create-ampless 1.0.0-beta.151 → 1.0.0-beta.154

package/dist/index.js

@@ -1916,8 +1916,15 @@ var AMPLESS_PACKAGES = /* @__PURE__ */ new Set([
   "@ampless/runtime"
 ]);
 var AMPLESS_MANAGED_TRANSITIVE_PREFIXES = ["@tiptap/"];
+var AMPLESS_MANAGED_EXACT_DEPS = /* @__PURE__ */ new Set([
+  "aws-amplify",
+  "@aws-amplify/adapter-nextjs",
+  "@aws-amplify/backend",
+  "@aws-amplify/backend-cli"
+]);
 function isManagedDep(name) {
   if (AMPLESS_PACKAGES.has(name)) return true;
+  if (AMPLESS_MANAGED_EXACT_DEPS.has(name)) return true;
   return AMPLESS_MANAGED_TRANSITIVE_PREFIXES.some((p3) => name.startsWith(p3));
 }
 var AMPLESS_MANAGED_SCRIPTS = /* @__PURE__ */ new Set([

package/dist/templates/_shared/amplify/auth/resource.custom.ts

@@ -0,0 +1,39 @@
+// Custom Cognito auth options for this project.
+//
+// `amplify/auth/resource.ts` spreads this object into
+// `amplessAuthConfig({ postConfirmation, ...authCustomizations })`, so
+// anything you set here overrides the ampless defaults.
+//
+// This file is NEVER overwritten by `create-ampless upgrade` —
+// `amplify/auth/resource.ts` is, so keep your auth customizations here.
+//
+// ── Passkeys (WebAuthn) ──────────────────────────────────────────────
+//
+// Passkeys are ENABLED BY DEFAULT (the empty object below). With the
+// default, Amplify auto-resolves the WebAuthn Relying Party ID from the
+// deployment domain, which works on Amplify Hosting domains and on a
+// `localhost` sandbox.
+//
+// If you serve the admin from a CUSTOM DOMAIN behind a CDN, the
+// auto-resolved RP ID won't match the URL the browser sees and passkey
+// sign-in fails with a `SecurityError`. Pin the RP ID to the bare
+// domain (no protocol, no path) the operators visit:
+//
+//   export const authCustomizations: Pick<AmplessAuthConfigOpts, 'webAuthn'> = {
+//     webAuthn: { relyingPartyId: 'admin.example.com' },
+//   }
+//
+// To turn passkeys off entirely (password-only sign-in):
+//
+//   export const authCustomizations: Pick<AmplessAuthConfigOpts, 'webAuthn'> = {
+//     webAuthn: false,
+//   }
+//
+// ⚠️ Changing the RP ID after operators have registered passkeys
+// invalidates every existing credential — they'll have to register
+// again from the account page. The password flow always stays available
+// as the fallback. See `docs/passkeys.md`.
+
+import type { AmplessAuthConfigOpts } from '@ampless/backend'
+
+export const authCustomizations: Pick<AmplessAuthConfigOpts, 'webAuthn'> = {}

package/dist/templates/_shared/amplify/auth/resource.ts

@@ -1,6 +1,7 @@
 import { defineAuth } from '@aws-amplify/backend'
 import { amplessAuthConfig } from '@ampless/backend'
 import { postConfirmation } from './post-confirmation/resource.js'
+import { authCustomizations } from './resource.custom.js'
 
 // Provisions a Cognito User Pool + Identity Pool with the three role
 // groups (ampless-admin, ampless-editor, ampless-reader) and wires in
@@ -10,4 +11,10 @@ import { postConfirmation } from './post-confirmation/resource.js'
 // `defineAuth` must be called from this file directly — Amplify Gen 2's
 // import-path verifier requires it to live at amplify/auth/resource.ts.
 // `amplessAuthConfig` just returns the props object.
-export const auth = defineAuth(amplessAuthConfig({ postConfirmation }))
+//
+// Per-site auth knobs (e.g. passkey Relying Party ID on a custom
+// domain) live in `resource.custom.ts` — that file is yours to edit and
+// is never overwritten by `update-ampless`.
+export const auth = defineAuth(
+  amplessAuthConfig({ postConfirmation, ...authCustomizations })
+)

package/dist/templates/_shared/app/(admin)/admin/account/page.tsx

@@ -0,0 +1,5 @@
+import { admin } from '@/lib/admin'
+import { createAccountPage } from '@ampless/admin/pages'
+
+export const dynamic = 'force-dynamic'
+export default createAccountPage(admin)

package/dist/templates/_shared/package.json

@@ -26,21 +26,21 @@
     "@tiptap/pm": "^3.23.6",
     "@tiptap/react": "^3.23.6",
     "@tiptap/starter-kit": "^3.23.6",
-    "@ampless/plugin-analytics-ga4": "^0.2.0-beta.35",
-    "@ampless/plugin-cookie-consent": "^0.1.0-beta.26",
-    "@ampless/plugin-gtm": "^0.2.0-beta.34",
-    "@ampless/plugin-og-image": "^0.2.0-beta.51",
-    "@ampless/plugin-plausible": "^0.2.0-beta.34",
-    "@ampless/plugin-reading-time": "^0.1.0-beta.24",
-    "@ampless/plugin-rss": "^0.2.0-beta.51",
-    "@ampless/plugin-schema-jsonld": "^0.1.1-beta.30",
-    "@ampless/plugin-seo": "^0.2.0-beta.51",
-    "@ampless/plugin-webhook": "^0.2.0-beta.52",
-    "@ampless/admin": "^1.0.0-beta.89",
-    "@ampless/backend": "^1.0.0-beta.74",
-    "@ampless/runtime": "^1.0.0-beta.60",
+    "@ampless/plugin-analytics-ga4": "^0.2.0-beta.36",
+    "@ampless/plugin-cookie-consent": "^0.1.0-beta.27",
+    "@ampless/plugin-gtm": "^0.2.0-beta.35",
+    "@ampless/plugin-og-image": "^0.2.0-beta.52",
+    "@ampless/plugin-plausible": "^0.2.0-beta.35",
+    "@ampless/plugin-reading-time": "^0.1.0-beta.25",
+    "@ampless/plugin-rss": "^0.2.0-beta.52",
+    "@ampless/plugin-schema-jsonld": "^0.1.1-beta.31",
+    "@ampless/plugin-seo": "^0.2.0-beta.52",
+    "@ampless/plugin-webhook": "^0.2.0-beta.53",
+    "@ampless/admin": "^1.0.0-beta.91",
+    "@ampless/backend": "^1.0.0-beta.76",
+    "@ampless/runtime": "^1.0.0-beta.61",
     "@digital-go-jp/tailwind-theme-plugin": "^0.3.4",
-    "ampless": "^1.0.0-beta.51",
+    "ampless": "^1.0.0-beta.52",
     "aws-amplify": "^6.17.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ampless",
-  "version": "1.0.0-beta.151",
+  "version": "1.0.0-beta.154",
   "description": "Create a new ampless project",
   "license": "MIT",
   "type": "module",