create-ampless 0.2.0-alpha.2 → 0.2.0-alpha.5

package/README.md

@@ -28,6 +28,42 @@ npm run dev             # http://localhost:3000
 
 Sign up at `/login` — the first registered user is automatically promoted to the `ampless-admin` Cognito group.
 
+## One-shot deploy: `--deploy`
+
+The wizard can also take you all the way from `npx` to a live Amplify Hosting URL:
+
+```bash
+npx create-ampless@alpha my-site --deploy
+```
+
+That extra flag, after scaffolding, runs:
+
+1. `git init` + initial commit
+2. Create a GitHub repo (`gh repo create`) and push
+3. `aws amplify create-app` linked to the new repo
+4. `aws amplify create-branch main`
+5. `aws amplify start-job --job-type RELEASE`
+6. Optional `aws amplify create-domain-association` if you pass `--domain`
+
+Anything missing on the command line gets asked interactively. For CI-friendly fully-flagged usage:
+
+```bash
+npx create-ampless@alpha my-site --deploy \
+  --github-owner my-org \
+  --github-private \
+  --aws-region us-east-1 \
+  --domain example.com --subdomain blog \
+  --skip-confirm
+```
+
+If the apex domain is hosted in Route 53 in the same AWS account, Amplify will auto-create the DNS records once ACM validates. Otherwise the CLI prints the exact CNAMEs to add at your registrar.
+
+### Deploy requirements
+
+- [`gh`](https://cli.github.com/) installed and authenticated (`gh auth login`)
+- [`aws`](https://aws.amazon.com/cli/) installed and configured (`aws configure`)
+- A GitHub token with `repo` scope (resolved via `--github-token` → `GITHUB_TOKEN` env → `gh auth token` → interactive prompt)
+
 ## Requirements
 
 - Node.js >= 20

package/dist/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { spinner, outro, log } from "@clack/prompts";
+import { spinner as spinner2, outro, log as log3 } from "@clack/prompts";
 import { existsSync as existsSync2 } from "fs";
-import { resolve as resolve3 } from "path";
+import { resolve as resolve4 } from "path";
 
 // src/prompts.ts
 import * as p from "@clack/prompts";
@@ -191,36 +191,725 @@ async function scaffold(sharedDir, themesRoot, destDir, opts) {
   await substituteDir(destDir, vars);
 }
 
-// src/index.ts
+// src/args.ts
+var STRING_FLAGS = /* @__PURE__ */ new Set([
+  "--github-owner",
+  "--github-token",
+  "--aws-profile",
+  "--aws-region",
+  "--domain",
+  "--subdomain"
+]);
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+  "--deploy",
+  "--github-private",
+  "--skip-confirm",
+  "--help",
+  "-h"
+]);
+function parseDeployArgs(argv) {
+  const out = {
+    deploy: false,
+    githubPrivate: false,
+    skipConfirm: false,
+    help: false,
+    unknown: []
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const raw = argv[i];
+    let token = raw;
+    let inlineValue;
+    const eq = raw.indexOf("=");
+    if (raw.startsWith("--") && eq > 2) {
+      token = raw.slice(0, eq);
+      inlineValue = raw.slice(eq + 1);
+    }
+    if (BOOLEAN_FLAGS.has(token)) {
+      switch (token) {
+        case "--deploy":
+          out.deploy = true;
+          break;
+        case "--github-private":
+          out.githubPrivate = true;
+          break;
+        case "--skip-confirm":
+          out.skipConfirm = true;
+          break;
+        case "--help":
+        case "-h":
+          out.help = true;
+          break;
+      }
+      continue;
+    }
+    if (STRING_FLAGS.has(token)) {
+      const value = inlineValue ?? argv[++i];
+      if (value === void 0) {
+        throw new Error(`Missing value for ${token}`);
+      }
+      switch (token) {
+        case "--github-owner":
+          out.githubOwner = value;
+          break;
+        case "--github-token":
+          out.githubToken = value;
+          break;
+        case "--aws-profile":
+          out.awsProfile = value;
+          break;
+        case "--aws-region":
+          out.awsRegion = value;
+          break;
+        case "--domain":
+          out.domain = value;
+          break;
+        case "--subdomain":
+          out.subdomain = value;
+          break;
+      }
+      continue;
+    }
+    if (raw.startsWith("-")) {
+      out.unknown.push(raw);
+      continue;
+    }
+    if (out.projectName === void 0) {
+      out.projectName = raw;
+    } else {
+      out.unknown.push(raw);
+    }
+  }
+  return out;
+}
+var HELP_TEXT = `create-ampless \u2014 scaffold an ampless project
+
+Usage:
+  npx create-ampless@alpha <project-name> [options]
+
+Options:
+  --deploy                    Also create GitHub repo + Amplify Hosting app and
+                              kick off the first deploy after scaffolding
+  --github-owner <login>      GitHub owner (user or org). Defaults to the
+                              authenticated 'gh' user
+  --github-private            Create a private repo (default: public)
+  --github-token <token>      GitHub token. Falls back to GITHUB_TOKEN env,
+                              then 'gh auth token', then an interactive prompt
+  --aws-profile <profile>     AWS profile name to pass to the aws CLI
+  --aws-region <region>       AWS region (defaults to aws config / env)
+  --domain <name>             Custom domain (apex or subdomain) to attach
+  --subdomain <prefix>        Subdomain prefix for the domain (default: apex)
+  --skip-confirm              Don't ask 'proceed?' before running
+  -h, --help                  Show this message
+`;
+
+// src/deploy-prompts.ts
+import * as p2 from "@clack/prompts";
+import { execa as execa2 } from "execa";
+
+// src/deploy.ts
+import { execa } from "execa";
+import { writeFile as writeFile2 } from "fs/promises";
+import { resolve as resolve3 } from "path";
+import { spinner, log } from "@clack/prompts";
 import pc from "picocolors";
+var AMPLIFY_BUILD_SPEC = `version: 1
+frontend:
+  phases:
+    preBuild:
+      commands:
+        - npm ci
+    build:
+      commands:
+        - npx ampx pipeline-deploy --branch $AWS_BRANCH --app-id $AWS_APP_ID
+        - npm run build
+  artifacts:
+    baseDirectory: .next
+    files:
+      - '**/*'
+  cache:
+    paths:
+      - node_modules/**/*
+      - .next/cache/**/*
+`;
+async function resolveGithubToken(explicit, env = process.env) {
+  if (explicit && explicit.trim()) return explicit.trim();
+  const envToken = env.GITHUB_TOKEN;
+  if (envToken && envToken.trim()) return envToken.trim();
+  try {
+    const { stdout } = await execa("gh", ["auth", "token"], { reject: false });
+    const trimmed = stdout?.trim();
+    if (trimmed) return trimmed;
+  } catch {
+  }
+  return void 0;
+}
+function extractRegistrableDomain(domain) {
+  const labels = domain.replace(/\.$/, "").split(".");
+  if (labels.length <= 2) return labels.join(".");
+  const MULTI_PART_SUFFIXES = /* @__PURE__ */ new Set([
+    "co.uk",
+    "org.uk",
+    "me.uk",
+    "gov.uk",
+    "ac.uk",
+    "co.jp",
+    "ne.jp",
+    "or.jp",
+    "ac.jp",
+    "go.jp",
+    "ad.jp",
+    "gr.jp",
+    "lg.jp",
+    "com.au",
+    "net.au",
+    "org.au",
+    "edu.au",
+    "gov.au",
+    "co.nz",
+    "net.nz",
+    "org.nz",
+    "com.br",
+    "com.mx",
+    "com.cn",
+    "com.sg",
+    "com.hk",
+    "com.tw",
+    "co.kr",
+    "or.kr",
+    "co.in",
+    "co.id",
+    "co.za"
+  ]);
+  const lastTwo = labels.slice(-2).join(".");
+  if (MULTI_PART_SUFFIXES.has(lastTwo) && labels.length >= 3) {
+    return labels.slice(-3).join(".");
+  }
+  return lastTwo;
+}
+function splitDomain(domain, subdomain) {
+  const registrable = extractRegistrableDomain(domain);
+  if (subdomain !== void 0) {
+    return { registrable, subdomain };
+  }
+  if (domain === registrable) {
+    return { registrable, subdomain: "" };
+  }
+  const prefix = domain.slice(0, domain.length - registrable.length - 1);
+  return { registrable, subdomain: prefix };
+}
+async function run(cmd, args, opts = {}) {
+  const { step, ...execaOpts } = opts;
+  try {
+    const result = await execa(cmd, args, { stdio: "pipe", ...execaOpts });
+    return result.stdout?.toString() ?? "";
+  } catch (err) {
+    const e = err;
+    const detail = (e.stderr || e.stdout || e.shortMessage || e.message || String(err)).trim();
+    const prefix = step ? `${step}: ` : "";
+    throw new Error(`${prefix}${cmd} ${args.join(" ")}
+${detail}`);
+  }
+}
+async function ensureCommandExists(cmd) {
+  try {
+    await execa(cmd, ["--version"], { stdio: "ignore" });
+  } catch {
+    const hint = cmd === "gh" ? "Install with `brew install gh` (or see https://cli.github.com/) then run `gh auth login`." : "Install with `brew install awscli` (or see https://aws.amazon.com/cli/) then run `aws configure`.";
+    throw new Error(`Required command not found: ${cmd}
+${hint}`);
+  }
+}
+function awsArgs(opts, extra) {
+  const base = [];
+  if (opts.awsProfile) base.push("--profile", opts.awsProfile);
+  if (opts.awsRegion) base.push("--region", opts.awsRegion);
+  base.push(...extra);
+  base.push("--output", "json");
+  return base;
+}
+async function gitInitCommit(dir) {
+  await run("git", ["init", "-b", "main"], { cwd: dir, step: "git init" });
+  await run("git", ["add", "."], { cwd: dir, step: "git add" });
+  await run(
+    "git",
+    ["commit", "-m", "Initial scaffold (create-ampless)"],
+    { cwd: dir, step: "git commit" }
+  );
+}
+async function ghRepoCreate(opts) {
+  const visibility = opts.githubPrivate ? "--private" : "--public";
+  const name = `${opts.githubOwner}/${opts.projectName}`;
+  const out = await run(
+    "gh",
+    [
+      "repo",
+      "create",
+      name,
+      "--source",
+      opts.projectDir,
+      "--push",
+      visibility,
+      "--description",
+      "Created by create-ampless"
+    ],
+    {
+      cwd: opts.projectDir,
+      step: "gh repo create",
+      env: { ...process.env, GH_TOKEN: opts.githubToken }
+    }
+  );
+  const match = out.match(/https:\/\/github\.com\/[^\s]+/g);
+  if (match && match.length > 0) return match[match.length - 1].replace(/[.,]$/, "");
+  return `https://github.com/${name}`;
+}
+async function amplifyCreateApp(opts, repoUrl) {
+  const out = await run(
+    "aws",
+    awsArgs(opts, [
+      "amplify",
+      "create-app",
+      "--name",
+      opts.projectName,
+      "--repository",
+      repoUrl,
+      "--access-token",
+      opts.githubToken,
+      "--platform",
+      "WEB_COMPUTE",
+      "--build-spec",
+      AMPLIFY_BUILD_SPEC
+    ]),
+    { step: "aws amplify create-app" }
+  );
+  const parsed = JSON.parse(out);
+  const appId = parsed.app?.appId;
+  if (!appId) throw new Error("aws amplify create-app: missing app.appId in response");
+  return {
+    appId,
+    defaultDomain: parsed.app?.defaultDomain ?? "amplifyapp.com"
+  };
+}
+async function amplifyCreateBranch(opts, appId) {
+  await run(
+    "aws",
+    awsArgs(opts, [
+      "amplify",
+      "create-branch",
+      "--app-id",
+      appId,
+      "--branch-name",
+      "main",
+      "--stage",
+      "PRODUCTION"
+    ]),
+    { step: "aws amplify create-branch" }
+  );
+}
+async function amplifyStartJob(opts, appId) {
+  await run(
+    "aws",
+    awsArgs(opts, [
+      "amplify",
+      "start-job",
+      "--app-id",
+      appId,
+      "--branch-name",
+      "main",
+      "--job-type",
+      "RELEASE"
+    ]),
+    { step: "aws amplify start-job" }
+  );
+}
+async function findRoute53Zone(opts, registrable) {
+  try {
+    const out = await run(
+      "aws",
+      awsArgs(opts, [
+        "route53",
+        "list-hosted-zones-by-name",
+        "--dns-name",
+        registrable,
+        "--max-items",
+        "1"
+      ]),
+      { step: "aws route53 list-hosted-zones-by-name" }
+    );
+    const parsed = JSON.parse(out);
+    const zones = parsed.HostedZones ?? [];
+    for (const z of zones) {
+      if (z.Name && z.Name.replace(/\.$/, "") === registrable && z.Id) {
+        return z.Id.replace("/hostedzone/", "");
+      }
+    }
+  } catch {
+  }
+  return void 0;
+}
+async function amplifyCreateDomain(opts, appId) {
+  const { registrable, subdomain } = splitDomain(opts.domain, opts.subdomain);
+  const fullName = subdomain ? `${subdomain}.${registrable}` : registrable;
+  const route53Zone = await findRoute53Zone(opts, registrable);
+  if (route53Zone) {
+    log.info(
+      `Route 53 hosted zone detected for ${pc.cyan(registrable)} \u2014 Amplify will auto-create DNS records once ACM validates.`
+    );
+  }
+  const out = await run(
+    "aws",
+    awsArgs(opts, [
+      "amplify",
+      "create-domain-association",
+      "--app-id",
+      appId,
+      "--domain-name",
+      registrable,
+      "--sub-domain-settings",
+      `prefix=${subdomain},branchName=main`
+    ]),
+    { step: "aws amplify create-domain-association" }
+  );
+  const parsed = JSON.parse(out);
+  const verification = [];
+  const certRecord = parsed.domainAssociation?.certificateVerificationDNSRecord;
+  if (certRecord) {
+    const parts = certRecord.trim().split(/\s+/);
+    if (parts.length >= 3) {
+      verification.push({
+        cname: parts[0].replace(/\.$/, ""),
+        target: parts.slice(2).join(" ").replace(/\.$/, "")
+      });
+    }
+  }
+  for (const sd of parsed.domainAssociation?.subDomains ?? []) {
+    if (!sd.dnsRecord) continue;
+    const parts = sd.dnsRecord.trim().split(/\s+/);
+    if (parts.length >= 3) {
+      const prefix = sd.subDomainSetting?.prefix ?? "";
+      const cname = prefix ? `${prefix}.${registrable}` : registrable;
+      verification.push({
+        cname,
+        target: parts.slice(2).join(" ").replace(/\.$/, "")
+      });
+    }
+  }
+  return {
+    domainUrl: `https://${fullName}`,
+    verification: route53Zone ? void 0 : verification.length > 0 ? verification : void 0
+  };
+}
+async function runDeploy(opts) {
+  await ensureCommandExists("gh");
+  await ensureCommandExists("aws");
+  await writeFile2(resolve3(opts.projectDir, "amplify.yml"), AMPLIFY_BUILD_SPEC, "utf-8");
+  const created = {};
+  const fail = (step, cause) => {
+    const msg = cause instanceof Error ? cause.message : String(cause);
+    const cleanup = [];
+    if (created.appId) {
+      cleanup.push(
+        `  - Amplify app: ${created.appId} (delete: aws amplify delete-app --app-id ${created.appId}${opts.awsProfile ? ` --profile ${opts.awsProfile}` : ""}${opts.awsRegion ? ` --region ${opts.awsRegion}` : ""})`
+      );
+    }
+    if (created.repoUrl) {
+      cleanup.push(
+        `  - GitHub repo: ${created.repoUrl} (delete: gh repo delete ${opts.githubOwner}/${opts.projectName} --yes)`
+      );
+    }
+    const cleanupBlock = cleanup.length > 0 ? `
+Created so far:
+${cleanup.join("\n")}
+
+Re-run after cleaning up.` : "";
+    throw new Error(`Deploy failed at: ${step}
+${msg}${cleanupBlock}`);
+  };
+  let s = spinner();
+  s.start("git init + initial commit");
+  try {
+    await gitInitCommit(opts.projectDir);
+    s.stop("git: committed initial scaffold");
+  } catch (err) {
+    s.stop("git: failed");
+    fail("git init / commit", err);
+  }
+  s = spinner();
+  s.start("Creating GitHub repo + pushing");
+  try {
+    created.repoUrl = await ghRepoCreate(opts);
+    s.stop(`GitHub: ${created.repoUrl}`);
+  } catch (err) {
+    s.stop("GitHub: failed");
+    fail("gh repo create", err);
+  }
+  let app;
+  s = spinner();
+  s.start("Creating Amplify Hosting app");
+  try {
+    app = await amplifyCreateApp(opts, created.repoUrl);
+    created.appId = app.appId;
+    s.stop(`Amplify app: ${app.appId}`);
+  } catch (err) {
+    s.stop("Amplify create-app: failed");
+    return fail("aws amplify create-app", err);
+  }
+  s = spinner();
+  s.start("Creating main branch");
+  try {
+    await amplifyCreateBranch(opts, app.appId);
+    s.stop("Amplify branch: main");
+  } catch (err) {
+    s.stop("Amplify create-branch: failed");
+    fail("aws amplify create-branch", err);
+  }
+  s = spinner();
+  s.start("Starting first deployment");
+  try {
+    await amplifyStartJob(opts, app.appId);
+    s.stop("Amplify: first job started");
+  } catch (err) {
+    s.stop("Amplify start-job: failed");
+    fail("aws amplify start-job", err);
+  }
+  const amplifyAppUrl = `https://main.${app.appId}.${app.defaultDomain}`;
+  const result = {
+    githubRepoUrl: created.repoUrl,
+    amplifyAppId: app.appId,
+    amplifyAppUrl
+  };
+  if (opts.domain) {
+    s = spinner();
+    s.start(`Associating custom domain ${opts.domain}`);
+    try {
+      const dom = await amplifyCreateDomain(opts, app.appId);
+      result.domainUrl = dom.domainUrl;
+      result.domainVerification = dom.verification;
+      s.stop(`Custom domain queued: ${opts.domain}`);
+    } catch (err) {
+      s.stop("Custom domain: failed");
+      const msg = err instanceof Error ? err.message : String(err);
+      log.warn(`Custom domain step failed:
+${msg}`);
+    }
+  }
+  return result;
+}
+
+// src/deploy-prompts.ts
+async function detectGithubLogin() {
+  try {
+    const { stdout } = await execa2("gh", ["api", "user", "--jq", ".login"], { reject: false });
+    const trimmed = stdout?.trim();
+    return trimmed || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function detectAwsRegion() {
+  if (process.env.AWS_REGION?.trim()) return process.env.AWS_REGION.trim();
+  if (process.env.AWS_DEFAULT_REGION?.trim()) return process.env.AWS_DEFAULT_REGION.trim();
+  try {
+    const { stdout } = await execa2("aws", ["configure", "get", "region"], { reject: false });
+    const trimmed = stdout?.trim();
+    return trimmed || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function gatherDeployOptions(args, projectDir, projectName) {
+  p2.log.info("Configuring deploy (GitHub + Amplify Hosting)");
+  let githubOwner = args.githubOwner;
+  if (!githubOwner) {
+    const detected = await detectGithubLogin();
+    const answer = await p2.text({
+      message: "GitHub owner (user or org)",
+      placeholder: detected ?? "your-github-username",
+      defaultValue: detected ?? "",
+      validate: (v) => !v?.trim() ? "GitHub owner is required" : void 0
+    });
+    if (p2.isCancel(answer)) {
+      p2.cancel("Cancelled.");
+      return null;
+    }
+    githubOwner = answer.trim();
+  }
+  let githubPrivate = args.githubPrivate;
+  if (!args.githubPrivate) {
+    const choice = await p2.select({
+      message: "Repository visibility",
+      options: [
+        { value: "public", label: "Public" },
+        { value: "private", label: "Private" }
+      ],
+      initialValue: "public"
+    });
+    if (p2.isCancel(choice)) {
+      p2.cancel("Cancelled.");
+      return null;
+    }
+    githubPrivate = choice === "private";
+  }
+  let githubToken = await resolveGithubToken(args.githubToken);
+  if (!githubToken) {
+    const answer = await p2.password({
+      message: "GitHub token (needs `repo` scope) \u2014 or run `gh auth login` first",
+      validate: (v) => !v?.trim() ? "Token is required" : void 0
+    });
+    if (p2.isCancel(answer)) {
+      p2.cancel("Cancelled.");
+      return null;
+    }
+    githubToken = answer.trim();
+  }
+  let awsRegion = args.awsRegion;
+  if (!awsRegion) {
+    const detected = await detectAwsRegion();
+    const answer = await p2.text({
+      message: "AWS region",
+      placeholder: detected ?? "us-east-1",
+      defaultValue: detected ?? "us-east-1"
+    });
+    if (p2.isCancel(answer)) {
+      p2.cancel("Cancelled.");
+      return null;
+    }
+    awsRegion = answer.trim() || detected || "us-east-1";
+  }
+  let domain = args.domain;
+  let subdomain = args.subdomain;
+  if (!domain) {
+    const wantDomain = await p2.confirm({
+      message: "Attach a custom domain?",
+      initialValue: false
+    });
+    if (p2.isCancel(wantDomain)) {
+      p2.cancel("Cancelled.");
+      return null;
+    }
+    if (wantDomain) {
+      const dom = await p2.text({
+        message: "Domain (apex or subdomain, e.g. example.com or blog.example.com)",
+        validate: (v) => {
+          if (!v?.trim()) return "Domain is required";
+          if (!/^[a-z0-9.-]+\.[a-z]{2,}$/i.test(v.trim())) return "Looks invalid";
+        }
+      });
+      if (p2.isCancel(dom)) {
+        p2.cancel("Cancelled.");
+        return null;
+      }
+      domain = dom.trim();
+      if (!subdomain) {
+        const sub = await p2.text({
+          message: "Subdomain prefix (leave blank for apex)",
+          placeholder: "",
+          defaultValue: ""
+        });
+        if (p2.isCancel(sub)) {
+          p2.cancel("Cancelled.");
+          return null;
+        }
+        subdomain = sub.trim() || void 0;
+      }
+    }
+  }
+  if (!args.skipConfirm) {
+    const proceed = await p2.confirm({
+      message: `Proceed?
+  GitHub: ${githubOwner}/${projectName} (${githubPrivate ? "private" : "public"})
+  Region: ${awsRegion}` + (domain ? `
+  Domain: ${subdomain ? `${subdomain}.` : ""}${domain}` : ""),
+      initialValue: true
+    });
+    if (p2.isCancel(proceed) || !proceed) {
+      p2.cancel("Cancelled.");
+      return null;
+    }
+  }
+  return {
+    projectDir,
+    projectName,
+    githubOwner,
+    githubPrivate,
+    githubToken,
+    awsProfile: args.awsProfile,
+    awsRegion,
+    domain,
+    subdomain,
+    skipConfirm: args.skipConfirm
+  };
+}
+
+// src/index.ts
+import pc2 from "picocolors";
 async function main() {
-  const argProjectName = process.argv[2];
-  const opts = await runPrompts(argProjectName);
+  const args = parseDeployArgs(process.argv.slice(2));
+  if (args.help) {
+    process.stdout.write(HELP_TEXT);
+    return;
+  }
+  for (const flag of args.unknown) {
+    log3.warn(`Unknown argument ignored: ${flag}`);
+  }
+  const opts = await runPrompts(args.projectName);
   if (!opts) return;
-  const destDir = resolve3(process.cwd(), opts.projectName);
+  const destDir = resolve4(process.cwd(), opts.projectName);
   if (existsSync2(destDir)) {
-    log.error(`Directory already exists: ${destDir}`);
+    log3.error(`Directory already exists: ${destDir}`);
     process.exit(1);
   }
   const sharedDir = sharedTemplateDir();
-  const s = spinner();
+  const s = spinner2();
   s.start("Scaffolding project...");
   try {
     await scaffold(sharedDir, templatesDir, destDir, opts);
     s.stop("Done!");
   } catch (err) {
     s.stop("Failed.");
-    log.error(String(err));
+    log3.error(String(err));
     process.exit(1);
   }
+  if (args.deploy) {
+    const deployOpts = await gatherDeployOptions(args, destDir, opts.projectName);
+    if (!deployOpts) return;
+    try {
+      const result = await runDeploy(deployOpts);
+      const lines = [
+        `${pc2.green("\u2714")} Project deployed`,
+        ``,
+        `  GitHub:        ${pc2.cyan(result.githubRepoUrl)}`,
+        `  Amplify app:   ${pc2.cyan(result.amplifyAppId)}`,
+        `  Amplify URL:   ${pc2.cyan(result.amplifyAppUrl)}`
+      ];
+      if (result.domainUrl) {
+        lines.push(`  Custom domain: ${pc2.cyan(result.domainUrl)}`);
+      }
+      if (result.domainVerification && result.domainVerification.length > 0) {
+        lines.push("", `  ${pc2.bold("Add these DNS records to verify the domain:")}`);
+        for (const v of result.domainVerification) {
+          lines.push(`    ${v.cname}  CNAME  ${v.target}`);
+        }
+      }
+      lines.push(
+        "",
+        `  First build is now running in Amplify Hosting.`,
+        `  Watch it at ${pc2.cyan(`https://console.aws.amazon.com/amplify/home#/${result.amplifyAppId}`)}`
+      );
+      outro(lines.join("\n"));
+    } catch (err) {
+      log3.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+    return;
+  }
   outro(
-    `${pc.green("\u2714")} Project created at ${pc.bold(opts.projectName)}
+    `${pc2.green("\u2714")} Project created at ${pc2.bold(opts.projectName)}
 
   Next steps:
-    ${pc.cyan("cd")} ${opts.projectName}
-    ${pc.cyan("npm install")}
-    ${pc.cyan("npx ampx sandbox")}   ${pc.dim("# start Amplify backend")}
-    ${pc.cyan("npm run dev")}         ${pc.dim("# start Next.js")}`
+    ${pc2.cyan("cd")} ${opts.projectName}
+    ${pc2.cyan("npm install")}
+    ${pc2.cyan("npx ampx sandbox")}   ${pc2.dim("# start Amplify backend")}
+    ${pc2.cyan("npm run dev")}         ${pc2.dim("# start Next.js")}`
   );
 }
 main().catch((err) => {

package/dist/templates/_shared/amplify.yml

@@ -0,0 +1,18 @@
+version: 1
+frontend:
+  phases:
+    preBuild:
+      commands:
+        - npm ci
+    build:
+      commands:
+        - npx ampx pipeline-deploy --branch $AWS_BRANCH --app-id $AWS_APP_ID
+        - npm run build
+  artifacts:
+    baseDirectory: .next
+    files:
+      - '**/*'
+  cache:
+    paths:
+      - node_modules/**/*
+      - .next/cache/**/*

package/dist/templates/_shared/lib/amplify.ts

@@ -1,9 +1,20 @@
-// Back-compat shim. The Amplify SDK is now configured by the admin's
-// `<AdminProviders>` bootstrap (mounted by the layout factory in
-// `@ampless/admin/pages`), so most call sites no longer need to call
-// `configureAmplify()` themselves. Kept as a no-op so any lingering
-// `import '@/lib/amplify'` side-effect imports stay safe.
+// Client-side Amplify SDK setup. Imported as a side-effect from
+// `app/providers.tsx` so it runs on every page load (public + admin +
+// login). `<AdminProviders>` (mounted by the admin layout factory)
+// also performs this configuration, but it only runs for routes under
+// the (admin) group; `/login` is a top-level route outside that group
+// and would otherwise hit "Auth UserPool not configured" because no
+// AdminProviders has bootstrapped the SDK yet.
+//
+// `Amplify.configure` is idempotent — calling it once at the root and
+// again inside AdminProviders is harmless.
+
+import { Amplify } from 'aws-amplify'
+import outputs from '../amplify_outputs.json'
+
+Amplify.configure(outputs, { ssr: true })
 
 export function configureAmplify() {
-  // intentionally empty — admin bootstrap handles this
+  // module-level side effect above already ran; keep this as a no-op
+  // for callers that still import it as a function for back-compat.
 }

package/dist/templates/_shared/package.json

@@ -24,9 +24,9 @@
     "@ampless/plugin-rss": "^0.2.0-alpha.1",
     "@ampless/plugin-seo": "^0.2.0-alpha.1",
     "@ampless/plugin-webhook": "^0.2.0-alpha.1",
-    "@ampless/admin": "^0.2.0-alpha.1",
+    "@ampless/admin": "^0.2.0-alpha.5",
     "@ampless/backend": "^0.2.0-alpha.1",
-    "@ampless/runtime": "^0.2.0-alpha.1",
+    "@ampless/runtime": "^0.2.0-alpha.2",
     "@digital-go-jp/tailwind-theme-plugin": "^0.3.4",
     "ampless": "^0.2.0-alpha.1",
     "aws-amplify": "^6.10.0",

package/dist/templates/_shared/proxy.ts

@@ -10,7 +10,24 @@
 // forwarding, multi-site Cache-Control override.
 
 import cmsConfig from './cms.config'
-import { createAmplessMiddleware, defaultMatcherConfig } from '@ampless/runtime/middleware'
+import { createAmplessMiddleware } from '@ampless/runtime/middleware'
 
 export const proxy = createAmplessMiddleware({ cmsConfig })
-export const config = defaultMatcherConfig
+
+// Next.js 16's Turbopack requires `config` to be a statically
+// analysable object literal — referencing an imported variable
+// (e.g. `defaultMatcherConfig` from @ampless/runtime/middleware)
+// causes a build error:
+//   "Next.js can't recognize the exported `config` field in route.
+//    It needs to be a static object."
+//
+// So we inline the matcher here. If you change it, keep it in sync
+// with `defaultMatcherConfig` documented in @ampless/runtime/middleware.
+// The matcher excludes admin / api / login / static assets /
+// amplify_outputs.json so the public-site proxy doesn't rewrite
+// legitimate non-blog routes.
+export const config = {
+  matcher: [
+    '/((?!admin|api|login|_next/static|_next/image|favicon\\.ico|amplify_outputs\\.json).*)',
+  ],
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ampless",
-  "version": "0.2.0-alpha.2",
+  "version": "0.2.0-alpha.5",
   "description": "Create a new ampless project",
   "license": "MIT",
   "type": "module",
@@ -23,6 +23,7 @@
   "bugs": "https://github.com/heavymoons/ampless/issues",
   "dependencies": {
     "@clack/prompts": "^1.4.0",
+    "execa": "^9.6.1",
     "picocolors": "^1.1.1"
   },
   "keywords": [