create-ampless 1.0.0-alpha.143 → 1.0.0-alpha.145

package/dist/templates/_shared/app/(admin)/admin/preview/route.tsx

@@ -1,68 +1,4 @@
-import type { Post } from 'ampless'
 import { admin } from '@/lib/admin'
+import { createPreviewRouteHandler } from '@ampless/admin/api'
 
-/**
- * Preview-only Route Handler. Client-side `<PostForm>` / `<PostHistoryPanel>`
- * POST a draft Post to this endpoint while the preview tab is open; we
- * render the body + page-level scripts via `ampless.renderBody` /
- * `publicPostScriptsForPage` and return a fully-rendered HTML string
- * that the admin shows in an iframe (`sandbox="allow-scripts allow-same-origin"`,
- * v1 trust boundary expansion — admin preview content / plugin script are
- * explicitly treated as trusted; see the iframe comment in post-form.tsx).
- *
- * Why a Route Handler instead of a Server Action: Next.js 15+
- * refuses to compile Client Components that reach `react-dom/server`
- * through a `'use server'` module, because the build traces the
- * import graph from Client Components through Server Action modules.
- * Putting this rendering behind a Route Handler decouples it from
- * that graph entirely — the form fetches a plain HTTP endpoint and
- * the bundler never walks from `<PostForm>` into here. The endpoint
- * also gets an explicit `admin.isEditor()` gate so a future change
- * to the `(admin)` route-group middleware can't silently turn
- * preview into a content-leak vector for unpublished drafts.
- *
- * The `react-dom/server` import itself is loaded via dynamic
- * `import()` inside the handler. Next.js 16's Turbopack flags any
- * top-level static `import 'react-dom/server'` reached from the app
- * router build (Route Handlers included), so we deliberately defer
- * the resolution to request time — the module is still pulled from
- * the same Node.js subpath that `next start` ships, just not visible
- * to the build-time import-graph walker.
- *
- * Auth: locked to authenticated editors. Anonymous + reader access is
- * 403. This matches the rest of `/admin/**`, which is gated by the
- * `(admin)` route group + middleware, but we add an explicit check
- * here as defence-in-depth against the middleware gate being
- * misconfigured.
- */
-export async function POST(req: Request): Promise<Response> {
-  const session = await admin.getServerSession()
-  if (!admin.isEditor(session)) {
-    return new Response('Forbidden', { status: 403 })
-  }
-  let draft: Post
-  try {
-    draft = (await req.json()) as Post
-  } catch {
-    return new Response('Bad Request', { status: 400 })
-  }
-  const ampless = await admin.getAmpless()
-  // IMPORTANT: include BOTH the body and the page-level scripts so
-  // widgets like x.com's `widgets.js` get a chance to hydrate in the
-  // iframe.
-  const node = (
-    <>
-      {await ampless.renderBody(draft)}
-      {await ampless.publicPostScriptsForPage([draft])}
-    </>
-  )
-  // Dynamic import: see top-of-file comment. The module is server-only
-  // and resolved at request time.
-  const { renderToStaticMarkup } = await import('react-dom/server')
-  return new Response(renderToStaticMarkup(node), {
-    headers: {
-      'Content-Type': 'text/html; charset=utf-8',
-      'Cache-Control': 'no-store',
-    },
-  })
-}
+export const POST = createPreviewRouteHandler(admin)

package/dist/templates/_shared/package.json

@@ -26,21 +26,21 @@
     "@tiptap/pm": "^3.23.6",
     "@tiptap/react": "^3.23.6",
     "@tiptap/starter-kit": "^3.23.6",
-    "@ampless/plugin-analytics-ga4": "^0.2.0-alpha.33",
-    "@ampless/plugin-cookie-consent": "^0.1.0-alpha.24",
-    "@ampless/plugin-gtm": "^0.2.0-alpha.32",
-    "@ampless/plugin-og-image": "^0.2.0-alpha.49",
-    "@ampless/plugin-plausible": "^0.2.0-alpha.32",
-    "@ampless/plugin-reading-time": "^0.1.0-alpha.22",
-    "@ampless/plugin-rss": "^0.2.0-alpha.49",
-    "@ampless/plugin-schema-jsonld": "^0.1.1-alpha.28",
-    "@ampless/plugin-seo": "^0.2.0-alpha.49",
-    "@ampless/plugin-webhook": "^0.2.0-alpha.50",
-    "@ampless/admin": "^1.0.0-alpha.83",
-    "@ampless/backend": "^1.0.0-alpha.71",
-    "@ampless/runtime": "^1.0.0-alpha.58",
+    "@ampless/plugin-analytics-ga4": "^0.2.0-alpha.34",
+    "@ampless/plugin-cookie-consent": "^0.1.0-alpha.25",
+    "@ampless/plugin-gtm": "^0.2.0-alpha.33",
+    "@ampless/plugin-og-image": "^0.2.0-alpha.50",
+    "@ampless/plugin-plausible": "^0.2.0-alpha.33",
+    "@ampless/plugin-reading-time": "^0.1.0-alpha.23",
+    "@ampless/plugin-rss": "^0.2.0-alpha.50",
+    "@ampless/plugin-schema-jsonld": "^0.1.1-alpha.29",
+    "@ampless/plugin-seo": "^0.2.0-alpha.50",
+    "@ampless/plugin-webhook": "^0.2.0-alpha.51",
+    "@ampless/admin": "^1.0.0-alpha.84",
+    "@ampless/backend": "^1.0.0-alpha.72",
+    "@ampless/runtime": "^1.0.0-alpha.59",
     "@digital-go-jp/tailwind-theme-plugin": "^0.3.4",
-    "ampless": "^1.0.0-alpha.49",
+    "ampless": "^1.0.0-alpha.50",
     "aws-amplify": "^6.17.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ampless",
-  "version": "1.0.0-alpha.143",
+  "version": "1.0.0-alpha.145",
   "description": "Create a new ampless project",
   "license": "MIT",
   "type": "module",