create-ampless 1.0.0-alpha.128 → 1.0.0-alpha.131

package/dist/index.js

@@ -1885,23 +1885,41 @@ var AMPLESS_MANAGED_APP_PATHS = [
   "app/login",
   "app/site"
 ];
-var AMPLESS_RETIRED_PATHS = [];
+var AMPLESS_RETIRED_PATHS = [
+  // Phase 7 preview pipeline migrated from a `'use server'` action to a
+  // Route Handler at `app/(admin)/admin/preview/route.tsx` (default
+  // endpoint: `/admin/preview`). The old action made Next.js 15+ refuse
+  // to compile the edit-post page
+  // because the import graph traced `react-dom/server` from Client
+  // Components through Server Action modules. Sites scaffolded before
+  // this change pick the new endpoint up on their next `update-ampless`
+  // — the new route file is seeded as part of the normal template
+  // sync, and the old action file is retired by this entry.
+  "app/(admin)/admin/_actions/render-preview.tsx"
+];
 var AMPLESS_PACKAGES = /* @__PURE__ */ new Set([
   "ampless",
   "@ampless/admin",
   "@ampless/backend",
-  "@ampless/runtime",
-  "@ampless/plugin-seo",
-  "@ampless/plugin-rss",
-  "@ampless/plugin-schema-jsonld",
-  "@ampless/plugin-webhook",
-  "@ampless/plugin-og-image",
   "@ampless/plugin-analytics-ga4",
+  "@ampless/plugin-cookie-consent",
   "@ampless/plugin-gtm",
+  "@ampless/plugin-og-image",
   "@ampless/plugin-plausible",
-  "@ampless/plugin-cookie-consent",
-  "@ampless/plugin-reading-time"
+  "@ampless/plugin-reading-time",
+  "@ampless/plugin-rss",
+  "@ampless/plugin-schema-jsonld",
+  "@ampless/plugin-seo",
+  "@ampless/plugin-webhook",
+  "@ampless/plugin-x-embed",
+  "@ampless/plugin-youtube",
+  "@ampless/runtime"
 ]);
+var AMPLESS_MANAGED_TRANSITIVE_PREFIXES = ["@tiptap/"];
+function isManagedDep(name) {
+  if (AMPLESS_PACKAGES.has(name)) return true;
+  return AMPLESS_MANAGED_TRANSITIVE_PREFIXES.some((p3) => name.startsWith(p3));
+}
 var AMPLESS_MANAGED_SCRIPTS = /* @__PURE__ */ new Set([
   "sandbox",
   "sandbox:dev",
@@ -2231,7 +2249,7 @@ async function runUpgradeIn(destDir, sharedDir, opts = {}) {
     const templateDeps = templatePkg[section] ?? {};
     const projectDeps = projectPkg[section] ?? {};
     for (const [name, version] of Object.entries(templateDeps)) {
-      if (!AMPLESS_PACKAGES.has(name)) continue;
+      if (!isManagedDep(name)) continue;
       projectDeps[name] = version;
     }
     if (Object.keys(projectDeps).length > 0) {

package/dist/templates/_shared/app/(admin)/admin/posts/[postId]/page.tsx

@@ -1,5 +1,4 @@
 import { admin } from '@/lib/admin'
 import { createEditPostPage } from '@ampless/admin/pages'
-import { renderPreviewHtml } from '../../_actions/render-preview'
 
-export default createEditPostPage(admin, { renderPreviewAction: renderPreviewHtml })
+export default createEditPostPage(admin)

package/dist/templates/_shared/app/(admin)/admin/posts/new/page.tsx

@@ -1,5 +1,4 @@
 import { admin } from '@/lib/admin'
 import { createNewPostPage } from '@ampless/admin/pages'
-import { renderPreviewHtml } from '../../_actions/render-preview'
 
-export default createNewPostPage(admin, { renderPreviewAction: renderPreviewHtml })
+export default createNewPostPage(admin)

package/dist/templates/_shared/app/(admin)/admin/preview/route.tsx

@@ -0,0 +1,66 @@
+import type { Post } from 'ampless'
+import { admin } from '@/lib/admin'
+
+/**
+ * Preview-only Route Handler. Client-side `<PostForm>` / `<PostHistoryPanel>`
+ * POST a draft Post to this endpoint while the preview tab is open; we
+ * render the body + page-level scripts via `ampless.renderBody` /
+ * `publicPostScriptsForPage` and return a fully-rendered HTML string
+ * that the admin shows in an iframe (`sandbox="allow-scripts"`).
+ *
+ * Why a Route Handler instead of a Server Action: Next.js 15+
+ * refuses to compile Client Components that reach `react-dom/server`
+ * through a `'use server'` module, because the build traces the
+ * import graph from Client Components through Server Action modules.
+ * Putting this rendering behind a Route Handler decouples it from
+ * that graph entirely — the form fetches a plain HTTP endpoint and
+ * the bundler never walks from `<PostForm>` into here. The endpoint
+ * also gets an explicit `admin.isEditor()` gate so a future change
+ * to the `(admin)` route-group middleware can't silently turn
+ * preview into a content-leak vector for unpublished drafts.
+ *
+ * The `react-dom/server` import itself is loaded via dynamic
+ * `import()` inside the handler. Next.js 16's Turbopack flags any
+ * top-level static `import 'react-dom/server'` reached from the app
+ * router build (Route Handlers included), so we deliberately defer
+ * the resolution to request time — the module is still pulled from
+ * the same Node.js subpath that `next start` ships, just not visible
+ * to the build-time import-graph walker.
+ *
+ * Auth: locked to authenticated editors. Anonymous + reader access is
+ * 403. This matches the rest of `/admin/**`, which is gated by the
+ * `(admin)` route group + middleware, but we add an explicit check
+ * here as defence-in-depth against the middleware gate being
+ * misconfigured.
+ */
+export async function POST(req: Request): Promise<Response> {
+  const session = await admin.getServerSession()
+  if (!admin.isEditor(session)) {
+    return new Response('Forbidden', { status: 403 })
+  }
+  let draft: Post
+  try {
+    draft = (await req.json()) as Post
+  } catch {
+    return new Response('Bad Request', { status: 400 })
+  }
+  const ampless = await admin.getAmpless()
+  // IMPORTANT: include BOTH the body and the page-level scripts so
+  // widgets like x.com's `widgets.js` get a chance to hydrate in the
+  // iframe.
+  const node = (
+    <>
+      {await ampless.renderBody(draft)}
+      {await ampless.publicPostScriptsForPage([draft])}
+    </>
+  )
+  // Dynamic import: see top-of-file comment. The module is server-only
+  // and resolved at request time.
+  const { renderToStaticMarkup } = await import('react-dom/server')
+  return new Response(renderToStaticMarkup(node), {
+    headers: {
+      'Content-Type': 'text/html; charset=utf-8',
+      'Cache-Control': 'no-store',
+    },
+  })
+}

package/dist/templates/_shared/docs/plugin-author-guide.ja.md

@@ -808,16 +808,24 @@ export default createAdminLayout(admin, { editorBootstrap: EditorBootstrap })
 
 ### エディタプレビューのパイプライン
 
-admin の edit / new post フォームは preview ペインを `<iframe sandbox="allow-scripts">` で表示する。`srcDoc` はテンプレート側 server action が返す HTML:
+admin の edit / new post フォームは preview ペインを `<iframe sandbox="allow-scripts">` で表示する。`srcDoc` はテンプレート側 preview Route Handler が返す HTML。テンプレート scaffold は handler を `app/(admin)/admin/preview/route.tsx` に同梱する:
 
 ```tsx
-// templates/_shared/app/(admin)/admin/_actions/render-preview.tsx
-'use server'
-import { renderToStaticMarkup } from 'react-dom/server'
+// templates/_shared/app/(admin)/admin/preview/route.tsx
 import type { Post } from 'ampless'
 import { admin } from '@/lib/admin'
 
-export async function renderPreviewHtml(draft: Post): Promise<string> {
+export async function POST(req: Request): Promise<Response> {
+  const session = await admin.getServerSession()
+  if (!admin.isEditor(session)) {
+    return new Response('Forbidden', { status: 403 })
+  }
+  let draft: Post
+  try {
+    draft = (await req.json()) as Post
+  } catch {
+    return new Response('Bad Request', { status: 400 })
+  }
   const ampless = await admin.getAmpless()
   const node = (
     <>
@@ -825,21 +833,35 @@ export async function renderPreviewHtml(draft: Post): Promise<string> {
       {await ampless.publicPostScriptsForPage([draft])}
     </>
   )
-  return renderToStaticMarkup(node)
+  // dynamic import: 下の「Server Action ではなく Route Handler を採用した理由」参照。
+  const { renderToStaticMarkup } = await import('react-dom/server')
+  return new Response(renderToStaticMarkup(node), {
+    headers: {
+      'Content-Type': 'text/html; charset=utf-8',
+      'Cache-Control': 'no-store',
+    },
+  })
 }
 ```
 
-page factory は `renderPreviewAction` オプションでこの action を thread する:
+`<PostForm>` / `<PostHistoryPanel>` は素のままで `/admin/preview` に draft を POST する — call site で追加の wiring は不要:
 
 ```tsx
 // templates/_shared/app/(admin)/admin/posts/[postId]/page.tsx
 import { admin } from '@/lib/admin'
 import { createEditPostPage } from '@ampless/admin/pages'
-import { renderPreviewHtml } from '../../_actions/render-preview'
 
-export default createEditPostPage(admin, { renderPreviewAction: renderPreviewHtml })
+export default createEditPostPage(admin)
 ```
 
+admin が非デフォルトパス（Next.js `basePath` やカスタム prefix）にマウントされている場合は、page factory の `previewEndpoint` option で endpoint を上書きできる:
+
+```tsx
+export default createEditPostPage(admin, { previewEndpoint: '/cms/admin/preview' })
+```
+
+Server Action ではなく Route Handler を採用した理由: `'use server'` モジュール内部で `react-dom/server` 由来の rendering を行うと、Next.js 15+ が edit-post page の compile に失敗する。build 時に Client Component から Server Action モジュール経由で import graph を辿るため、その経路上で `react-dom/server` に到達した時点で「You're importing a component that imports react-dom/server」チェックが発火する。Route Handler に切り出すことで rendering を import graph から完全に切り離せる — `<PostForm>` は plain な HTTP endpoint を fetch するだけで、bundler は form から handler 側へ踏み込まない。さらに handler 自身が `admin.isEditor()` を明示的にチェックすることで、将来 `(admin)` route-group gate が誤設定された場合の安全側のフェールセーフになる。`react-dom/server` の import 自体を dynamic にしているのは Next.js 16 の Turbopack が、Route Handler を含む app router build 経路で reach できる top-level の `react-dom/server` static import を一律で flag するため。request 時に解決することで build-time import-graph walker から外しつつ、runtime では同じ Node.js subpath からロードする。
+
 iframe の `sandbox="allow-scripts"` は `allow-same-origin` を含まないので、preview の中身は opaque origin で動作する → widget script は admin の DOM に触れない。トレードオフ: widget が自身の origin の storage にアクセスできない場合に正しく動かない可能性がある。Phase 7 時点の dogfood では YouTube iframe / x.com widgets.js とも opaque origin で動作することを確認済み。将来 non-opaque origin が必要な widget が出てきた場合、escape hatch は別 subdomain の preview route + 適切な CSP — sandbox flag を緩めるのは取らない。
 
 ---

package/dist/templates/_shared/docs/plugin-author-guide.md

@@ -1062,16 +1062,25 @@ registered list onto its built-in extensions on every render.
 
 The admin's edit / new post forms render the preview pane in an
 `<iframe sandbox="allow-scripts">` whose `srcDoc` is the HTML returned
-by the template's server action:
+by the template's preview Route Handler. The template scaffold ships
+the handler at `app/(admin)/admin/preview/route.tsx`:
 
 ```tsx
-// templates/_shared/app/(admin)/admin/_actions/render-preview.tsx
-'use server'
-import { renderToStaticMarkup } from 'react-dom/server'
+// templates/_shared/app/(admin)/admin/preview/route.tsx
 import type { Post } from 'ampless'
 import { admin } from '@/lib/admin'
 
-export async function renderPreviewHtml(draft: Post): Promise<string> {
+export async function POST(req: Request): Promise<Response> {
+  const session = await admin.getServerSession()
+  if (!admin.isEditor(session)) {
+    return new Response('Forbidden', { status: 403 })
+  }
+  let draft: Post
+  try {
+    draft = (await req.json()) as Post
+  } catch {
+    return new Response('Bad Request', { status: 400 })
+  }
   const ampless = await admin.getAmpless()
   const node = (
     <>
@@ -1079,22 +1088,54 @@ export async function renderPreviewHtml(draft: Post): Promise<string> {
       {await ampless.publicPostScriptsForPage([draft])}
     </>
   )
-  return renderToStaticMarkup(node)
+  // Dynamic import: see "Why a Route Handler" below.
+  const { renderToStaticMarkup } = await import('react-dom/server')
+  return new Response(renderToStaticMarkup(node), {
+    headers: {
+      'Content-Type': 'text/html; charset=utf-8',
+      'Cache-Control': 'no-store',
+    },
+  })
 }
 ```
 
-Page factories thread the action down via the `renderPreviewAction`
-option:
+`<PostForm>` / `<PostHistoryPanel>` POST the draft to `/admin/preview`
+out of the box — no extra wiring at the call site:
 
 ```tsx
 // templates/_shared/app/(admin)/admin/posts/[postId]/page.tsx
 import { admin } from '@/lib/admin'
 import { createEditPostPage } from '@ampless/admin/pages'
-import { renderPreviewHtml } from '../../_actions/render-preview'
 
-export default createEditPostPage(admin, { renderPreviewAction: renderPreviewHtml })
+export default createEditPostPage(admin)
 ```
 
+If the admin is mounted at a non-default path (Next.js `basePath` or
+a custom prefix), override the endpoint via the page factory's
+`previewEndpoint` option:
+
+```tsx
+export default createEditPostPage(admin, { previewEndpoint: '/cms/admin/preview' })
+```
+
+Why a Route Handler rather than a Server Action: putting
+`react-dom/server`-driven rendering inside a `'use server'` module
+makes Next.js 15+ refuse to compile the edit-post page, because the
+build traces the import graph from Client Components through Server
+Action modules and any reach to `react-dom/server` along that path
+trips the "You're importing a component that imports
+react-dom/server" check. A Route Handler decouples the rendering
+from that graph entirely — `<PostForm>` fetches a plain HTTP
+endpoint and the bundler never walks from the form into here. The
+handler's explicit `admin.isEditor()` check also defends against
+accidental exposure if the `(admin)` route-group gate is ever
+misconfigured. The `react-dom/server` import itself is dynamic
+because Next.js 16's Turbopack flags any top-level static import of
+`react-dom/server` reached from the app router build, Route Handlers
+included; deferring it to request time keeps the module outside the
+build-time import-graph walker while still loading it from the same
+Node.js subpath at runtime.
+
 The iframe's `sandbox="allow-scripts"` (without `allow-same-origin`)
 keeps preview content in an opaque origin so widget scripts cannot
 reach the admin's DOM. The trade-off is that some widgets may misbehave

package/dist/templates/_shared/package.json

@@ -20,26 +20,27 @@
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-label": "^2.1.8",
     "@radix-ui/react-slot": "^1.2.4",
+    "@tiptap/core": "^3.23.6",
     "@tiptap/extension-image": "^3.23.6",
     "@tiptap/extension-link": "^3.23.6",
     "@tiptap/pm": "^3.23.6",
     "@tiptap/react": "^3.23.6",
     "@tiptap/starter-kit": "^3.23.6",
-    "@ampless/plugin-analytics-ga4": "^0.2.0-alpha.26",
-    "@ampless/plugin-cookie-consent": "^0.1.0-alpha.17",
-    "@ampless/plugin-gtm": "^0.2.0-alpha.25",
-    "@ampless/plugin-og-image": "^0.2.0-alpha.42",
-    "@ampless/plugin-plausible": "^0.2.0-alpha.25",
-    "@ampless/plugin-reading-time": "^0.1.0-alpha.15",
-    "@ampless/plugin-rss": "^0.2.0-alpha.42",
-    "@ampless/plugin-schema-jsonld": "^0.1.1-alpha.21",
-    "@ampless/plugin-seo": "^0.2.0-alpha.42",
-    "@ampless/plugin-webhook": "^0.2.0-alpha.43",
-    "@ampless/admin": "^1.0.0-alpha.75",
-    "@ampless/backend": "^1.0.0-alpha.64",
-    "@ampless/runtime": "^1.0.0-alpha.51",
+    "@ampless/plugin-analytics-ga4": "^0.2.0-alpha.27",
+    "@ampless/plugin-cookie-consent": "^0.1.0-alpha.18",
+    "@ampless/plugin-gtm": "^0.2.0-alpha.26",
+    "@ampless/plugin-og-image": "^0.2.0-alpha.43",
+    "@ampless/plugin-plausible": "^0.2.0-alpha.26",
+    "@ampless/plugin-reading-time": "^0.1.0-alpha.16",
+    "@ampless/plugin-rss": "^0.2.0-alpha.43",
+    "@ampless/plugin-schema-jsonld": "^0.1.1-alpha.22",
+    "@ampless/plugin-seo": "^0.2.0-alpha.43",
+    "@ampless/plugin-webhook": "^0.2.0-alpha.44",
+    "@ampless/admin": "^1.0.0-alpha.76",
+    "@ampless/backend": "^1.0.0-alpha.65",
+    "@ampless/runtime": "^1.0.0-alpha.52",
     "@digital-go-jp/tailwind-theme-plugin": "^0.3.4",
-    "ampless": "^1.0.0-alpha.42",
+    "ampless": "^1.0.0-alpha.43",
     "aws-amplify": "^6.17.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ampless",
-  "version": "1.0.0-alpha.128",
+  "version": "1.0.0-alpha.131",
   "description": "Create a new ampless project",
   "license": "MIT",
   "type": "module",

package/dist/templates/_shared/app/(admin)/admin/_actions/render-preview.tsx

@@ -1,32 +0,0 @@
-'use server'
-
-// Phase 7 preview pipeline. <PostForm> / <PostHistoryPanel> calls this
-// server action with the in-flight draft Post; we render the body +
-// page-level scripts on the server (where async ReactNode +
-// `contentFields` plugin renderers can run) and return a complete HTML
-// string that the admin shows in an iframe (sandbox=`allow-scripts`).
-//
-// Server-side is the only place this can live: `ampless.renderBody`
-// returns a Promise<ReactNode>, so client code can't call it inline.
-// The action also has access to the `Ampless` instance via
-// `admin.getAmpless()` which the client never sees.
-
-import { renderToStaticMarkup } from 'react-dom/server'
-import type { Post } from 'ampless'
-import { admin } from '@/lib/admin'
-
-export async function renderPreviewHtml(draft: Post): Promise<string> {
-  const ampless = await admin.getAmpless()
-  // IMPORTANT: include BOTH the body and the page-level scripts so
-  // widgets like x.com's `widgets.js` get a chance to hydrate in the
-  // iframe. Without `publicPostScriptsForPage([draft])` the embed
-  // blockquote would render but never load the widget JS, and authors
-  // wouldn't see what the public page actually looks like.
-  const node = (
-    <>
-      {await ampless.renderBody(draft)}
-      {await ampless.publicPostScriptsForPage([draft])}
-    </>
-  )
-  return renderToStaticMarkup(node)
-}