = /* @__PURE__ */ new Set([
   "--site-name",
   "--themes",
@@ -279,7 +296,11 @@ var STRING_FLAGS = /* @__PURE__ */ new Set([
   "--aws-region",
   "--domain",
   "--subdomain",
-  "--iam-service-role"
+  "--iam-service-role",
+  // Phase 5 `plugin <name>` flags
+  "--trust-level",
+  "--capabilities",
+  "--description"
 ]);
 var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "--deploy",
@@ -291,7 +312,12 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "--create-iam-role",
   "--skip-confirm",
   "--help",
-  "-h"
+  "-h",
+  // Phase 5 `plugin <name>` mode flags
+  "--local",
+  "--standalone",
+  // setup-encryption-key flags
+  "--gitignore"
 ]);
 function parseDeployArgs(argv) {
   const out = {
@@ -299,6 +325,9 @@ function parseDeployArgs(argv) {
     mount: false,
     upgrade: false,
     copyTheme: false,
+    createPlugin: false,
+    setupEncryptionKey: false,
+    gitignore: false,
     dryRun: false,
     noInstall: false,
     githubPrivate: false,
@@ -346,6 +375,21 @@ function parseDeployArgs(argv) {
         case "-h":
           out.help = true;
           break;
+        case "--local":
+          if (out.pluginMode === "standalone") {
+            throw new Error("Cannot combine --local and --standalone");
+          }
+          out.pluginMode = "local";
+          break;
+        case "--standalone":
+          if (out.pluginMode === "local") {
+            throw new Error("Cannot combine --local and --standalone");
+          }
+          out.pluginMode = "standalone";
+          break;
+        case "--gitignore":
+          out.gitignore = true;
+          break;
       }
       continue;
     }
@@ -401,6 +445,31 @@ function parseDeployArgs(argv) {
         case "--iam-service-role":
           out.iamServiceRole = value;
           break;
+        case "--trust-level": {
+          if (!VALID_PLUGIN_TRUST_LEVELS.includes(value)) {
+            throw new Error(
+              `Invalid --trust-level "${value}". Valid values: ${VALID_PLUGIN_TRUST_LEVELS.join(", ")}`
+            );
+          }
+          out.pluginTrustLevel = value;
+          break;
+        }
+        case "--capabilities": {
+          const caps = value.split(",").map((c) => c.trim()).filter(Boolean);
+          const invalid = caps.filter(
+            (c) => !VALID_PLUGIN_CAPABILITIES.includes(c)
+          );
+          if (invalid.length > 0) {
+            throw new Error(
+              `Invalid capability(ies): ${invalid.join(", ")}. Valid values: ${VALID_PLUGIN_CAPABILITIES.join(", ")}`
+            );
+          }
+          out.pluginCapabilities = caps;
+          break;
+        }
+        case "--description":
+          out.pluginDescription = value;
+          break;
       }
       continue;
     }
@@ -412,6 +481,10 @@ function parseDeployArgs(argv) {
       out.upgrade = true;
       continue;
     }
+    if (raw === "setup-encryption-key" && out.projectName === void 0 && !out.setupEncryptionKey && !out.upgrade && !out.copyTheme && !out.createPlugin) {
+      out.setupEncryptionKey = true;
+      continue;
+    }
     if (raw === "copy-theme" && out.projectName === void 0 && !out.copyTheme) {
       out.copyTheme = true;
       continue;
@@ -424,6 +497,14 @@ function parseDeployArgs(argv) {
       out.copyThemeTarget = raw;
       continue;
     }
+    if (raw === "plugin" && out.projectName === void 0 && !out.createPlugin && !out.upgrade && !out.copyTheme) {
+      out.createPlugin = true;
+      continue;
+    }
+    if (out.createPlugin && out.pluginName === void 0) {
+      out.pluginName = raw;
+      continue;
+    }
     if (out.projectName === void 0) {
       out.projectName = raw;
     } else {
@@ -435,9 +516,12 @@ function parseDeployArgs(argv) {
 var HELP_TEXT = `create-ampless \u2014 scaffold an ampless project
 
 Usage:
-  npx create-ampless@alpha <project-name> [options]
-  npx create-ampless@alpha --mount [options]    # in an existing project dir
-  npx create-ampless@alpha upgrade [options]    # in an existing project dir
+  npx create-ampless@latest <project-name> [options]
+  npx create-ampless@latest --mount [options]               # in an existing project dir
+  npx create-ampless@latest upgrade [options]               # in an existing project dir
+  npx create-ampless@latest copy-theme <src> <dst>          # in an existing project dir
+  npx create-ampless@latest plugin <name> [options]         # scaffold a plugin (Phase 5)
+  npx create-ampless@latest setup-encryption-key [--gitignore]  # generate encryption key file
 
 Options:
   --site-name <name>          Site display name (default: "My Blog")
@@ -487,7 +571,61 @@ copy-theme <source> <target>
          (the convention that flags it as user-owned, so upgrade leaves
          it alone). Run inside an existing ampless project.
 
-         Example: npx create-ampless@alpha copy-theme blog my-blog
+         Example: npx create-ampless@latest copy-theme blog my-blog
+
+plugin <name>
+         Scaffold an ampless plugin. Two modes:
+
+  --local                     Default. Writes plugins/<name>/index.ts inside
+                              the current ampless site. The site itself is the
+                              build / publish unit; the plugin file is just
+                              code that sits there. Plugin name is a kebab-case
+                              identifier (e.g. "site-verification").
+
+  --standalone                Writes a complete npm package at ./<name>/ ready
+                              for 'npm publish'. Plugin name should be the npm
+                              package name (e.g. "@scope/ampless-plugin-foo"
+                              or "ampless-plugin-foo"); the kebab segment
+                              becomes the AmplessPlugin.name.
+
+  --trust-level <value>       'untrusted' (default), 'trusted', or 'privileged'
+  --capabilities <list>       Comma-separated. Valid: publicHead, publicBody,
+                              metadata, eventHooks, adminSettings,
+                              writePublicAsset, schema
+                              (default: publicHead,adminSettings)
+  --description "<text>"      Optional one-line description
+
+         Examples:
+           npx create-ampless@latest plugin site-verification
+           npx create-ampless@latest plugin @ishinao/ampless-plugin-foo --standalone
+
+setup-encryption-key
+         Generate the AES-256-GCM encryption key for plugin secret storage
+         and write it to amplify/secrets/encryption-key.ts (adjacent to
+         amplify/backend.ts). No AWS credentials required \u2014 this is a
+         local file operation only.
+
+         After generating, import the constant in amplify/backend.ts and
+         pass it to defineAmplessBackend({ pluginSecretEncryptionKey: ... }).
+         Then redeploy (or restart the sandbox) to inject the key into the
+         Lambda env vars.
+
+  --gitignore                 Add amplify/secrets/encryption-key.ts to
+                              .gitignore. Default: file is committed
+                              (safe for private repos). Use this flag only
+                              for public repos; distribute the key separately.
+
+         Threat model:
+           \u2713 DDB Console operator sees ciphertext only
+           \u26A0 Source repo / deploy artifact access defeats encryption
+           \u2717 Malicious trusted plugin in the same Lambda can also read
+             the key (per-plugin Lambda isolation = roadmap)
+
+         Rotation: re-run with confirm overwrite. Existing ciphertext
+         becomes unreadable; re-save each secret via /admin/plugins.
+
+         Example: npx create-ampless@latest setup-encryption-key
+         Example: npx create-ampless@latest setup-encryption-key --gitignore
 `;
 
 // src/deploy-prompts.ts
@@ -1091,38 +1229,19 @@ function splitDomain(domain, subdomain) {
 async function rewriteCmsConfigForDomain(projectDir, fullDomain) {
   const path = resolve4(projectDir, "cms.config.ts");
   if (!existsSync4(path)) {
-    return { urlRewritten: false, sitesInjected: false };
+    return { urlRewritten: false };
   }
   let content = await readFile2(path, "utf-8");
   let urlRewritten = false;
-  let sitesInjected = false;
   const urlRe = /url:\s*['"]http:\/\/localhost:3000['"]/;
   if (urlRe.test(content)) {
     content = content.replace(urlRe, `url: 'https://${fullDomain}'`);
     urlRewritten = true;
   }
-  const sitesActiveRe = /^\s*sites:\s*\{/m;
-  if (!sitesActiveRe.test(content)) {
-    const siteCloseRe = /(\n(\s*)site:\s*\{[\s\S]*?\n\2\},)/;
-    const m = siteCloseRe.exec(content);
-    if (m) {
-      const indent = m[2] ?? "  ";
-      const inner = indent + "  ";
-      const innermost = inner + "  ";
-      const inject = `
-${indent}sites: {
-${inner}default: {
-${innermost}domains: ['${fullDomain}'],
-${inner}},
-${indent}},`;
-      content = content.replace(siteCloseRe, `$1${inject}`);
-      sitesInjected = true;
-    }
-  }
-  if (urlRewritten || sitesInjected) {
+  if (urlRewritten) {
     await writeFile2(path, content, "utf-8");
   }
-  return { urlRewritten, sitesInjected };
+  return { urlRewritten };
 }
 async function run(cmd, args, opts = {}) {
   const { step, ...execaOpts } = opts;
@@ -1503,11 +1622,8 @@ async function runDeploy(opts) {
     const { registrable, subdomain } = splitDomain(opts.domain, opts.subdomain);
     const fullDomain = subdomain ? `${subdomain}.${registrable}` : registrable;
     const mutations = await rewriteCmsConfigForDomain(opts.projectDir, fullDomain);
-    if (mutations.urlRewritten || mutations.sitesInjected) {
-      const parts = [];
-      if (mutations.urlRewritten) parts.push(`site.url \u2192 https://${fullDomain}`);
-      if (mutations.sitesInjected) parts.push(`sites.default.domains += ${fullDomain}`);
-      log.info(`cms.config.ts updated: ${parts.join(", ")}`);
+    if (mutations.urlRewritten) {
+      log.info(`cms.config.ts updated: site.url \u2192 https://${fullDomain}`);
     }
   }
   const created = {};
@@ -1761,6 +1877,15 @@ import { join as join3, relative, extname as extname2, dirname } from "path";
 import { log as log3, outro } from "@clack/prompts";
 import pc3 from "picocolors";
 import { execa as execa4 } from "execa";
+var AMPLESS_MANAGED_APP_PATHS = [
+  "app/(admin)/admin",
+  "app/api/admin",
+  "app/api/media",
+  "app/api/mcp",
+  "app/login",
+  "app/site"
+];
+var AMPLESS_RETIRED_PATHS = [];
 var AMPLESS_PACKAGES = /* @__PURE__ */ new Set([
   "ampless",
   "@ampless/admin",
@@ -1768,8 +1893,14 @@ var AMPLESS_PACKAGES = /* @__PURE__ */ new Set([
   "@ampless/runtime",
   "@ampless/plugin-seo",
   "@ampless/plugin-rss",
+  "@ampless/plugin-schema-jsonld",
   "@ampless/plugin-webhook",
-  "@ampless/plugin-og-image"
+  "@ampless/plugin-og-image",
+  "@ampless/plugin-analytics-ga4",
+  "@ampless/plugin-gtm",
+  "@ampless/plugin-plausible",
+  "@ampless/plugin-cookie-consent",
+  "@ampless/plugin-reading-time"
 ]);
 var AMPLESS_MANAGED_SCRIPTS = /* @__PURE__ */ new Set([
   "sandbox",
@@ -1791,15 +1922,34 @@ var PROTECTED_PATTERNS = [
   /^\.amplify(\/|$)/,
   /^amplify_outputs\.json$/,
   /^next-env\.d\.ts$/,
+  // `tsconfig.json` is auto-managed by Next.js during `next build` /
+  // `next dev` — it rewrites `jsx: "preserve"` → `"react-jsx"` for
+  // the React automatic runtime and appends `.next/dev/types/**/*.ts`
+  // to `include`. Treating the file as `replace` here would overwrite
+  // those mutations on every `update-ampless`, only for Next.js to
+  // re-apply them on the next build — a churn cycle that produces a
+  // dirty diff after every upgrade. Protect the file; users hand-
+  // merge new compiler options in the rare case the template
+  // tsconfig changes meaningfully.
+  /^tsconfig\.json$/,
   /^tsconfig\.tsbuildinfo$/,
   /^pnpm-lock\.yaml$/,
   /^package-lock\.json$/,
   // Anything under themes/ is handled by syncThemes; the file-walk
   // classifier must not double-process it.
   /^themes(\/|$)/,
-  /^themes-registry\.ts$/
+  /^themes-registry\.ts$/,
+  // `plugins/` is the site-local plugin directory (user-owned, mirrors
+  // the `themes/my-*` convention for user-customised themes). The
+  // initial scaffold seeds a README into this directory; everything
+  // afterwards is the user's territory. We never overwrite or delete
+  // files here — even the seeded README is frozen at scaffold time,
+  // because plugin authors will sometimes edit it to document the
+  // site's own conventions. The kept-up-to-date "how to write a
+  // plugin" doc lives in `packages/ampless/docs/plugin-author-guide.md`.
+  /^plugins(\/|$)/
 ];
-var SEED_IF_MISSING_PATTERN = /\.custom\.ts$/;
+var SEED_IF_MISSING_PATTERN = /\.custom\.ts$|^plugins\/README(\.ja)?\.md$|^amplify\/secrets\/encryption-key\.ts$/;
 var TEXT_EXTENSIONS2 = /* @__PURE__ */ new Set([
   ".json",
   ".md",
@@ -1819,12 +1969,24 @@ var TEXT_EXTENSIONS2 = /* @__PURE__ */ new Set([
   ".gitignore"
 ]);
 function isProtected(relPath) {
+  if (SEED_IF_MISSING_PATTERN.test(relPath)) return false;
   return PROTECTED_PATTERNS.some((re) => re.test(relPath));
 }
+var NON_THEME_TEMPLATE_PREFIXES = ["plugin-"];
+function isThemeDirName(name) {
+  if (name === "_shared") return false;
+  for (const prefix of NON_THEME_TEMPLATE_PREFIXES) {
+    if (name.startsWith(prefix)) return false;
+  }
+  return true;
+}
+function isQuarantinedThemeName(name) {
+  return !isThemeDirName(name);
+}
 async function listShippedThemes(templatesRoot) {
   if (!existsSync5(templatesRoot)) return [];
   const entries = await readdir3(templatesRoot, { withFileTypes: true });
-  return entries.filter((e) => e.isDirectory() && e.name !== "_shared").map((e) => e.name).sort();
+  return entries.filter((e) => e.isDirectory() && isThemeDirName(e.name)).map((e) => e.name).sort();
 }
 var USER_OWNED_THEME_FILES = /* @__PURE__ */ new Set(["README.md", ".gitignore"]);
 function isUserOwnedThemeFile(path) {
@@ -1852,6 +2014,16 @@ async function syncThemes(destDir, templatesRoot) {
   const shipped = await listShippedThemes(templatesRoot);
   const themesDir = join3(destDir, "themes");
   await mkdir2(themesDir, { recursive: true });
+  const quarantined = [];
+  if (existsSync5(themesDir)) {
+    const present = await readdir3(themesDir, { withFileTypes: true });
+    for (const entry of present) {
+      if (!entry.isDirectory()) continue;
+      if (!isQuarantinedThemeName(entry.name)) continue;
+      await rm2(join3(themesDir, entry.name), { recursive: true, force: true });
+      quarantined.push(entry.name);
+    }
+  }
   for (const name of shipped) {
     const src = join3(templatesRoot, name);
     const dst = join3(themesDir, name);
@@ -1865,10 +2037,12 @@ async function syncThemes(destDir, templatesRoot) {
   }
   const installed = await discoverInstalledThemes(destDir);
   const shippedSet = new Set(shipped);
-  const preserved = installed.filter((t) => !shippedSet.has(t));
+  const preserved = installed.filter(
+    (t) => !shippedSet.has(t) && !isQuarantinedThemeName(t)
+  );
   const all = [...shipped, ...preserved];
   await writeFile3(join3(destDir, "themes-registry.ts"), buildRegistry(all), "utf-8");
-  return { synced: shipped, preserved };
+  return { synced: shipped, preserved, quarantined };
 }
 async function walkDir(dir, base, out) {
   const entries = await readdir3(dir, { withFileTypes: true });
@@ -1882,6 +2056,69 @@ async function walkDir(dir, base, out) {
     }
   }
 }
+async function listFilesRecursive(root) {
+  const out = [];
+  async function walk(current, relPrefix) {
+    const entries = await readdir3(current, { withFileTypes: true });
+    for (const entry of entries) {
+      const rel = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        await walk(join3(current, entry.name), rel);
+      } else if (entry.isFile()) {
+        out.push(rel);
+      }
+    }
+  }
+  if (!existsSync5(root)) return out;
+  await walk(root, "");
+  return out;
+}
+async function pruneEmptyDirs(root) {
+  if (!existsSync5(root)) return;
+  const entries = await readdir3(root, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      await pruneEmptyDirs(join3(root, entry.name));
+    }
+  }
+  const remaining = await readdir3(root);
+  if (remaining.length === 0) {
+    await rm2(root, { recursive: true, force: true });
+  }
+}
+async function findObsoleteFiles(destDir, sharedDir) {
+  const obsolete = [];
+  for (const managedPath of AMPLESS_MANAGED_APP_PATHS) {
+    const userPath = join3(destDir, managedPath);
+    if (!existsSync5(userPath)) continue;
+    const templatePath2 = join3(sharedDir, managedPath);
+    const templateFiles = new Set(await listFilesRecursive(templatePath2));
+    const userFiles = await listFilesRecursive(userPath);
+    for (const f of userFiles) {
+      if (!templateFiles.has(f)) {
+        obsolete.push(`${managedPath}/${f}`);
+      }
+    }
+  }
+  for (const retiredPath of AMPLESS_RETIRED_PATHS) {
+    const userFile = join3(destDir, retiredPath);
+    if (existsSync5(userFile)) {
+      obsolete.push(retiredPath);
+    }
+  }
+  return obsolete;
+}
+async function removeObsoleteFiles(destDir, paths) {
+  for (const rel of paths) {
+    const abs = join3(destDir, rel);
+    if (existsSync5(abs)) {
+      await rm2(abs, { force: true });
+    }
+  }
+  for (const managedPath of AMPLESS_MANAGED_APP_PATHS) {
+    await pruneEmptyDirs(join3(destDir, managedPath));
+  }
+}
 function substituteVars(content, vars) {
   return content.replace(/\{\{(\w+)\}\}/g, (_, key) => vars[key] ?? `{{${key}}}`);
 }
@@ -1934,22 +2171,34 @@ async function runUpgradeIn(destDir, sharedDir, opts = {}) {
   const seedSkipped = classification.seed.filter((r) => existsSync5(join3(destDir, r)));
   const shippedThemes = themeSyncEnabled ? await listShippedThemes(templatesRoot) : [];
   const existingThemes = themeSyncEnabled ? await discoverInstalledThemes(destDir) : [];
-  const preservedThemes = existingThemes.filter((t) => !shippedThemes.includes(t));
+  const quarantinedThemesPreview = existingThemes.filter(isQuarantinedThemeName);
+  const preservedThemes = existingThemes.filter(
+    (t) => !shippedThemes.includes(t) && !isQuarantinedThemeName(t)
+  );
+  const obsoleteFiles = await findObsoleteFiles(destDir, sharedDir);
   log3.info(
-    `replace: ${pc3.green(`\u8FFD\u52A0 ${replaceNew.length}`)} / ${pc3.yellow(`\u66F4\u65B0 ${replaceUpdate.length}`)}`
+    `replace: ${pc3.green(`${replaceNew.length} added`)} / ${pc3.yellow(`${replaceUpdate.length} updated`)}`
   );
-  log3.info(`merge:   ${pc3.cyan("package.json: ampless deps / managed scripts \u3092\u30C6\u30F3\u30D7\u30EC\u5074\u306B\u5408\u308F\u305B\u308B")}`);
+  log3.info(`merge:   ${pc3.cyan("package.json: sync ampless deps and managed scripts with the template")}`);
   if (classification.seed.length > 0) {
     log3.info(
-      `seed:    ${pc3.green(`\u8FFD\u52A0 ${seedNew.length}`)} / ${pc3.dim(`\u65E2\u5B58\u30D5\u30A1\u30A4\u30EB\u306F\u4E0A\u66F8\u304D\u3057\u306A\u3044: ${seedSkipped.length}`)} (*.custom.ts)`
+      `seed:    ${pc3.green(`${seedNew.length} added`)} / ${pc3.dim(`${seedSkipped.length} kept (existing *.custom.ts left untouched)`)}`
     );
   }
   if (themeSyncEnabled) {
     log3.info(
-      `themes:  ${pc3.cyan(`\u30C7\u30D5\u30A9\u30EB\u30C8\u30C6\u30FC\u30DE\u3092\u540C\u671F: ${shippedThemes.length}`)} / ${pc3.dim(`\u30AB\u30B9\u30BF\u30E0\u30C6\u30FC\u30DE (my-*) \u3092\u4FDD\u6301: ${preservedThemes.length}`)}`
+      `themes:  ${pc3.cyan(`${shippedThemes.length} default themes synced`)} / ${pc3.dim(`${preservedThemes.length} custom (my-*) themes preserved`)}`
     );
+    if (quarantinedThemesPreview.length > 0) {
+      log3.info(
+        `recover: ${pc3.yellow(`${quarantinedThemesPreview.length} bogus theme dir(s) removed`)} (${quarantinedThemesPreview.join(", ")} \u2014 scaffold templates leaked in by an earlier buggy create-ampless@alpha)`
+      );
+    }
+  }
+  if (obsoleteFiles.length > 0) {
+    log3.info(`cleanup: ${pc3.yellow(`${obsoleteFiles.length} removed`)} (files under ampless-managed app/ paths that no longer exist in the template)`);
   }
-  log3.info(`protected: ${pc3.dim(`\u30C6\u30F3\u30D7\u30EC\u306B\u5B58\u5728\u3059\u308B\u304C\u89E6\u3089\u306A\u3044: ${classification.protected.length} \u500B`)}`);
+  log3.info(`protected: ${pc3.dim(`${classification.protected.length} template files left untouched`)}`);
   if (opts.dryRun) {
     return {
       added: replaceNew,
@@ -1958,7 +2207,9 @@ async function runUpgradeIn(destDir, sharedDir, opts = {}) {
       protected: classification.protected,
       themesSynced: shippedThemes,
       themesPreserved: preservedThemes,
-      packageJsonMerged: false
+      themesQuarantined: quarantinedThemesPreview,
+      packageJsonMerged: false,
+      obsoleteRemoved: obsoleteFiles
     };
   }
   for (const rel of classification.replace) {
@@ -1971,7 +2222,8 @@ async function runUpgradeIn(destDir, sharedDir, opts = {}) {
     const dst = join3(destDir, rel);
     await copyWithSubstitution(src, dst, vars);
   }
-  const themeResult = themeSyncEnabled ? await syncThemes(destDir, templatesRoot) : { synced: [], preserved: [] };
+  const themeResult = themeSyncEnabled ? await syncThemes(destDir, templatesRoot) : { synced: [], preserved: [], quarantined: [] };
+  await removeObsoleteFiles(destDir, obsoleteFiles);
   const templatePkgRaw = await readFile3(join3(sharedDir, "package.json"), "utf-8");
   const templatePkg = JSON.parse(templatePkgRaw);
   const indent = detectIndent(projectPkgRaw);
@@ -1988,9 +2240,12 @@ async function runUpgradeIn(destDir, sharedDir, opts = {}) {
   }
   const templateScripts = templatePkg["scripts"] ?? {};
   const projectScripts = projectPkg["scripts"] ?? {};
-  for (const [name, body] of Object.entries(templateScripts)) {
-    if (!AMPLESS_MANAGED_SCRIPTS.has(name)) continue;
-    projectScripts[name] = body;
+  for (const name of AMPLESS_MANAGED_SCRIPTS) {
+    if (name in templateScripts) {
+      projectScripts[name] = templateScripts[name];
+    } else {
+      delete projectScripts[name];
+    }
   }
   if (Object.keys(projectScripts).length > 0) {
     projectPkg["scripts"] = projectScripts;
@@ -2008,7 +2263,9 @@ async function runUpgradeIn(destDir, sharedDir, opts = {}) {
     protected: classification.protected,
     themesSynced: themeResult.synced,
     themesPreserved: themeResult.preserved,
-    packageJsonMerged: true
+    themesQuarantined: themeResult.quarantined,
+    packageJsonMerged: true,
+    obsoleteRemoved: obsoleteFiles
   };
 }
 async function runUpgrade(args) {
@@ -2104,8 +2361,8 @@ async function runCopyTheme(args) {
   const source = args.copyThemeSource;
   const target = args.copyThemeTarget;
   if (!source || !target) {
-    log4.error("Usage: npx create-ampless@alpha copy-theme <source> <target>");
-    log4.info("Example: npx create-ampless@alpha copy-theme blog my-blog");
+    log4.error("Usage: npx create-ampless@latest copy-theme <source> <target>");
+    log4.info("Example: npx create-ampless@latest copy-theme blog my-blog");
     process.exit(1);
   }
   try {
@@ -2118,7 +2375,7 @@ async function runCopyTheme(args) {
 
   themes-registry.ts updated. Next:
     ${pc4.cyan(`Open themes/${result.target}/ and start customising`)}
-    ${pc4.cyan(`Activate via /admin/sites/<siteId>/theme`)}`
+    ${pc4.cyan(`Activate via /admin/sites/default/theme`)}`
     );
   } catch (err) {
     log4.error(err instanceof Error ? err.message : String(err));
@@ -2126,12 +2383,407 @@ async function runCopyTheme(args) {
   }
 }
 
-// src/index.ts
+// src/plugin.ts
+import { cp as cp4, mkdir as mkdir3, readFile as readFile5, writeFile as writeFile5, readdir as readdir5 } from "fs/promises";
+import { existsSync as existsSync7 } from "fs";
+import { join as join5, extname as extname3, basename as basename3 } from "path";
+import {
+  log as log5,
+  outro as outro3,
+  text as text3,
+  select as select2,
+  multiselect as multiselect2,
+  isCancel as isCancel3,
+  cancel as cancel3
+} from "@clack/prompts";
 import pc5 from "picocolors";
+var SCAFFOLD_AMPLESS_VERSION = "1.0.0-alpha.22";
+var TEXT_EXTENSIONS3 = /* @__PURE__ */ new Set([
+  ".json",
+  ".md",
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".html",
+  ".css",
+  ".env",
+  ".txt",
+  ".yaml",
+  ".yml",
+  ".toml",
+  ".gitignore"
+]);
+function toKebab(s) {
+  return s.replace(/[A-Z]/g, (c) => "-" + c.toLowerCase()).replace(/^-/, "");
+}
+function toCamelCase(kebab) {
+  return kebab.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+}
+function toPascalCase(kebab) {
+  const c = toCamelCase(kebab);
+  return c.charAt(0).toUpperCase() + c.slice(1);
+}
+function toDisplayName(kebab) {
+  const words = kebab.split("-");
+  return words.map((w, i) => i === 0 ? w.charAt(0).toUpperCase() + w.slice(1) : w).join(" ");
+}
+function sanitizeForJsComment(s) {
+  return s.replace(/\*\//g, "*\\/").replace(/[\r\n]+/g, " ").replace(/\s{2,}/g, " ").trim();
+}
+function lastSegment(packageName) {
+  return packageName.replace(/^@[^/]+\//, "");
+}
+function pluginNameFromPackage(packageName) {
+  const segment = lastSegment(packageName);
+  if (segment.startsWith("ampless-plugin-")) {
+    return segment.slice("ampless-plugin-".length);
+  }
+  if (segment.startsWith("plugin-")) {
+    return segment.slice("plugin-".length);
+  }
+  return segment;
+}
+async function substituteFile2(filePath, vars) {
+  const ext = extname3(filePath) || (basename3(filePath) === ".gitignore" ? ".gitignore" : "");
+  if (!TEXT_EXTENSIONS3.has(ext)) return;
+  const content = await readFile5(filePath, "utf-8");
+  const replaced = content.replace(/\{\{(\w+)\}\}/g, (_, key) => vars[key] ?? `{{${key}}}`);
+  if (replaced !== content) await writeFile5(filePath, replaced, "utf-8");
+}
+async function substituteDir2(dir, vars) {
+  const entries = await readdir5(dir, { withFileTypes: true });
+  await Promise.all(
+    entries.map(async (entry) => {
+      const fullPath = join5(dir, entry.name);
+      if (entry.isDirectory()) {
+        await substituteDir2(fullPath, vars);
+      } else {
+        await substituteFile2(fullPath, vars);
+      }
+    })
+  );
+}
+var KEBAB_RE = /^[a-z][a-z0-9]*(?:-[a-z][a-z0-9]*)*$/;
+var PACKAGE_NAME_RE = /^(@[a-z][a-z0-9-]*\/)?[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+async function runCreatePluginIn(destDir, args) {
+  const mode = args.pluginMode ?? "local";
+  let rawName = args.pluginName;
+  if (!rawName) {
+    if (args.skipConfirm === true) {
+      throw new Error(
+        mode === "local" ? "Plugin name is required when --skip-confirm is set. Pass it as the positional argument: `create-ampless plugin <name> --skip-confirm`." : "Plugin package name is required when --skip-confirm is set. Pass it as the positional argument: `create-ampless plugin <package-name> --standalone --skip-confirm`."
+      );
+    }
+    const answer = await text3({
+      message: mode === "local" ? 'Plugin name (kebab-case, e.g. "site-verification"):' : 'Plugin package name (e.g. "@scope/ampless-plugin-foo" or "ampless-plugin-foo"):',
+      validate(v) {
+        if (!v) return "Plugin name is required";
+        const re = mode === "local" ? KEBAB_RE : PACKAGE_NAME_RE;
+        if (!re.test(v)) {
+          return mode === "local" ? 'Must be kebab-case starting with a lowercase letter (e.g. "site-verification")' : 'Must be a valid npm package name (e.g. "ampless-plugin-foo" or "@scope/ampless-plugin-foo")';
+        }
+      }
+    });
+    if (isCancel3(answer)) {
+      cancel3("Cancelled.");
+      process.exit(0);
+    }
+    rawName = answer;
+  } else {
+    const re = mode === "local" ? KEBAB_RE : PACKAGE_NAME_RE;
+    if (!re.test(rawName)) {
+      throw new Error(
+        mode === "local" ? `Invalid plugin name "${rawName}". Must be kebab-case (e.g. "site-verification").` : `Invalid plugin name "${rawName}". Must be a valid npm package name (e.g. "ampless-plugin-foo" or "@scope/ampless-plugin-foo").`
+      );
+    }
+  }
+  const skipConfirm = args.skipConfirm === true;
+  let trustLevel = args.pluginTrustLevel;
+  if (!trustLevel) {
+    if (skipConfirm) {
+      trustLevel = "untrusted";
+    } else {
+      const answer = await select2({
+        message: "Trust level:",
+        options: VALID_PLUGIN_TRUST_LEVELS.map((t) => ({
+          value: t,
+          label: t,
+          hint: t === "untrusted" ? "No special permissions (default)" : t === "trusted" ? "Can read site config" : "Full access to internal APIs"
+        }))
+      });
+      if (isCancel3(answer)) {
+        cancel3("Cancelled.");
+        process.exit(0);
+      }
+      trustLevel = answer;
+    }
+  }
+  let capabilities = args.pluginCapabilities;
+  if (!capabilities) {
+    if (skipConfirm) {
+      capabilities = ["publicHead", "adminSettings"];
+    } else {
+      const answer = await multiselect2({
+        message: "Capabilities (space to toggle, enter to confirm):",
+        options: VALID_PLUGIN_CAPABILITIES.map((c) => ({
+          value: c,
+          label: c
+        })),
+        initialValues: ["publicHead", "adminSettings"],
+        required: false
+      });
+      if (isCancel3(answer)) {
+        cancel3("Cancelled.");
+        process.exit(0);
+      }
+      capabilities = answer;
+    }
+  }
+  const rawDescription = args.pluginDescription ?? "";
+  const description = sanitizeForJsComment(rawDescription);
+  const descriptionJson = JSON.stringify(rawDescription);
+  const nameKebab = mode === "local" ? rawName : pluginNameFromPackage(rawName);
+  const packageName = mode === "standalone" ? rawName : nameKebab;
+  if (!KEBAB_RE.test(nameKebab)) {
+    throw new Error(
+      `Invalid plugin name: "${nameKebab}" (derived from "${rawName}" by stripping the npm scope and the conventional ampless-plugin- prefix) is not valid kebab-case. Each segment must start with a letter and contain only letters and digits. Examples: "site-verification", "image-zoom".`
+    );
+  }
+  const nameCamelCase = toCamelCase(nameKebab);
+  const NamePascalCase = toPascalCase(nameKebab);
+  const DisplayName = toDisplayName(nameKebab);
+  void toKebab;
+  let outputDir;
+  if (mode === "local") {
+    const problem = validateMountableProject(destDir);
+    if (problem) {
+      throw new Error(problem);
+    }
+    outputDir = join5(destDir, "plugins", nameKebab);
+    if (existsSync7(outputDir)) {
+      throw new Error(
+        `Plugin directory already exists: plugins/${nameKebab}/
+Remove it first or choose a different name.`
+      );
+    }
+  } else {
+    const nameSegment = lastSegment(rawName);
+    outputDir = join5(destDir, nameSegment);
+    if (existsSync7(outputDir)) {
+      throw new Error(
+        `Directory already exists: ${nameSegment}/
+Remove it first or choose a different name.`
+      );
+    }
+  }
+  const templateDir = pluginTemplateDir(mode);
+  if (!existsSync7(templateDir)) {
+    throw new Error(
+      `Plugin template not found: ${templateDir}
+The ${mode === "local" ? "plugin-local" : "plugin-standalone"} template directory has not been added to the repo yet. Run \`git pull\` to pick up the latest templates.`
+    );
+  }
+  await mkdir3(outputDir, { recursive: true });
+  await cp4(templateDir, outputDir, { recursive: true });
+  const capabilitiesList = capabilities && capabilities.length > 0 ? capabilities.map((c) => `'${c}'`).join(", ") : "";
+  const capabilitiesJsonArray = capabilities && capabilities.length > 0 ? capabilities.map((c) => `"${c}"`).join(", ") : "";
+  const vars = {
+    // Use camelCase keys so they survive substituteVars' `\w+` regex.
+    // Templates reference them as `{{nameKebab}}` (not `{{name-kebab}}`).
+    nameKebab,
+    nameCamelCase,
+    NameCamelCase: NamePascalCase,
+    packageName,
+    description,
+    descriptionJson,
+    trustLevel: trustLevel ?? "untrusted",
+    capabilitiesList,
+    capabilitiesJsonArray,
+    DisplayName,
+    displayNameJa: DisplayName,
+    // same as English for now; maintainers can localise
+    amplessVersion: SCAFFOLD_AMPLESS_VERSION
+  };
+  await substituteDir2(outputDir, vars);
+  return {
+    mode,
+    outputDir,
+    pluginName: nameKebab,
+    packageName: mode === "standalone" ? packageName : void 0
+  };
+}
+async function runCreatePlugin(args) {
+  const destDir = process.cwd();
+  try {
+    const result = await runCreatePluginIn(destDir, args);
+    if (result.mode === "local") {
+      const rel = `plugins/${result.pluginName}/`;
+      const factoryName = `${toCamelCase(result.pluginName)}Plugin`;
+      outro3(
+        `${pc5.green("\u2714")} Plugin scaffolded at ${pc5.bold(rel)}
+
+  Register it in ${pc5.cyan("cms.config.ts")}:
+
+    import ${factoryName} from './plugins/${result.pluginName}'
+
+    export default defineConfig({
+      // ...
+      plugins: [
+        ${factoryName}(),
+      ],
+    })
+
+  Then restart the dev server to pick up the new plugin.`
+      );
+    } else {
+      const dirName = result.packageName ? lastSegment(result.packageName) : result.pluginName;
+      outro3(
+        `${pc5.green("\u2714")} Standalone plugin scaffolded at ${pc5.bold(dirName + "/")}
+
+  Next steps:
+    ${pc5.cyan(`cd ${dirName}`)}
+    ${pc5.cyan("pnpm install")}
+    ${pc5.cyan("pnpm test")}
+    ${pc5.cyan("pnpm build")}
+    ${pc5.cyan("pnpm publish --access public --tag alpha")}
+
+  Then add the published package to your ampless site:
+    ${pc5.cyan(`pnpm add ${result.packageName ?? result.pluginName}`)}`
+      );
+    }
+  } catch (err) {
+    log5.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+
+// src/setup-encryption-key.ts
+import { writeFile as writeFile6, mkdir as mkdir4, readFile as readFile6 } from "fs/promises";
+import { existsSync as existsSync8 } from "fs";
+import { join as join6 } from "path";
+import { randomBytes } from "crypto";
+import { log as log6, confirm as confirm3, outro as outro4, cancel as cancel4 } from "@clack/prompts";
+import pc6 from "picocolors";
+var SECRETS_DIR = "amplify/secrets";
+var KEY_FILE = "encryption-key.ts";
+var KEY_FILE_PATH = `${SECRETS_DIR}/${KEY_FILE}`;
+function buildFileContent(keyB64) {
+  return `// Generated by \`npx create-ampless setup-encryption-key\`.
+// AES-256-GCM key (32 bytes, base64) for plugin secret storage.
+// Rotate via the same CLI command. Existing ciphertext becomes unreadable on rotation.
+
+export const PLUGIN_SECRET_ENCRYPTION_KEY = '${keyB64}'
+`;
+}
+function extractKeyValue(source) {
+  const match = source.match(
+    /\bPLUGIN_SECRET_ENCRYPTION_KEY\b\s*(?::\s*[^=]+)?=\s*(['"])(.*?)\1/
+  );
+  return match?.[2] ?? null;
+}
+function isEmptyPlaceholder(source) {
+  return extractKeyValue(source) === "";
+}
+async function appendGitignoreEntry(cwd, entry) {
+  const gitignorePath = join6(cwd, ".gitignore");
+  if (existsSync8(gitignorePath)) {
+    const content = await readFile6(gitignorePath, "utf-8");
+    if (content.includes(entry)) return;
+    await writeFile6(gitignorePath, content + (content.endsWith("\n") ? "" : "\n") + entry + "\n");
+  } else {
+    await writeFile6(gitignorePath, entry + "\n");
+  }
+}
+async function runSetupEncryptionKey(args) {
+  const cwd = process.cwd();
+  if (!existsSync8(join6(cwd, "amplify"))) {
+    log6.error(
+      `No \`amplify/\` directory found in ${cwd}.
+Run this command from the root of an ampless project (where amplify/backend.ts lives).`
+    );
+    process.exit(1);
+  }
+  const keyFilePath = join6(cwd, KEY_FILE_PATH);
+  if (existsSync8(keyFilePath)) {
+    const existingContent = await readFile6(keyFilePath, "utf-8");
+    if (!isEmptyPlaceholder(existingContent)) {
+      log6.warn(
+        pc6.yellow(
+          `${KEY_FILE_PATH} already exists.
+Overwriting it will make all existing plugin secrets unreadable
+until each secret is re-saved through the admin UI.`
+        )
+      );
+      const confirmed = await confirm3({
+        message: "Overwrite the existing encryption key?",
+        initialValue: false
+      });
+      if (confirmed === false || confirmed === void 0) {
+        cancel4("Cancelled \u2014 existing key preserved.");
+        return;
+      }
+    }
+  }
+  const keyBytes = randomBytes(32);
+  const keyB64 = keyBytes.toString("base64");
+  const secretsDir = join6(cwd, SECRETS_DIR);
+  if (!existsSync8(secretsDir)) {
+    await mkdir4(secretsDir, { recursive: true });
+  }
+  try {
+    await writeFile6(keyFilePath, buildFileContent(keyB64), "utf-8");
+  } catch (err) {
+    log6.error(
+      `Failed to write ${KEY_FILE_PATH}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    process.exit(1);
+  }
+  if (args.gitignore) {
+    try {
+      await appendGitignoreEntry(cwd, KEY_FILE_PATH);
+      log6.info(`Added ${KEY_FILE_PATH} to .gitignore`);
+    } catch (err) {
+      log6.warn(
+        `Could not update .gitignore: ${err instanceof Error ? err.message : String(err)}
+Add \`${KEY_FILE_PATH}\` to your .gitignore manually.`
+      );
+    }
+  }
+  outro4(
+    `${pc6.green("\u2714")} Generated ${pc6.cyan(KEY_FILE_PATH)}
+
+  ${pc6.bold("Next steps:")}
+    1. In \`amplify/backend.ts\`, add:
+       import { PLUGIN_SECRET_ENCRYPTION_KEY } from './secrets/encryption-key.js'
+       defineAmplessBackend({ ..., pluginSecretEncryptionKey: PLUGIN_SECRET_ENCRYPTION_KEY })
+    2. Redeploy (or restart the sandbox) to inject the key into Lambda env vars.
+    3. Save plugin secrets via the admin UI \u2014 they are now encrypted at rest.
+
+  ${pc6.bold("Threat model summary:")}
+    ${pc6.green("\u2713")} AWS Console operator browsing DDB sees ciphertext only
+    ${pc6.yellow("\u26A0")} Anyone with source repo / deploy artifact access can decrypt
+    ${pc6.red("\u2717")} Malicious trusted plugin in the same Lambda can also decrypt
+       (per-plugin Lambda isolation = roadmap)
+
+` + (args.gitignore ? `  ${pc6.dim(`${KEY_FILE_PATH} added to .gitignore.`)}
+
+` : `  ${pc6.yellow("Tip:")} If committing to a PUBLIC repo, run with --gitignore instead
+  and distribute the key separately.
+
+`) + `  ${pc6.yellow("Rotation:")} Re-run this command and confirm overwrite.
+  Existing ciphertext will be unreadable; re-save via /admin/plugins.`
+  );
+}
+
+// src/index.ts
+import pc7 from "picocolors";
 var DEFAULT_THEMES = VALID_THEMES;
 function buildNonInteractiveOpts(args) {
   const projectName = args.projectName ?? (() => {
-    const b = basename3(process.cwd());
+    const b = basename4(process.cwd());
     return b && b !== "/" ? b : "my-ampless-site";
   })();
   const siteName = args.siteName ?? "My Blog";
@@ -2152,18 +2804,18 @@ function warnIgnoredScaffoldFlags(args) {
   if (args.plugins) ignored.push("--plugins");
   if (args.projectName) ignored.push("<project-name> positional");
   if (ignored.length > 0) {
-    log5.warn(`--mount mode ignores: ${ignored.join(", ")}`);
+    log7.warn(`--mount mode ignores: ${ignored.join(", ")}`);
   }
 }
 async function runMount(args) {
   const destDir = process.cwd();
-  const projectName = basename3(destDir);
+  const projectName = basename4(destDir);
   warnIgnoredScaffoldFlags(args);
   const problem = validateMountableProject(destDir);
   if (problem) {
-    log5.error(problem);
-    log5.info(
-      "Run `npx create-ampless@alpha <name>` first to scaffold, or `cd` into a scaffolded project before passing --mount."
+    log7.error(problem);
+    log7.info(
+      "Run `npx create-ampless@latest <name>` first to scaffold, or `cd` into a scaffolded project before passing --mount."
     );
     process.exit(1);
   }
@@ -2176,23 +2828,23 @@ async function runMount(args) {
     if (err instanceof PreflightError) {
       process.exit(1);
     }
-    log5.error(err instanceof Error ? err.message : String(err));
+    log7.error(err instanceof Error ? err.message : String(err));
     process.exit(1);
   }
 }
 function printDeployResult(result) {
   const lines = [
-    `${pc5.green("\u2714")} Project deployed`,
+    `${pc7.green("\u2714")} Project deployed`,
     ``,
-    `  GitHub:        ${pc5.cyan(result.githubRepoUrl)}`,
-    `  Amplify app:   ${pc5.cyan(result.amplifyAppId)}`,
-    `  Amplify URL:   ${pc5.cyan(result.amplifyAppUrl)}`
+    `  GitHub:        ${pc7.cyan(result.githubRepoUrl)}`,
+    `  Amplify app:   ${pc7.cyan(result.amplifyAppId)}`,
+    `  Amplify URL:   ${pc7.cyan(result.amplifyAppUrl)}`
   ];
   if (result.domainUrl) {
-    lines.push(`  Custom domain: ${pc5.cyan(result.domainUrl)}`);
+    lines.push(`  Custom domain: ${pc7.cyan(result.domainUrl)}`);
   }
   if (result.domainVerification && result.domainVerification.length > 0) {
-    lines.push("", `  ${pc5.bold("Add these DNS records to verify the domain:")}`);
+    lines.push("", `  ${pc7.bold("Add these DNS records to verify the domain:")}`);
     for (const v of result.domainVerification) {
       lines.push(`    ${v.cname}  CNAME  ${v.target}`);
     }
@@ -2200,9 +2852,9 @@ function printDeployResult(result) {
   lines.push(
     "",
     `  First build is now running in Amplify Hosting.`,
-    `  Watch it at ${pc5.cyan(`https://console.aws.amazon.com/amplify/home#/${result.amplifyAppId}`)}`
+    `  Watch it at ${pc7.cyan(`https://console.aws.amazon.com/amplify/home#/${result.amplifyAppId}`)}`
   );
-  outro3(lines.join("\n"));
+  outro5(lines.join("\n"));
 }
 async function main() {
   const args = parseDeployArgs(process.argv.slice(2));
@@ -2211,7 +2863,7 @@ async function main() {
     return;
   }
   for (const flag of args.unknown) {
-    log5.warn(`Unknown argument ignored: ${flag}`);
+    log7.warn(`Unknown argument ignored: ${flag}`);
   }
   if (args.upgrade) {
     await runUpgrade(args);
@@ -2221,6 +2873,14 @@ async function main() {
     await runCopyTheme(args);
     return;
   }
+  if (args.createPlugin) {
+    await runCreatePlugin(args);
+    return;
+  }
+  if (args.setupEncryptionKey) {
+    await runSetupEncryptionKey(args);
+    return;
+  }
   if (args.mount) {
     await runMount(args);
     return;
@@ -2233,8 +2893,8 @@ async function main() {
   }
   if (!opts) return;
   const destDir = resolve5(process.cwd(), opts.projectName);
-  if (existsSync7(destDir)) {
-    log5.error(`Directory already exists: ${destDir}`);
+  if (existsSync9(destDir)) {
+    log7.error(`Directory already exists: ${destDir}`);
     process.exit(1);
   }
   const sharedDir = sharedTemplateDir();
@@ -2245,7 +2905,7 @@ async function main() {
     s.stop("Done!");
   } catch (err) {
     s.stop("Failed.");
-    log5.error(String(err));
+    log7.error(String(err));
     process.exit(1);
   }
   if (args.deploy) {
@@ -2258,19 +2918,18 @@ async function main() {
       if (err instanceof PreflightError) {
         process.exit(1);
       }
-      log5.error(err instanceof Error ? err.message : String(err));
+      log7.error(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
     return;
   }
-  outro3(
-    `${pc5.green("\u2714")} Project created at ${pc5.bold(opts.projectName)}
+  outro5(
+    `${pc7.green("\u2714")} Project created at ${pc7.bold(opts.projectName)}
 
   Next steps:
-    ${pc5.cyan("cd")} ${opts.projectName}
-    ${pc5.cyan("npm install")}
-    ${pc5.cyan("npx ampx sandbox")}   ${pc5.dim("# start Amplify backend")}
-    ${pc5.cyan("npm run dev")}         ${pc5.dim("# start Next.js")}`
+    ${pc7.cyan("cd")} ${opts.projectName}
+    ${pc7.cyan("npm install")}
+    ${pc7.cyan("npm run sandbox")}   ${pc7.dim("# deploy sandbox + start Next.js")}`
   );
 }
 main().catch((err) => {