@ampless/backend 0.2.0-alpha.0 → 0.2.0-alpha.1

package/README.md

@@ -38,12 +38,15 @@ export default defineAmplessBackend({
 ### `amplify/auth/resource.ts`
 
 ```ts
-import { defineAmplessAuth } from '@ampless/backend'
+import { defineAuth } from '@aws-amplify/backend'
+import { amplessAuthConfig } from '@ampless/backend'
 import { postConfirmation } from './post-confirmation/resource'
 
-export const auth = defineAmplessAuth({ postConfirmation })
+export const auth = defineAuth(amplessAuthConfig({ postConfirmation }))
 ```
 
+> `defineAuth` must live in `amplify/auth/resource.ts` itself. Amplify Gen 2's import-path verifier inspects the call site of `defineAuth` / `defineData` / `defineStorage` and throws `Amplify Auth must be defined in amplify/auth/resource.ts` if it's invoked from any other file (including a `node_modules/@ampless/backend/...` wrapper). `amplessAuthConfig` returns the props object so you can call `defineAuth(...)` here without losing the ampless defaults.
+
 ### `amplify/data/resource.ts`
 
 ```ts
@@ -65,10 +68,13 @@ The three AppSync JS resolver files (`list-published-posts.js`, `get-published-p
 ### `amplify/storage/resource.ts`
 
 ```ts
-import { defineAmplessStorage } from '@ampless/backend'
-export const storage = defineAmplessStorage()
+import { defineStorage } from '@aws-amplify/backend'
+import { amplessStorageConfig } from '@ampless/backend'
+export const storage = defineStorage(amplessStorageConfig())
 ```
 
+> Same import-path verifier constraint as auth — `defineStorage` has to be called from this file directly. `amplessStorageConfig` returns the props object.
+
 ### Lambda thin shells
 
 Every handler file in `amplify/auth/`, `amplify/events/`, and `amplify/functions/` becomes a 1–3 line re-export. Amplify's esbuild follows the import into this package and bundles the real handler code into the Lambda artifact.
@@ -102,7 +108,7 @@ export { handler } from '@ampless/backend/functions/api-key-renewer'
 
 ## Sub-paths
 
-- `@ampless/backend` — `defineAmplessBackend`, `defineAmplessAuth`, `defineAmplessStorage`, `amplessSchemaModels`, `extendAmplessSchema`, `defaultAuthorizationModes`
+- `@ampless/backend` — `defineAmplessBackend`, `amplessAuthConfig`, `amplessStorageConfig`, `amplessSchemaModels`, `extendAmplessSchema`, `defaultAuthorizationModes`
 - `@ampless/backend/auth/post-confirmation` — Lambda handler
 - `@ampless/backend/events/dispatcher` — Lambda handler
 - `@ampless/backend/events/processor-trusted` — `createProcessorTrustedHandler({ plugins, site })`

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { defineData } from '@aws-amplify/backend';
+import { defineAuth, defineStorage, defineData } from '@aws-amplify/backend';
 
 type AuthResource = any;
 type DataResource = any;
@@ -44,7 +44,7 @@ type AmplessBackend = any;
  */
 declare function defineAmplessBackend(opts: DefineAmplessBackendOpts): AmplessBackend;
 
-interface DefineAmplessAuthOpts {
+interface AmplessAuthConfigOpts {
     /**
      * The `post-confirmation` Cognito Lambda trigger that promotes the
      * first signup to `ampless-admin`. Wire your own `defineFunction`
@@ -59,17 +59,35 @@ interface DefineAmplessAuthOpts {
     postConfirmation?: unknown;
 }
 /**
- * Provision the ampless Cognito User Pool / Identity Pool with the
- * three role groups and the optional post-confirmation trigger.
+ * Build the ampless Cognito configuration (User Pool + Identity Pool
+ * with the three role groups and the optional post-confirmation
+ * trigger) as a plain options object suitable for `defineAuth(...)`.
+ *
+ * Returning a config object — rather than calling `defineAuth`
+ * internally — keeps the actual `defineAuth` call inside the user's
+ * `amplify/auth/resource.ts`. Amplify Gen 2's import-path verifier
+ * (`@aws-amplify/backend-auth/lib/factory.js`) inspects the second
+ * stack frame and requires the call site to live at
+ * `amplify/auth/resource.ts`; routing through this package fails
+ * that check.
  *
  * Public reads use AppSync's API key (not the guest Identity Pool
  * role) because `a.handler.custom` doesn't accept `allow.guest()`
  * in Amplify Gen 2 — see `data/resource.ts` and the RUNBOOK.
+ *
+ * Usage:
+ *
+ *     // amplify/auth/resource.ts
+ *     import { defineAuth } from '@aws-amplify/backend'
+ *     import { amplessAuthConfig } from '@ampless/backend'
+ *     import { postConfirmation } from './post-confirmation/resource.js'
+ *     export const auth = defineAuth(amplessAuthConfig({ postConfirmation }))
  */
-declare function defineAmplessAuth(opts?: DefineAmplessAuthOpts): any;
+declare function amplessAuthConfig(opts?: AmplessAuthConfigOpts): Parameters<typeof defineAuth>[0];
 
 /**
- * Provision the ampless S3 bucket with the standard access map:
+ * Build the ampless S3 bucket configuration as a plain options object
+ * suitable for `defineStorage(...)`. Access map:
  *   - `public/media/*`   — guest read, admin/editor full
  *   - `public/plugins/*` — guest read, admin full
  *
@@ -77,12 +95,22 @@ declare function defineAmplessAuth(opts?: DefineAmplessAuthOpts): any;
  * `public/site-settings/*`) are applied by `defineAmplessBackend`
  * after `defineBackend` runs.
  *
- * Return type is `unknown` because Amplify's storage construct type
- * carries internal pnpm paths that don't survive declaration emit —
- * the resulting `storage` resource flows into `defineAmplessBackend`
- * unchanged.
+ * Returning a config object — rather than calling `defineStorage`
+ * internally — keeps the actual `defineStorage` call inside the
+ * user's `amplify/storage/resource.ts`. Amplify Gen 2's import-path
+ * verifier (`@aws-amplify/backend-storage/lib/factory.js`) inspects
+ * the second stack frame and requires the call site to live at
+ * `amplify/storage/resource.ts`; routing through this package fails
+ * that check.
+ *
+ * Usage:
+ *
+ *     // amplify/storage/resource.ts
+ *     import { defineStorage } from '@aws-amplify/backend'
+ *     import { amplessStorageConfig } from '@ampless/backend'
+ *     export const storage = defineStorage(amplessStorageConfig())
  */
-declare function defineAmplessStorage(): any;
+declare function amplessStorageConfig(): Parameters<typeof defineStorage>[0];
 
 interface AmplessResolverPaths {
     listPublishedPosts: string;
@@ -155,4 +183,4 @@ declare function extendAmplessSchema(a: any, custom?: Record<string, any>, opts?
  */
 declare const defaultAuthorizationModes: Parameters<typeof defineData>[0]['authorizationModes'];
 
-export { type AmplessBackend, type AmplessResolverPaths, type AmplessSchemaModelsOpts, DEFAULT_RESOLVER_PATHS, type DefineAmplessAuthOpts, type DefineAmplessBackendOpts, amplessSchemaModels, defaultAuthorizationModes, defineAmplessAuth, defineAmplessBackend, defineAmplessStorage, extendAmplessSchema };
+export { type AmplessAuthConfigOpts, type AmplessBackend, type AmplessResolverPaths, type AmplessSchemaModelsOpts, DEFAULT_RESOLVER_PATHS, type DefineAmplessBackendOpts, amplessAuthConfig, amplessSchemaModels, amplessStorageConfig, defaultAuthorizationModes, defineAmplessBackend, extendAmplessSchema };

package/dist/index.js

@@ -153,9 +153,8 @@ function defineAmplessBackend(opts) {
 }
 
 // src/auth/index.ts
-import { defineAuth } from "@aws-amplify/backend";
-function defineAmplessAuth(opts = {}) {
-  return defineAuth({
+function amplessAuthConfig(opts = {}) {
+  return {
     loginWith: {
       email: true
     },
@@ -164,13 +163,12 @@ function defineAmplessAuth(opts = {}) {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       { postConfirmation: opts.postConfirmation }
     ) : void 0
-  });
+  };
 }
 
 // src/storage/index.ts
-import { defineStorage } from "@aws-amplify/backend";
-function defineAmplessStorage() {
-  return defineStorage({
+function amplessStorageConfig() {
+  return {
     name: "amplessMedia",
     access: (allow) => ({
       "public/media/*": [
@@ -182,7 +180,7 @@ function defineAmplessStorage() {
         allow.groups(["ampless-admin"]).to(["read", "write", "delete"])
       ]
     })
-  });
+  };
 }
 
 // src/data/index.ts
@@ -384,10 +382,10 @@ var defaultAuthorizationModes = {
 };
 export {
   DEFAULT_RESOLVER_PATHS,
+  amplessAuthConfig,
   amplessSchemaModels,
+  amplessStorageConfig,
   defaultAuthorizationModes,
-  defineAmplessAuth,
   defineAmplessBackend,
-  defineAmplessStorage,
   extendAmplessSchema
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "0.2.0-alpha.0",
+  "version": "0.2.0-alpha.1",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -48,11 +48,11 @@
     "@aws-sdk/client-appsync": "^3.717.0",
     "@aws-sdk/client-cognito-identity-provider": "^3.717.0",
     "@aws-sdk/client-dynamodb": "^3.717.0",
-    "@aws-sdk/client-s3": "^3.717.0",
+    "@aws-sdk/client-s3": "^3.1048.0",
     "@aws-sdk/client-sqs": "^3.717.0",
     "@aws-sdk/lib-dynamodb": "^3.717.0",
     "@aws-sdk/util-dynamodb": "^3.717.0",
-    "ampless": "0.2.0-alpha.0"
+    "ampless": "0.2.0-alpha.1"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1",