create-ampless 1.0.0-alpha.99 → 1.0.0-beta.148

package/README.ja.md

@@ -5,10 +5,10 @@
 
 [ampless](https://github.com/heavymoons/ampless) プロジェクト向け CLI スキャフォールディングツール。
 
-> **プレリリース / アルファ版。** v1.0 まではマイナーバージョンでも破壊的変更が入る可能性があります。`@alpha` タグを使用してください（`@latest` タグは v1.0 まで存在しません）。
+> **プレリリース / ベータ版。** v1.0 まではマイナーバージョンでも破壊的変更が入る可能性があります。`@beta` タグを使用してください（`@latest` タグは v1.0 まで存在しません）。
 
 ```bash
-npx create-ampless@alpha
+npx create-ampless@beta
 ```
 
 ウィザードが以下を順に案内します：
@@ -36,7 +36,7 @@ npm run dev             # http://localhost:3000
 ウィザードは `npx` から Amplify Hosting の URL まで一気に進めることもできます：
 
 ```bash
-npx create-ampless@alpha my-site --deploy
+npx create-ampless@beta my-site --deploy
 ```
 
 このフラグを追加すると、スキャフォールディング後に以下が実行されます：
@@ -51,7 +51,7 @@ npx create-ampless@alpha my-site --deploy
 コマンドラインに指定が不足している場合はインタラクティブに確認します。CI 向けのフル指定の例：
 
 ```bash
-npx create-ampless@alpha my-site --deploy \
+npx create-ampless@beta my-site --deploy \
   --github-owner my-org \
   --github-private \
   --aws-region us-east-1 \

package/README.md

@@ -5,10 +5,10 @@
 
 CLI scaffolding tool for [ampless](https://github.com/heavymoons/ampless) projects.
 
-> **Pre-release / alpha.** Breaking changes possible in any minor version until v1.0. Use the `@alpha` tag (the `@latest` tag won't exist until v1.0).
+> **Pre-release / beta.** Breaking changes possible in any minor version until v1.0. Use the `@beta` tag (the `@latest` tag won't exist until v1.0).
 
 ```bash
-npx create-ampless@alpha
+npx create-ampless@beta
 ```
 
 The wizard walks you through:
@@ -36,7 +36,7 @@ Sign up at `/login` — the first registered user is automatically promoted to t
 The wizard can also take you all the way from `npx` to a live Amplify Hosting URL:
 
 ```bash
-npx create-ampless@alpha my-site --deploy
+npx create-ampless@beta my-site --deploy
 ```
 
 That extra flag, after scaffolding, runs:
@@ -51,7 +51,7 @@ That extra flag, after scaffolding, runs:
 Anything missing on the command line gets asked interactively. For CI-friendly fully-flagged usage:
 
 ```bash
-npx create-ampless@alpha my-site --deploy \
+npx create-ampless@beta my-site --deploy \
   --github-owner my-org \
   --github-private \
   --aws-region us-east-1 \

package/dist/index.js

@@ -516,12 +516,12 @@ function parseDeployArgs(argv) {
 var HELP_TEXT = `create-ampless \u2014 scaffold an ampless project
 
 Usage:
-  npx create-ampless@latest <project-name> [options]
-  npx create-ampless@latest --mount [options]               # in an existing project dir
-  npx create-ampless@latest upgrade [options]               # in an existing project dir
-  npx create-ampless@latest copy-theme <src> <dst>          # in an existing project dir
-  npx create-ampless@latest plugin <name> [options]         # scaffold a plugin (Phase 5)
-  npx create-ampless@latest setup-encryption-key [--gitignore]  # generate encryption key file
+  npx create-ampless@beta <project-name> [options]
+  npx create-ampless@beta --mount [options]               # in an existing project dir
+  npx create-ampless@beta upgrade [options]               # in an existing project dir
+  npx create-ampless@beta copy-theme <src> <dst>          # in an existing project dir
+  npx create-ampless@beta plugin <name> [options]         # scaffold a plugin (Phase 5)
+  npx create-ampless@beta setup-encryption-key [--gitignore]  # generate encryption key file
 
 Options:
   --site-name <name>          Site display name (default: "My Blog")
@@ -558,7 +558,7 @@ Options:
                               flag values (for CI / automation)
   -h, --help                  Show this message
 
-upgrade  Sync ampless package files / deps to latest alpha.
+upgrade  Sync ampless package files / deps to latest beta.
          Run inside an existing ampless project.
 
   --dry-run                   Show what would change without writing any files
@@ -571,7 +571,7 @@ copy-theme <source> <target>
          (the convention that flags it as user-owned, so upgrade leaves
          it alone). Run inside an existing ampless project.
 
-         Example: npx create-ampless@latest copy-theme blog my-blog
+         Example: npx create-ampless@beta copy-theme blog my-blog
 
 plugin <name>
          Scaffold an ampless plugin. Two modes:
@@ -596,8 +596,8 @@ plugin <name>
   --description "<text>"      Optional one-line description
 
          Examples:
-           npx create-ampless@latest plugin site-verification
-           npx create-ampless@latest plugin @ishinao/ampless-plugin-foo --standalone
+           npx create-ampless@beta plugin site-verification
+           npx create-ampless@beta plugin @ishinao/ampless-plugin-foo --standalone
 
 setup-encryption-key
          Generate the AES-256-GCM encryption key for plugin secret storage
@@ -624,8 +624,8 @@ setup-encryption-key
          Rotation: re-run with confirm overwrite. Existing ciphertext
          becomes unreadable; re-save each secret via /admin/plugins.
 
-         Example: npx create-ampless@latest setup-encryption-key
-         Example: npx create-ampless@latest setup-encryption-key --gitignore
+         Example: npx create-ampless@beta setup-encryption-key
+         Example: npx create-ampless@beta setup-encryption-key --gitignore
 `;
 
 // src/deploy-prompts.ts
@@ -1885,23 +1885,41 @@ var AMPLESS_MANAGED_APP_PATHS = [
   "app/login",
   "app/site"
 ];
-var AMPLESS_RETIRED_PATHS = [];
+var AMPLESS_RETIRED_PATHS = [
+  // Phase 7 preview pipeline migrated from a `'use server'` action to a
+  // Route Handler at `app/(admin)/admin/preview/route.tsx` (default
+  // endpoint: `/admin/preview`). The old action made Next.js 15+ refuse
+  // to compile the edit-post page
+  // because the import graph traced `react-dom/server` from Client
+  // Components through Server Action modules. Sites scaffolded before
+  // this change pick the new endpoint up on their next `update-ampless`
+  // — the new route file is seeded as part of the normal template
+  // sync, and the old action file is retired by this entry.
+  "app/(admin)/admin/_actions/render-preview.tsx"
+];
 var AMPLESS_PACKAGES = /* @__PURE__ */ new Set([
   "ampless",
   "@ampless/admin",
   "@ampless/backend",
-  "@ampless/runtime",
-  "@ampless/plugin-seo",
-  "@ampless/plugin-rss",
-  "@ampless/plugin-schema-jsonld",
-  "@ampless/plugin-webhook",
-  "@ampless/plugin-og-image",
   "@ampless/plugin-analytics-ga4",
+  "@ampless/plugin-cookie-consent",
   "@ampless/plugin-gtm",
+  "@ampless/plugin-og-image",
   "@ampless/plugin-plausible",
-  "@ampless/plugin-cookie-consent",
-  "@ampless/plugin-reading-time"
+  "@ampless/plugin-reading-time",
+  "@ampless/plugin-rss",
+  "@ampless/plugin-schema-jsonld",
+  "@ampless/plugin-seo",
+  "@ampless/plugin-webhook",
+  "@ampless/plugin-x-embed",
+  "@ampless/plugin-youtube",
+  "@ampless/runtime"
 ]);
+var AMPLESS_MANAGED_TRANSITIVE_PREFIXES = ["@tiptap/"];
+function isManagedDep(name) {
+  if (AMPLESS_PACKAGES.has(name)) return true;
+  return AMPLESS_MANAGED_TRANSITIVE_PREFIXES.some((p3) => name.startsWith(p3));
+}
 var AMPLESS_MANAGED_SCRIPTS = /* @__PURE__ */ new Set([
   "sandbox",
   "sandbox:dev",
@@ -2138,6 +2156,120 @@ function detectIndent(jsonStr) {
   if (!m) return 2;
   return m[1].length;
 }
+async function bumpUserAmplessPlugins(destDir, projectPkg, templatePkg) {
+  const result = { bumped: [], warnings: [] };
+  const deps = projectPkg.dependencies ?? {};
+  const templateDeps = templatePkg.dependencies ?? {};
+  for (const pkgName of Object.keys(deps)) {
+    if (!pkgName.startsWith("@ampless/")) continue;
+    if (pkgName in templateDeps) continue;
+    let latest;
+    try {
+      const { stdout } = await execa4("npm", ["view", `${pkgName}@beta`, "version"], {
+        cwd: destDir,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      latest = stdout.trim();
+    } catch (e) {
+      result.warnings.push(
+        `${pkgName}: failed to resolve @beta version (${e instanceof Error ? e.message : String(e)}). Leaving the existing pin in package.json.`
+      );
+      continue;
+    }
+    if (!latest) {
+      result.warnings.push(`${pkgName}: npm view returned empty version. Skipping bump.`);
+      continue;
+    }
+    const target = `^${latest}`;
+    const current = deps[pkgName];
+    if (current === target) continue;
+    deps[pkgName] = target;
+    result.bumped.push({ name: pkgName, from: current, to: target });
+  }
+  return result;
+}
+function djb2Hash(s) {
+  let h = 5381;
+  for (let i = 0; i < s.length; i++) {
+    h = h * 33 ^ s.charCodeAt(i) | 0;
+  }
+  return (h >>> 0).toString(16);
+}
+async function regenerateEditorBootstrap(destDir, projectPkg) {
+  const targetPath = join3(destDir, "app", "(admin)", "admin", "_editor-bootstrap.tsx");
+  const installedPlugins = [];
+  const warnings = [];
+  const deps = projectPkg.dependencies ?? {};
+  for (const pkgName of Object.keys(deps)) {
+    const pkgJsonPath = join3(destDir, "node_modules", pkgName, "package.json");
+    if (!existsSync5(pkgJsonPath)) continue;
+    let mf;
+    try {
+      mf = JSON.parse(await readFile3(pkgJsonPath, "utf-8"));
+    } catch (e) {
+      warnings.push(`${pkgName}: failed to read package.json (${e instanceof Error ? e.message : String(e)}). Skipping editor wiring.`);
+      continue;
+    }
+    const ep = mf?.amplessPlugin?.editorExports;
+    if (typeof ep !== "string") continue;
+    if (!ep.startsWith("./") || ep.includes("..") || ep.startsWith("/") || /[?#]/.test(ep)) {
+      warnings.push(`${pkgName}: amplessPlugin.editorExports="${ep}" is invalid (must be a ./-prefixed relative subpath without .. or query/fragment). Skipping editor wiring.`);
+      continue;
+    }
+    if (!mf?.exports || typeof mf.exports[ep] === "undefined") {
+      warnings.push(`${pkgName}: amplessPlugin.editorExports="${ep}" is not declared in package.json#exports. Skipping editor wiring.`);
+      continue;
+    }
+    installedPlugins.push({ packageName: pkgName, editorExports: ep });
+  }
+  installedPlugins.sort((a, b) => a.packageName.localeCompare(b.packageName));
+  const lines = [];
+  lines.push("'use client'", "");
+  lines.push("// AUTO-GENERATED by `npm run update-ampless`. Do not edit \u2014 your changes");
+  lines.push("// will be overwritten on the next run. To enable / disable a plugin's");
+  lines.push("// editor extension, add / remove the corresponding @ampless/plugin-...");
+  lines.push("// entry in your project's package.json (and register it in cms.config.ts");
+  lines.push("// for runtime).", "");
+  lines.push("import { installAdminEditorExtensions, installAdminTiptapNodeMarkdown, installAdminTiptapNodeHtml } from '@ampless/admin/editor'");
+  const identifiers = [];
+  const seen = /* @__PURE__ */ new Map();
+  for (const p3 of installedPlugins) {
+    let ident = "__" + p3.packageName.replace(/^@/, "").replace(/[^a-zA-Z0-9]+/g, "_") + "_editor";
+    if (seen.has(ident) && seen.get(ident) !== p3.packageName) {
+      const suffix = djb2Hash(p3.packageName).slice(0, 8);
+      const orig = ident;
+      ident = `${ident}_${suffix}`;
+      warnings.push(`editor-bootstrap codegen: sanitised identifier "${orig}" collides between "${seen.get(orig)}" and "${p3.packageName}". Using "${ident}" for the latter to disambiguate.`);
+    }
+    seen.set(ident, p3.packageName);
+    const importSubpath = p3.editorExports.startsWith("./") ? `${p3.packageName}/${p3.editorExports.slice(2)}` : `${p3.packageName}/${p3.editorExports}`;
+    lines.push(`import * as ${ident} from '${importSubpath}'`);
+    identifiers.push(ident);
+  }
+  lines.push("");
+  lines.push("export function EditorBootstrap({ children }: { children: React.ReactNode }) {");
+  if (identifiers.length === 0) {
+    lines.push("  installAdminEditorExtensions([])");
+    lines.push("  installAdminTiptapNodeMarkdown([])");
+    lines.push("  installAdminTiptapNodeHtml([])");
+  } else {
+    lines.push("  installAdminEditorExtensions([");
+    for (const id of identifiers) lines.push(`    ${id}.editorExtension,`);
+    lines.push("  ])");
+    lines.push("  installAdminTiptapNodeMarkdown([");
+    for (const id of identifiers) lines.push(`    ${id}.tiptapNodeToMarkdown ?? {},`);
+    lines.push("  ])");
+    lines.push("  installAdminTiptapNodeHtml([");
+    for (const id of identifiers) lines.push(`    ${id}.tiptapNodeToHtml ?? {},`);
+    lines.push("  ])");
+  }
+  lines.push("  return <>{children}</>");
+  lines.push("}");
+  lines.push("");
+  await mkdir2(dirname(targetPath), { recursive: true });
+  await writeFile3(targetPath, lines.join("\n"), "utf-8");
+  return { path: targetPath, pluginCount: installedPlugins.length, warnings };
+}
 async function runUpgradeIn(destDir, sharedDir, opts = {}) {
   const derivedRoot = opts.templatesRoot ?? join3(sharedDir, "..");
   const themeSyncEnabled = existsSync5(join3(derivedRoot, "_shared"));
@@ -2231,7 +2363,7 @@ async function runUpgradeIn(destDir, sharedDir, opts = {}) {
     const templateDeps = templatePkg[section] ?? {};
     const projectDeps = projectPkg[section] ?? {};
     for (const [name, version] of Object.entries(templateDeps)) {
-      if (!AMPLESS_PACKAGES.has(name)) continue;
+      if (!isManagedDep(name)) continue;
       projectDeps[name] = version;
     }
     if (Object.keys(projectDeps).length > 0) {
@@ -2251,11 +2383,46 @@ async function runUpgradeIn(destDir, sharedDir, opts = {}) {
     projectPkg["scripts"] = projectScripts;
   }
   await writeFile3(projectPkgPath, JSON.stringify(projectPkg, null, indent) + "\n", "utf-8");
+  const templatePkgForBump = templatePkg;
+  const projectPkgForBump = projectPkg;
+  const userPluginBump = await bumpUserAmplessPlugins(destDir, projectPkgForBump, templatePkgForBump);
+  if (userPluginBump.bumped.length > 0) {
+    await writeFile3(projectPkgPath, JSON.stringify(projectPkg, null, indent) + "\n", "utf-8");
+  }
   if (!opts.noInstall) {
     const usePnpm = existsSync5(join3(destDir, "pnpm-lock.yaml"));
     const pm = usePnpm ? "pnpm" : "npm";
     await execa4(pm, ["install"], { cwd: destDir, stdio: "inherit" });
   }
+  const codegenProjectPkg = JSON.parse(
+    await readFile3(join3(destDir, "package.json"), "utf-8")
+  );
+  const bootstrapResult = await regenerateEditorBootstrap(destDir, codegenProjectPkg);
+  if (opts.noInstall) {
+    bootstrapResult.warnings.push(
+      "_editor-bootstrap.tsx was generated without running npm install \u2014 node_modules may be stale. Run `npm run update-ampless` (without --no-install) to pick up newly added plugin editor extensions."
+    );
+    if (userPluginBump.bumped.length > 0) {
+      userPluginBump.warnings.push(
+        `package.json was updated with ${userPluginBump.bumped.length} bumped @ampless/* plugin version(s) but npm install was skipped \u2014 run \`npm install\` (or \`npm run update-ampless\` without --no-install) to apply the new versions.`
+      );
+    }
+  }
+  for (const w of bootstrapResult.warnings) {
+    log3.warn(w);
+  }
+  log3.info(
+    `editor:  ${pc3.cyan(`auto-wired ${bootstrapResult.pluginCount} editor extension(s) in _editor-bootstrap.tsx`)}`
+  );
+  if (userPluginBump.bumped.length > 0) {
+    log3.info(`plugins: ${pc3.cyan(`bumped ${userPluginBump.bumped.length} user-installed @ampless/* plugin(s) to latest @beta:`)}`);
+    for (const { name, from, to } of userPluginBump.bumped) {
+      log3.info(`  ${name}: ${from} \u2192 ${to}`);
+    }
+  }
+  for (const w of userPluginBump.warnings) {
+    log3.warn(w);
+  }
   return {
     added: replaceNew,
     updated: replaceUpdate,
@@ -2265,7 +2432,9 @@ async function runUpgradeIn(destDir, sharedDir, opts = {}) {
     themesPreserved: themeResult.preserved,
     themesQuarantined: themeResult.quarantined,
     packageJsonMerged: true,
-    obsoleteRemoved: obsoleteFiles
+    obsoleteRemoved: obsoleteFiles,
+    editorExtensionsWired: bootstrapResult.pluginCount,
+    userPluginsBumped: userPluginBump.bumped.length
   };
 }
 async function runUpgrade(args) {
@@ -2361,8 +2530,8 @@ async function runCopyTheme(args) {
   const source = args.copyThemeSource;
   const target = args.copyThemeTarget;
   if (!source || !target) {
-    log4.error("Usage: npx create-ampless@latest copy-theme <source> <target>");
-    log4.info("Example: npx create-ampless@latest copy-theme blog my-blog");
+    log4.error("Usage: npx create-ampless@beta copy-theme <source> <target>");
+    log4.info("Example: npx create-ampless@beta copy-theme blog my-blog");
     process.exit(1);
   }
   try {
@@ -2397,7 +2566,7 @@ import {
   cancel as cancel3
 } from "@clack/prompts";
 import pc5 from "picocolors";
-var SCAFFOLD_AMPLESS_VERSION = "1.0.0-alpha.22";
+var SCAFFOLD_AMPLESS_VERSION = "1.0.0-beta.0";
 var TEXT_EXTENSIONS3 = /* @__PURE__ */ new Set([
   ".json",
   ".md",
@@ -2648,7 +2817,7 @@ async function runCreatePlugin(args) {
     ${pc5.cyan("pnpm install")}
     ${pc5.cyan("pnpm test")}
     ${pc5.cyan("pnpm build")}
-    ${pc5.cyan("pnpm publish --access public --tag alpha")}
+    ${pc5.cyan("pnpm publish --access public --tag beta")}
 
   Then add the published package to your ampless site:
     ${pc5.cyan(`pnpm add ${result.packageName ?? result.pluginName}`)}`
@@ -2671,7 +2840,7 @@ var SECRETS_DIR = "amplify/secrets";
 var KEY_FILE = "encryption-key.ts";
 var KEY_FILE_PATH = `${SECRETS_DIR}/${KEY_FILE}`;
 function buildFileContent(keyB64) {
-  return `// Generated by \`npx create-ampless setup-encryption-key\`.
+  return `// Generated by \`npx create-ampless@beta setup-encryption-key\`.
 // AES-256-GCM key (32 bytes, base64) for plugin secret storage.
 // Rotate via the same CLI command. Existing ciphertext becomes unreadable on rotation.
 
@@ -2815,7 +2984,7 @@ async function runMount(args) {
   if (problem) {
     log7.error(problem);
     log7.info(
-      "Run `npx create-ampless@latest <name>` first to scaffold, or `cd` into a scaffolded project before passing --mount."
+      "Run `npx create-ampless@beta <name>` first to scaffold, or `cd` into a scaffolded project before passing --mount."
     );
     process.exit(1);
   }

package/dist/templates/_shared/README.ja.md

@@ -133,7 +133,7 @@ export default defineConfig({
 このプロジェクトディレクトリ内で:
 
 ```bash
-npx create-ampless@latest --mount \
+npx create-ampless@beta --mount \
   --github-owner <your-user-or-org> \
   --aws-region <region> \
   --create-iam-role           # 初回のみ。次回以降は `--iam-service-role <arn>` で使い回し
@@ -153,7 +153,7 @@ CLI が以下を一気に実行します:
 - `--skip-confirm` — 非対話モード（CI / 再実行向け）
 - `--aws-profile <name>` — 複数 AWS profile がある場合に明示
 
-全フラグは `npx create-ampless@latest --help` を参照。
+全フラグは `npx create-ampless@beta --help` を参照。
 
 **このフロー固有の事前準備（[トップの必要なもの](#必要なもの) に加えて）:**
 
@@ -216,13 +216,13 @@ MCP のセットアップとトークン管理の詳細については [docs/arc
 
 ## ampless の更新
 
-ampless は `alpha` dist-tag でリリースしています。新機能を取り込むには:
+public beta 中の ampless は `beta` dist-tag でリリースしています。新機能を取り込むには:
 
 ```bash
 npm run update-ampless
 ```
 
-これは `npx create-ampless@latest upgrade` を実行し、以下を行います:
+これは `npx create-ampless@beta upgrade` を実行し、以下を行います:
 
 - `package.json` の `@ampless/*` / `ampless` 依存をバージョンアップ
 - 共有テンプレートファイル（admin アプリの土台、amplify バックエンド、lib/、middleware、テーマ）を再同期 — `cms.config.ts`、`theme.*` 管理画面設定、投稿、テーマ manifest 値などのユーザーカスタマイズは保持されます

package/dist/templates/_shared/README.md

@@ -133,7 +133,7 @@ The shipped [`amplify.yml`](./amplify.yml) runs `npx ampx pipeline-deploy` (Ampl
 From inside this project directory:
 
 ```bash
-npx create-ampless@latest --mount \
+npx create-ampless@beta --mount \
   --github-owner <your-user-or-org> \
   --aws-region <region> \
   --create-iam-role           # first time only; reuse `--iam-service-role <arn>` on later mounts
@@ -153,7 +153,7 @@ Useful extra flags:
 - `--skip-confirm` — non-interactive (good for CI / re-runs)
 - `--aws-profile <name>` — explicit AWS profile when you have multiple
 
-See `npx create-ampless@latest --help` for the full list.
+See `npx create-ampless@beta --help` for the full list.
 
 **Prerequisites for this flow (in addition to the [top-level Requirements](#requirements)):**
 
@@ -216,13 +216,13 @@ See [docs/architecture/04-access-layer-mcp.md](./docs/architecture/04-access-lay
 
 ## Updating ampless
 
-ampless releases on the `alpha` dist-tag. To pick up new features:
+ampless releases on the `beta` dist-tag during the public beta. To pick up new features:
 
 ```bash
 npm run update-ampless
 ```
 
-This runs `npx create-ampless@latest upgrade`, which:
+This runs `npx create-ampless@beta upgrade`, which:
 
 - Bumps the `@ampless/*` and `ampless` dependencies in `package.json`
 - Re-syncs the shared template files (admin app shell, amplify backend, lib/, middleware, themes) — your customizations to `cms.config.ts`, `theme.*` admin settings, posts, and theme manifest values are preserved.

package/dist/templates/_shared/amplify/backend.ts

@@ -13,7 +13,7 @@ import { userAdmin } from './functions/user-admin/resource.js'
 import { pluginSecretHandler } from './functions/plugin-secret-handler/resource.js'
 import { customizeBackend } from './backend.custom.js'
 // Plugin secret encryption key (Phase 6a v2.2).
-// Generate with: npx create-ampless setup-encryption-key
+// Generate with: npx create-ampless@beta setup-encryption-key
 // The key lives in amplify/secrets/encryption-key.ts (gitignore it for
 // public repos; safe to commit for private repos).
 import { PLUGIN_SECRET_ENCRYPTION_KEY } from './secrets/encryption-key.js'

package/dist/templates/_shared/amplify/data/get-published-post.js

@@ -8,6 +8,13 @@ import { util } from '@aws-appsync/utils'
 //
 // Drafts are dropped in the response handler. If draft + published
 // somehow share a slug we prefer the published row.
+//
+// Scheduled-publish: a `published` post is visible only when its
+// publishedAt is absent (= immediate) OR <= now (= already live).
+// When publishedAt is present and in the future the post is treated as
+// "not yet live" and is hidden from the public site. This check is
+// server-authoritative: the AppSync resolver enforces it on every read
+// without relying on any client-side filtering.
 export function request(ctx) {
   const slug = ctx.args.slug
   return {
@@ -25,6 +32,11 @@ export function request(ctx) {
 export function response(ctx) {
   if (ctx.error) util.error(ctx.error.message, ctx.error.type)
   const items = ctx.result.items ?? []
-  const published = items.find((i) => i.status === 'published')
+  const now = util.time.nowISO8601()
+  // Hide a published post only when publishedAt exists AND is in the future
+  // (scheduled). Missing publishedAt = immediate publish.
+  const published = items.find(
+    (i) => i.status === 'published' && (!i.publishedAt || i.publishedAt <= now)
+  )
   return published ?? null
 }

package/dist/templates/_shared/amplify/data/list-posts-by-tag.js

@@ -9,14 +9,26 @@ import { util } from '@aws-appsync/utils'
 // the tag partition condition. Drafts never appear here because the
 // admin client only writes PostTag rows for posts whose status is
 // 'published'.
+//
+// Scheduled-publish: the SK is a composite of `${publishedAt}#${postId}`.
+// ISO 8601 timestamps are fixed-width to millisecond precision, so lexical
+// order == chronological order. We add an upper-bound SK condition
+// `<= now + '#' + '￿'` to exclude PostTag rows whose publishedAt is in
+// the future. U+FFFF sorts above every character that can appear in a real
+// postId, so `now#￿` is strictly greater than `now#<any-postId>`:
+// every postId suffix sharing the current-millisecond ISO prefix is
+// included, while any SK whose timestamp prefix is later is excluded.
+// (Written as an escape so this source file stays ASCII.)
 export function request(ctx) {
   const { tag, limit, nextToken } = ctx.args
+  const now = util.time.nowISO8601()
+  const upper = now + '#￿'
   return {
     operation: 'Query',
     query: {
-      expression: '#tag = :tag',
-      expressionNames: { '#tag': 'tag' },
-      expressionValues: util.dynamodb.toMapValues({ ':tag': tag }),
+      expression: '#tag = :tag AND #pap <= :upper',
+      expressionNames: { '#tag': 'tag', '#pap': 'publishedAtPostId' },
+      expressionValues: util.dynamodb.toMapValues({ ':tag': tag, ':upper': upper }),
     },
     scanIndexForward: false, // newest first (SK descends)
     limit: limit ?? 20,

package/dist/templates/_shared/amplify/data/list-published-posts.js

@@ -1,4 +1,4 @@
-import { util } from '@aws-appsync/utils'
+import { util, runtime } from '@aws-appsync/utils'
 
 // AppSync JS resolver: list published posts, newest first.
 //
@@ -8,29 +8,40 @@ import { util } from '@aws-appsync/utils'
 // so a single Query reads only the `published` partition. Drafts never
 // appear because the PK condition pins status='published'.
 //
+// Scheduled-publish: the upper bound of the SK range is always clamped
+// to `now`. This ensures future-dated published posts (scheduled but not
+// yet live) never appear in public listings. The upper bound is the lesser
+// of `now` and any caller-supplied `to` argument.
+//
+// Reverse-range guard: if `from` is supplied and ends up > upper (e.g.
+// the caller asks for a range entirely in the future), we return an empty
+// result early via `runtime.earlyReturn` instead of issuing an inverted
+// BETWEEN to DynamoDB (which DynamoDB rejects with a ValidationException).
+//
 // Date-range filtering (`from`, `to`) is pushed into the SK condition,
 // so DynamoDB only reads the matching range. `nextToken` paginates
 // without re-issuing a fresh query.
 export function request(ctx) {
   const { from, to, limit, nextToken } = ctx.args
+  const now = util.time.nowISO8601()
+  // Always clamp the upper bound to now so future-dated posts are excluded.
+  const upper = to && to < now ? to : now
+
+  // If `from` is later than `upper` the range is empty — skip the query
+  // rather than letting DynamoDB see an inverted BETWEEN / >= condition.
+  if (from && from > upper) {
+    return runtime.earlyReturn({ items: [], nextToken: null })
+  }
 
   let keyExpression = '#status = :status'
-  const expressionNames = { '#status': 'status' }
-  const expressionValueMap = { ':status': 'published' }
+  const expressionNames = { '#status': 'status', '#publishedAt': 'publishedAt' }
+  const expressionValueMap = { ':status': 'published', ':upper': upper }
 
-  if (from && to) {
-    keyExpression += ' AND #publishedAt BETWEEN :from AND :to'
-    expressionNames['#publishedAt'] = 'publishedAt'
-    expressionValueMap[':from'] = from
-    expressionValueMap[':to'] = to
-  } else if (from) {
-    keyExpression += ' AND #publishedAt >= :from'
-    expressionNames['#publishedAt'] = 'publishedAt'
+  if (from) {
+    keyExpression += ' AND #publishedAt BETWEEN :from AND :upper'
     expressionValueMap[':from'] = from
-  } else if (to) {
-    keyExpression += ' AND #publishedAt <= :to'
-    expressionNames['#publishedAt'] = 'publishedAt'
-    expressionValueMap[':to'] = to
+  } else {
+    keyExpression += ' AND #publishedAt <= :upper'
   }
 
   return {

package/dist/templates/_shared/amplify/events/dispatcher/handler.ts

@@ -1,4 +1,14 @@
 // Re-exported from @ampless/backend so the package can ship Lambda
 // handler updates via `npm update`. Amplify's esbuild follows this
 // import and bundles the real handler into the Lambda artifact.
-export { handler } from '@ampless/backend/events/dispatcher'
+//
+// The dispatcher now also captures per-post revision history. The
+// retention window comes from the user-side `cms.config` — the package
+// handler never imports `cms.config` directly (it can't know the project
+// layout), so this thin shell wires the value in via the factory.
+import { createDispatcherHandler } from '@ampless/backend/events/dispatcher'
+import config from '../../../cms.config'
+
+export const handler = createDispatcherHandler({
+  historyRetentionDays: config.history?.retentionDays ?? 0,
+})

package/dist/templates/_shared/amplify/secrets/encryption-key.ts

@@ -1,9 +1,9 @@
-// Generated by `npx create-ampless setup-encryption-key`.
+// Generated by `npx create-ampless@beta setup-encryption-key`.
 // AES-256-GCM key (32 bytes, base64) for plugin secret storage.
 // Rotate via the same CLI command. Existing ciphertext becomes unreadable on rotation.
 //
 // IMPORTANT: This is a placeholder. Replace the value below with a real key
-// by running: npx create-ampless setup-encryption-key
+// by running: npx create-ampless@beta setup-encryption-key
 // (from your project root, after scaffolding).
 
 export const PLUGIN_SECRET_ENCRYPTION_KEY = ''

package/dist/templates/_shared/app/(admin)/admin/_editor-bootstrap.tsx

@@ -0,0 +1,13 @@
+'use client'
+
+// Placeholder for fresh scaffolds before `update-ampless` runs.
+// `npm run update-ampless` rewrites this file with auto-wired plugin
+// editor extensions based on the project's installed `@ampless/plugin-*`
+// packages.
+
+import { installAdminEditorExtensions } from '@ampless/admin/editor'
+
+export function EditorBootstrap({ children }: { children: React.ReactNode }) {
+  installAdminEditorExtensions([])
+  return <>{children}</>
+}

package/dist/templates/_shared/app/(admin)/admin/layout.tsx

@@ -1,4 +1,5 @@
 import { admin } from '@/lib/admin'
 import { createAdminLayout } from '@ampless/admin/pages'
+import { EditorBootstrap } from './_editor-bootstrap'
 
-export default createAdminLayout(admin)
+export default createAdminLayout(admin, { editorBootstrap: EditorBootstrap })

package/dist/templates/_shared/app/(admin)/admin/preview/route.tsx

@@ -0,0 +1,4 @@
+import { admin } from '@/lib/admin'
+import { createPreviewRouteHandler } from '@ampless/admin/api'
+
+export const POST = createPreviewRouteHandler(admin)