create-ampless 0.2.0-alpha.3 → 0.2.0-alpha.30

package/dist/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { spinner, outro, log } from "@clack/prompts";
-import { existsSync as existsSync2 } from "fs";
-import { resolve as resolve3 } from "path";
+import { spinner as spinner2, outro as outro3, log as log5 } from "@clack/prompts";
+import { existsSync as existsSync7 } from "fs";
+import { basename as basename3, resolve as resolve5 } from "path";
 
 // src/prompts.ts
 import * as p from "@clack/prompts";
@@ -28,7 +28,10 @@ async function runPrompts(argProjectName) {
       // Multiple themes can ship side-by-side. The first selected is the
       // default active theme; admins can switch per-site at runtime. Add
       // / remove themes later by editing themes-registry.ts and
-      // themes/<name>/.
+      // themes/<name>/. Initial values pick every shipped theme so the
+      // shared `themes-registry.ts` placeholder (which imports all of
+      // them) compiles out of the box; deselect any the project won't
+      // need before confirming.
       themes: () => p.multiselect({
         message: "Themes to install (space to toggle)",
         options: [
@@ -39,7 +42,7 @@ async function runPrompts(argProjectName) {
           { value: "docs", label: "Docs \u2014 sidebar-led docs (tag-driven sections)" },
           { value: "dads", label: "DADS \u2014 Digital Agency Design System (Japanese government style)" }
         ],
-        initialValues: ["blog"],
+        initialValues: ["blog", "minimal", "landing", "corporate", "docs", "dads"],
         required: true
       }),
       plugins: () => p.multiselect({
@@ -83,8 +86,8 @@ async function runPrompts(argProjectName) {
 }
 
 // src/scaffold.ts
-import { cp, readFile, writeFile, readdir, mkdir, rm } from "fs/promises";
-import { join, extname, resolve as resolve2 } from "path";
+import { cp, readFile, writeFile, readdir as readdir2, mkdir, rm } from "fs/promises";
+import { join as join2, extname, resolve as resolve2 } from "path";
 
 // src/templates.ts
 import { existsSync } from "fs";
@@ -104,6 +107,100 @@ function templatePath(theme) {
   return resolve(templatesDir, theme);
 }
 
+// src/gitignore.ts
+var DEFAULT_GITIGNORE = `# Dependencies
+node_modules/
+
+# Next.js
+.next/
+next-env.d.ts
+
+# Amplify
+.amplify/
+amplify_outputs.json
+
+# TypeScript build artifacts
+*.tsbuildinfo
+
+# Env / OS noise
+.env
+.env.local
+.env.*.local
+.DS_Store
+
+# Logs
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Editor
+.vscode/
+.idea/
+`;
+
+// src/themes-registry.ts
+import { readdir } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import { join } from "path";
+var CUSTOM_THEME_PREFIX = "my-";
+function toIdentifier(themeName) {
+  if (!themeName.includes("-")) return themeName;
+  return themeName.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
+}
+function isCustomTheme(themeName) {
+  return themeName.startsWith(CUSTOM_THEME_PREFIX);
+}
+async function discoverInstalledThemes(destDir) {
+  const themesDir = join(destDir, "themes");
+  if (!existsSync2(themesDir)) return [];
+  const entries = await readdir(themesDir, { withFileTypes: true });
+  return entries.filter((e) => e.isDirectory()).map((e) => e.name);
+}
+function buildRegistry(themes) {
+  const sorted = [...themes].sort((a, b) => {
+    const ca = isCustomTheme(a);
+    const cb = isCustomTheme(b);
+    if (ca !== cb) return ca ? 1 : -1;
+    return a.localeCompare(b);
+  });
+  const imports = sorted.map((t) => `import ${toIdentifier(t)} from '@/themes/${t}'`).join("\n");
+  const map = sorted.map((t) => {
+    const id = toIdentifier(t);
+    return id === t ? `  ${t},` : `  '${t}': ${id},`;
+  }).join("\n");
+  const fallback = sorted[0] ?? "blog";
+  return `// Generated by create-ampless. Lists every theme installed under
+// \`themes/<name>/\`. Auto-managed: \`create-ampless upgrade\` and
+// \`copy-theme\` regenerate this file from the directories present
+// under \`themes/\`. Edits made by hand will survive only until the
+// next upgrade.
+//
+// \`theme.active\` (per-site, in KvStore) picks which theme renders for
+// each request; everything listed here gets bundled so switching is
+// instant. Custom themes use the \`${CUSTOM_THEME_PREFIX}\` prefix and
+// are never touched by upgrade \u2014 clone an ampless default theme into
+// a \`${CUSTOM_THEME_PREFIX}<name>\` directory via \`copy-theme\` before
+// modifying it.
+
+${imports}
+
+export const themes = {
+${map}
+} as const
+
+export type ThemeName = keyof typeof themes
+
+export const themeList = Object.values(themes)
+
+/**
+ * Default theme used when a site has no \`theme.active\` override.
+ * Falls back to the first registered theme so an empty registry would
+ * still surface a clear runtime error rather than silent breakage.
+ */
+export const DEFAULT_THEME: ThemeName = (themeList[0]?.name as ThemeName) ?? '${fallback}'
+`;
+}
+
 // src/scaffold.ts
 var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".json",
@@ -131,10 +228,10 @@ async function substituteFile(filePath, vars) {
   if (replaced !== content) await writeFile(filePath, replaced, "utf-8");
 }
 async function substituteDir(dirPath, vars) {
-  const entries = await readdir(dirPath, { withFileTypes: true });
+  const entries = await readdir2(dirPath, { withFileTypes: true });
   await Promise.all(
     entries.map(async (entry) => {
-      const fullPath = join(dirPath, entry.name);
+      const fullPath = join2(dirPath, entry.name);
       if (entry.isDirectory()) {
         await substituteDir(fullPath, vars);
       } else {
@@ -143,30 +240,6 @@ async function substituteDir(dirPath, vars) {
     })
   );
 }
-function buildRegistry(themes) {
-  const imports = themes.map((t) => `import ${t} from '@/themes/${t}'`).join("\n");
-  const map = themes.map((t) => `  ${t},`).join("\n");
-  return `// Generated by create-ampless. Lists every theme installed under
-// \`themes/<name>/\`. Adding a theme = drop a directory under themes/,
-// add an import + map entry below, and redeploy.
-//
-// \`theme.active\` (per-site, in KvStore) picks which theme renders for
-// each request; everything listed here gets bundled so switching is
-// instant.
-
-${imports}
-
-export const themes = {
-${map}
-} as const
-
-export type ThemeName = keyof typeof themes
-
-export const themeList = Object.values(themes)
-
-export const DEFAULT_THEME: ThemeName = (themeList[0]?.name as ThemeName) ?? '${themes[0]}'
-`;
-}
 async function scaffold(sharedDir, themesRoot, destDir, opts) {
   await cp(sharedDir, destDir, { recursive: true });
   const destThemesDir = resolve2(destDir, "themes");
@@ -180,6 +253,8 @@ async function scaffold(sharedDir, themesRoot, destDir, opts) {
   void themesRoot;
   const registryPath = resolve2(destDir, "themes-registry.ts");
   await writeFile(registryPath, buildRegistry(opts.themes), "utf-8");
+  const gitignorePath = resolve2(destDir, ".gitignore");
+  await writeFile(gitignorePath, DEFAULT_GITIGNORE, "utf-8");
   const vars = {
     projectName: opts.projectName,
     siteName: opts.siteName,
@@ -191,36 +266,2085 @@ async function scaffold(sharedDir, themesRoot, destDir, opts) {
   await substituteDir(destDir, vars);
 }
 
-// src/index.ts
+// src/args.ts
+var VALID_THEMES = ["blog", "minimal", "landing", "corporate", "docs", "dads"];
+var VALID_PLUGINS = ["seo", "rss", "webhook"];
+var STRING_FLAGS = /* @__PURE__ */ new Set([
+  "--site-name",
+  "--themes",
+  "--plugins",
+  "--github-owner",
+  "--github-token",
+  "--aws-profile",
+  "--aws-region",
+  "--domain",
+  "--subdomain",
+  "--iam-service-role"
+]);
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+  "--deploy",
+  "--mount",
+  "--upgrade",
+  "--dry-run",
+  "--no-install",
+  "--github-private",
+  "--create-iam-role",
+  "--skip-confirm",
+  "--help",
+  "-h"
+]);
+function parseDeployArgs(argv) {
+  const out = {
+    deploy: false,
+    mount: false,
+    upgrade: false,
+    copyTheme: false,
+    dryRun: false,
+    noInstall: false,
+    githubPrivate: false,
+    createIamRole: false,
+    skipConfirm: false,
+    help: false,
+    unknown: []
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const raw = argv[i];
+    let token = raw;
+    let inlineValue;
+    const eq = raw.indexOf("=");
+    if (raw.startsWith("--") && eq > 2) {
+      token = raw.slice(0, eq);
+      inlineValue = raw.slice(eq + 1);
+    }
+    if (BOOLEAN_FLAGS.has(token)) {
+      switch (token) {
+        case "--deploy":
+          out.deploy = true;
+          break;
+        case "--mount":
+          out.mount = true;
+          break;
+        case "--upgrade":
+          out.upgrade = true;
+          break;
+        case "--dry-run":
+          out.dryRun = true;
+          break;
+        case "--no-install":
+          out.noInstall = true;
+          break;
+        case "--github-private":
+          out.githubPrivate = true;
+          break;
+        case "--create-iam-role":
+          out.createIamRole = true;
+          break;
+        case "--skip-confirm":
+          out.skipConfirm = true;
+          break;
+        case "--help":
+        case "-h":
+          out.help = true;
+          break;
+      }
+      continue;
+    }
+    if (STRING_FLAGS.has(token)) {
+      const value = inlineValue ?? argv[++i];
+      if (value === void 0) {
+        throw new Error(`Missing value for ${token}`);
+      }
+      switch (token) {
+        case "--site-name":
+          out.siteName = value;
+          break;
+        case "--themes": {
+          const themes = value.split(",").map((t) => t.trim()).filter(Boolean);
+          const invalid = themes.filter((t) => !VALID_THEMES.includes(t));
+          if (invalid.length > 0) {
+            throw new Error(
+              `Invalid theme(s): ${invalid.join(", ")}. Valid values: ${VALID_THEMES.join(", ")}`
+            );
+          }
+          out.themes = themes;
+          break;
+        }
+        case "--plugins": {
+          const plugins = value.split(",").map((p3) => p3.trim()).filter(Boolean);
+          const invalid = plugins.filter((p3) => !VALID_PLUGINS.includes(p3));
+          if (invalid.length > 0) {
+            throw new Error(
+              `Invalid plugin(s): ${invalid.join(", ")}. Valid values: ${VALID_PLUGINS.join(", ")}`
+            );
+          }
+          out.plugins = plugins;
+          break;
+        }
+        case "--github-owner":
+          out.githubOwner = value;
+          break;
+        case "--github-token":
+          out.githubToken = value;
+          break;
+        case "--aws-profile":
+          out.awsProfile = value;
+          break;
+        case "--aws-region":
+          out.awsRegion = value;
+          break;
+        case "--domain":
+          out.domain = value;
+          break;
+        case "--subdomain":
+          out.subdomain = value;
+          break;
+        case "--iam-service-role":
+          out.iamServiceRole = value;
+          break;
+      }
+      continue;
+    }
+    if (raw.startsWith("-")) {
+      out.unknown.push(raw);
+      continue;
+    }
+    if (raw === "upgrade" && out.projectName === void 0) {
+      out.upgrade = true;
+      continue;
+    }
+    if (raw === "copy-theme" && out.projectName === void 0 && !out.copyTheme) {
+      out.copyTheme = true;
+      continue;
+    }
+    if (out.copyTheme && out.copyThemeSource === void 0) {
+      out.copyThemeSource = raw;
+      continue;
+    }
+    if (out.copyTheme && out.copyThemeTarget === void 0) {
+      out.copyThemeTarget = raw;
+      continue;
+    }
+    if (out.projectName === void 0) {
+      out.projectName = raw;
+    } else {
+      out.unknown.push(raw);
+    }
+  }
+  return out;
+}
+var HELP_TEXT = `create-ampless \u2014 scaffold an ampless project
+
+Usage:
+  npx create-ampless@latest <project-name> [options]
+  npx create-ampless@latest --mount [options]    # in an existing project dir
+  npx create-ampless@latest upgrade [options]    # in an existing project dir
+
+Options:
+  --site-name <name>          Site display name (default: "My Blog")
+  --themes <list>             Comma-separated theme names to install
+                              Valid: blog, minimal, landing, corporate, docs, dads
+                              (default: blog)
+  --plugins <list>            Comma-separated plugin names to install
+                              Valid: seo, rss, webhook
+                              (default: seo)
+  --deploy                    Also create GitHub repo + Amplify Hosting app and
+                              kick off the first deploy after scaffolding
+  --mount                     Skip scaffolding and mount the CURRENT directory
+                              onto a new GitHub repo + Amplify Hosting app.
+                              Use after you've scaffolded and tested locally
+                              with 'npx ampx sandbox' and now want to publish.
+                              Implies --deploy. Scaffold flags (--site-name,
+                              --themes, --plugins) are ignored.
+  --github-owner <login>      GitHub owner (user or org). Defaults to the
+                              authenticated 'gh' user
+  --github-private            Create a private repo (default: public)
+  --github-token <token>      GitHub token. Falls back to GITHUB_TOKEN env,
+                              then 'gh auth token', then an interactive prompt
+  --aws-profile <profile>     AWS profile name to pass to the aws CLI
+  --aws-region <region>       AWS region (defaults to aws config / env)
+  --domain <name>             Custom domain (apex or subdomain) to attach
+  --subdomain <prefix>        Subdomain prefix for the domain (default: apex)
+  --iam-service-role <arn>    Existing IAM role for Amplify Hosting (must trust
+                              amplify.amazonaws.com and have
+                              AdministratorAccess-Amplify attached)
+  --create-iam-role           Let create-ampless provision the Amplify Hosting
+                              service role (idempotent; defaults to role name
+                              AmplifyDeployBackend)
+  --skip-confirm              Skip all interactive prompts and use defaults /
+                              flag values (for CI / automation)
+  -h, --help                  Show this message
+
+upgrade  Sync ampless package files / deps to latest alpha.
+         Run inside an existing ampless project.
+
+  --dry-run                   Show what would change without writing any files
+  --no-install                Skip running pnpm/npm install after updating
+                              package.json
+
+copy-theme <source> <target>
+         Copy a theme so the original stays managed by ampless and
+         customisations live in the copy. Target must start with "my-"
+         (the convention that flags it as user-owned, so upgrade leaves
+         it alone). Run inside an existing ampless project.
+
+         Example: npx create-ampless@latest copy-theme blog my-blog
+`;
+
+// src/deploy-prompts.ts
+import * as p2 from "@clack/prompts";
+import { execa as execa3 } from "execa";
+
+// src/deploy.ts
+import { execa as execa2 } from "execa";
+import { existsSync as existsSync4 } from "fs";
+import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { basename as basename2, resolve as resolve4 } from "path";
+import { spinner, log } from "@clack/prompts";
+import pc2 from "picocolors";
+
+// src/preflight.ts
+import { execa } from "execa";
+import { basename } from "path";
 import pc from "picocolors";
+var DEFAULT_AMPLIFY_ROLE_NAME = "AmplifyDeployBackend";
+var AMPLIFY_BACKEND_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess-Amplify";
+var TRUST_POLICY_JSON = JSON.stringify({
+  Version: "2012-10-17",
+  Statement: [
+    {
+      Effect: "Allow",
+      Principal: { Service: "amplify.amazonaws.com" },
+      Action: "sts:AssumeRole"
+    }
+  ]
+});
+async function tryExec(cmd, args) {
+  try {
+    const r = await execa(cmd, args, { reject: false, stdio: "pipe" });
+    return {
+      exitCode: r.exitCode ?? 0,
+      stdout: r.stdout?.toString() ?? "",
+      stderr: r.stderr?.toString() ?? ""
+    };
+  } catch (err) {
+    const e = err;
+    return {
+      exitCode: 1,
+      stdout: e.stdout ?? "",
+      stderr: e.stderr ?? e.message ?? String(err)
+    };
+  }
+}
+function awsBaseArgs(opts) {
+  const out = [];
+  if (opts.awsProfile) out.push("--profile", opts.awsProfile);
+  if (opts.awsRegion) out.push("--region", opts.awsRegion);
+  return out;
+}
+function awsCmd(opts, extra) {
+  return [...awsBaseArgs(opts), ...extra, "--output", "json"];
+}
+function shortName(opts) {
+  return basename(opts.projectDir);
+}
+async function checkGhInstalled(problems) {
+  const r = await tryExec("gh", ["--version"]);
+  if (r.exitCode !== 0) {
+    problems.push({
+      id: "gh-not-installed",
+      message: "GitHub CLI (`gh`) is not installed.",
+      remediation: [
+        "Install it (macOS: `brew install gh`; other OS: https://cli.github.com/),",
+        "then run `gh auth login` to sign in."
+      ]
+    });
+    return false;
+  }
+  return true;
+}
+async function checkGhAuth(problems) {
+  const r = await tryExec("gh", ["auth", "status"]);
+  const combined = `${r.stdout}
+${r.stderr}`;
+  if (r.exitCode !== 0 || /not logged in/i.test(combined)) {
+    problems.push({
+      id: "gh-not-authenticated",
+      message: "GitHub CLI is not authenticated.",
+      remediation: ["Run `gh auth login` and choose a method that includes the `repo` scope."]
+    });
+    return false;
+  }
+  const scopesMatch = combined.match(/Token scopes?:\s*([^\n]+)/i);
+  if (!scopesMatch) {
+    problems.push({
+      id: "gh-scopes-unknown",
+      message: "Could not determine GitHub token scopes from `gh auth status`.",
+      remediation: ["Run `gh auth refresh -s repo` to ensure the `repo` scope is granted."]
+    });
+    return false;
+  }
+  const hasRepo = /(^|[^a-z])repo([^a-z]|$)/i.test(scopesMatch[1]);
+  if (!hasRepo) {
+    problems.push({
+      id: "gh-missing-repo-scope",
+      message: "GitHub token is missing the `repo` scope.",
+      remediation: ["Run `gh auth refresh -s repo` to add the `repo` scope to your token."]
+    });
+    return false;
+  }
+  return true;
+}
+async function checkAwsInstalled(problems) {
+  const r = await tryExec("aws", ["--version"]);
+  if (r.exitCode !== 0) {
+    problems.push({
+      id: "aws-not-installed",
+      message: "AWS CLI (`aws`) is not installed.",
+      remediation: [
+        "Install it (macOS: `brew install awscli`; other OS: https://aws.amazon.com/cli/),",
+        "then run `aws configure` to set credentials."
+      ]
+    });
+    return false;
+  }
+  return true;
+}
+async function checkAwsCreds(opts, problems) {
+  const r = await tryExec("aws", [...awsBaseArgs(opts), "sts", "get-caller-identity", "--output", "json"]);
+  if (r.exitCode !== 0) {
+    problems.push({
+      id: "aws-credentials-missing",
+      message: "AWS credentials are not configured (sts get-caller-identity failed).",
+      remediation: [
+        "Run `aws configure` (or set AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN),",
+        opts.awsProfile ? `or check that profile \`${opts.awsProfile}\` exists in ~/.aws/config.` : "or pass --aws-profile <name> if you use named profiles."
+      ]
+    });
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(r.stdout);
+    const account = parsed.Account;
+    if (!account) {
+      problems.push({
+        id: "aws-identity-malformed",
+        message: "aws sts get-caller-identity did not return an Account field.",
+        remediation: ["Re-run `aws sts get-caller-identity` manually to inspect the response."]
+      });
+      return void 0;
+    }
+    let region = opts.awsRegion;
+    if (!region) {
+      const fromEnv = process.env.AWS_REGION?.trim() || process.env.AWS_DEFAULT_REGION?.trim();
+      if (fromEnv) region = fromEnv;
+    }
+    if (!region) {
+      const cfg = await tryExec("aws", [...awsBaseArgs(opts), "configure", "get", "region"]);
+      const trimmed = cfg.stdout.trim();
+      if (trimmed) region = trimmed;
+    }
+    if (!region) {
+      problems.push({
+        id: "aws-region-missing",
+        message: "AWS region is not set.",
+        remediation: [
+          "Pass --aws-region <name>, set AWS_REGION env var, or run `aws configure set region <name>`."
+        ]
+      });
+      return void 0;
+    }
+    return { account, region };
+  } catch (err) {
+    problems.push({
+      id: "aws-identity-parse-failed",
+      message: `Could not parse aws sts get-caller-identity response: ${err instanceof Error ? err.message : String(err)}`,
+      remediation: ["Re-run `aws sts get-caller-identity` manually to inspect the response."]
+    });
+    return void 0;
+  }
+}
+async function checkGithubRepoFree(opts, owner, problems) {
+  if (!owner) return;
+  const name = `${owner}/${shortName(opts)}`;
+  const r = await tryExec("gh", ["repo", "view", name]);
+  if (r.exitCode === 0) {
+    problems.push({
+      id: "github-repo-exists",
+      message: `GitHub repo ${name} already exists.`,
+      remediation: [
+        "Pick a different project name, or delete the existing repo first:",
+        `  gh repo delete ${name} --yes`
+      ]
+    });
+  }
+}
+async function checkAmplifyAppNameFree(opts, problems) {
+  const name = shortName(opts);
+  const r = await tryExec(
+    "aws",
+    awsCmd(opts, [
+      "amplify",
+      "list-apps",
+      "--query",
+      `apps[?name=='${name}']`
+    ])
+  );
+  if (r.exitCode !== 0) {
+    problems.push({
+      id: "amplify-list-apps-failed",
+      message: "Could not list Amplify Hosting apps to check for a name collision.",
+      remediation: [
+        "Verify your IAM identity has `amplify:ListApps` permission, then re-run.",
+        `Raw error: ${r.stderr.trim() || r.stdout.trim()}`
+      ]
+    });
+    return;
+  }
+  try {
+    const arr = JSON.parse(r.stdout);
+    if (Array.isArray(arr) && arr.length > 0) {
+      problems.push({
+        id: "amplify-app-name-taken",
+        message: `Amplify Hosting already has an app named "${name}" in this region.`,
+        remediation: [
+          "Pick a different project name, or delete the existing app first:",
+          `  aws amplify list-apps --query "apps[?name=='${name}'].appId" --output text${opts.awsProfile ? ` --profile ${opts.awsProfile}` : ""}${opts.awsRegion ? ` --region ${opts.awsRegion}` : ""}`,
+          "  aws amplify delete-app --app-id <appId>"
+        ]
+      });
+    }
+  } catch {
+  }
+}
+async function checkCdkBootstrap(opts, identity, problems) {
+  const r = await tryExec(
+    "aws",
+    [
+      ...awsBaseArgs(opts),
+      "ssm",
+      "get-parameter",
+      "--name",
+      "/cdk-bootstrap/hnb659fds/version",
+      "--output",
+      "json"
+    ]
+  );
+  if (r.exitCode !== 0) {
+    problems.push({
+      id: "cdk-not-bootstrapped",
+      message: `CDK is not bootstrapped in region ${identity.region}.`,
+      remediation: [
+        `Run: npx cdk bootstrap aws://${identity.account}/${identity.region}`
+      ]
+    });
+  }
+}
+async function checkRoute53Zone(opts, problems) {
+  if (!opts.domain) return;
+  const registrable = extractRegistrableDomain(opts.domain);
+  const r = await tryExec(
+    "aws",
+    [
+      ...awsBaseArgs(opts),
+      "route53",
+      "list-hosted-zones-by-name",
+      "--dns-name",
+      registrable,
+      "--max-items",
+      "1",
+      "--output",
+      "json"
+    ]
+  );
+  if (r.exitCode !== 0) {
+    problems.push({
+      id: "route53-list-failed",
+      message: `Could not query Route 53 for zone ${registrable}.`,
+      remediation: [
+        "Either grant `route53:ListHostedZonesByName` to your IAM identity,",
+        "or be prepared to add the CNAME records Amplify prints manually after deploy.",
+        `Raw error: ${r.stderr.trim() || r.stdout.trim()}`
+      ]
+    });
+    return;
+  }
+  try {
+    const parsed = JSON.parse(r.stdout);
+    const zones = parsed.HostedZones ?? [];
+    const found = zones.some(
+      (z) => z.Name && z.Name.replace(/\.$/, "") === registrable
+    );
+    if (!found) {
+      problems.push({
+        id: "route53-zone-missing",
+        message: `No Route 53 hosted zone for ${registrable} found in this AWS account.`,
+        remediation: [
+          "Amplify will still issue an ACM certificate, but you will need to add",
+          "the verification CNAMEs at your DNS provider manually. If you want",
+          "auto-validation, create a hosted zone first:",
+          `  aws route53 create-hosted-zone --name ${registrable} --caller-reference $(date +%s)${opts.awsProfile ? ` --profile ${opts.awsProfile}` : ""}`
+        ]
+      });
+    }
+  } catch {
+  }
+}
+async function resolveIamServiceRole(opts, args, problems) {
+  if (args.explicitArn) {
+    const roleName = args.explicitArn.split("/").pop() ?? args.explicitArn;
+    const r = await tryExec(
+      "aws",
+      [
+        ...awsBaseArgs(opts),
+        "iam",
+        "get-role",
+        "--role-name",
+        roleName,
+        "--output",
+        "json"
+      ]
+    );
+    if (r.exitCode !== 0) {
+      problems.push({
+        id: "iam-service-role-not-found",
+        message: `IAM role ${args.explicitArn} not found or inaccessible.`,
+        remediation: [
+          "Verify the ARN is correct and the role exists:",
+          `  aws iam get-role --role-name ${roleName}${opts.awsProfile ? ` --profile ${opts.awsProfile}` : ""}`
+        ]
+      });
+      return { willCreate: false };
+    }
+    return { arn: args.explicitArn, willCreate: false };
+  }
+  if (args.willCreate) {
+    return { willCreate: true };
+  }
+  const found = await findExistingAmplifyServiceRole(opts);
+  if (found) {
+    return { arn: found, willCreate: false };
+  }
+  problems.push({
+    id: "iam-service-role-missing",
+    message: "No Amplify Hosting service role found.",
+    remediation: [
+      "Either pass --iam-service-role <arn> pointing at an existing role,",
+      "or let create-ampless build one for you with --create-iam-role.",
+      "",
+      "Alternatively, create one yourself:",
+      `  aws iam create-role --role-name ${DEFAULT_AMPLIFY_ROLE_NAME} \\`,
+      `    --assume-role-policy-document '${TRUST_POLICY_JSON}'`,
+      `  aws iam attach-role-policy --role-name ${DEFAULT_AMPLIFY_ROLE_NAME} \\`,
+      `    --policy-arn ${AMPLIFY_BACKEND_POLICY_ARN}`,
+      `  # then re-run with: --iam-service-role $(aws iam get-role --role-name ${DEFAULT_AMPLIFY_ROLE_NAME} --query Role.Arn --output text)`
+    ]
+  });
+  return { willCreate: false };
+}
+function trustPolicyAllowsAmplify(doc) {
+  let parsed = doc;
+  if (typeof doc === "string") {
+    try {
+      parsed = JSON.parse(decodeURIComponent(doc));
+    } catch {
+      try {
+        parsed = JSON.parse(doc);
+      } catch {
+        return false;
+      }
+    }
+  }
+  const stmts = parsed?.Statement;
+  const arr = Array.isArray(stmts) ? stmts : stmts ? [stmts] : [];
+  for (const stmt of arr) {
+    const s = stmt;
+    const svc = s.Principal?.Service;
+    if (typeof svc === "string" && svc === "amplify.amazonaws.com") return true;
+    if (Array.isArray(svc) && svc.includes("amplify.amazonaws.com")) return true;
+  }
+  return false;
+}
+async function findExistingAmplifyServiceRole(opts) {
+  let marker;
+  for (let page = 0; page < 20; page++) {
+    const args = [
+      ...awsBaseArgs(opts),
+      "iam",
+      "list-roles",
+      "--max-items",
+      "200",
+      "--output",
+      "json"
+    ];
+    if (marker) args.push("--starting-token", marker);
+    const r = await tryExec("aws", args);
+    if (r.exitCode !== 0) return void 0;
+    let parsed;
+    try {
+      parsed = JSON.parse(r.stdout);
+    } catch {
+      return void 0;
+    }
+    for (const role of parsed.Roles ?? []) {
+      if (!role.RoleName || !role.Arn) continue;
+      if (!trustPolicyAllowsAmplify(role.AssumeRolePolicyDocument)) continue;
+      const pr = await tryExec(
+        "aws",
+        [
+          ...awsBaseArgs(opts),
+          "iam",
+          "list-attached-role-policies",
+          "--role-name",
+          role.RoleName,
+          "--output",
+          "json"
+        ]
+      );
+      if (pr.exitCode !== 0) continue;
+      try {
+        const policies = JSON.parse(pr.stdout);
+        const attached = (policies.AttachedPolicies ?? []).some(
+          (p3) => p3.PolicyArn === AMPLIFY_BACKEND_POLICY_ARN
+        );
+        if (attached) return role.Arn;
+      } catch {
+        continue;
+      }
+    }
+    if (!parsed.IsTruncated) break;
+    marker = parsed.Marker;
+    if (!marker) break;
+  }
+  return void 0;
+}
+async function runPreflight(opts, extra = {}) {
+  const problems = [];
+  const hasGh = await checkGhInstalled(problems);
+  if (hasGh) await checkGhAuth(problems);
+  const hasAws = await checkAwsInstalled(problems);
+  const identity = hasAws ? await checkAwsCreds(opts, problems) : void 0;
+  if (hasGh && opts.githubOwner && !extra.mountMode) {
+    await checkGithubRepoFree(opts, opts.githubOwner, problems);
+  }
+  if (identity) {
+    await checkAmplifyAppNameFree(opts, problems);
+    await checkCdkBootstrap(opts, identity, problems);
+    await checkRoute53Zone(opts, problems);
+  }
+  let willCreateIamRole = false;
+  let iamServiceRoleArn;
+  if (identity) {
+    const resolved = await resolveIamServiceRole(
+      opts,
+      { explicitArn: extra.iamServiceRoleArn, willCreate: extra.createIamRole === true },
+      problems
+    );
+    willCreateIamRole = resolved.willCreate;
+    iamServiceRoleArn = resolved.arn;
+  }
+  if (problems.length > 0) {
+    return { problems };
+  }
+  return {
+    problems,
+    resolution: {
+      iamServiceRoleArn,
+      willCreateIamRole,
+      awsAccount: identity.account,
+      awsRegion: identity.region
+    }
+  };
+}
+function formatPreflightReport(problems) {
+  const lines = [];
+  lines.push(`${pc.red("\u2717")} create-ampless --deploy: prerequisites missing`);
+  lines.push("");
+  for (const p3 of problems) {
+    lines.push(`  ${pc.red("\u2717")} ${p3.message}`);
+    for (const r of p3.remediation) {
+      lines.push(r ? `    ${r}` : "");
+    }
+    lines.push("");
+  }
+  lines.push("Fix the items above and re-run.");
+  return lines.join("\n");
+}
+function printPreflightReport(problems) {
+  process.stderr.write(`${formatPreflightReport(problems)}
+`);
+}
+
+// src/mount.ts
+import { existsSync as existsSync3 } from "fs";
+import { resolve as resolve3 } from "path";
+function validateMountableProject(destDir) {
+  const required = ["package.json", "cms.config.ts"];
+  for (const f of required) {
+    if (!existsSync3(resolve3(destDir, f))) {
+      return `Not an ampless project (missing ${f} in ${destDir})`;
+    }
+  }
+  const amplifyFiles = ["amplify/backend.ts", "amplify/data/resource.ts"];
+  if (!amplifyFiles.some((f) => existsSync3(resolve3(destDir, f)))) {
+    return `Not an ampless project (missing amplify/ in ${destDir})`;
+  }
+  return null;
+}
+function originPointsAt(origin, owner, name) {
+  const candidates = [
+    `https://github.com/${owner}/${name}`,
+    `https://github.com/${owner}/${name}.git`,
+    `git@github.com:${owner}/${name}`,
+    `git@github.com:${owner}/${name}.git`,
+    `ssh://git@github.com/${owner}/${name}`,
+    `ssh://git@github.com/${owner}/${name}.git`
+  ];
+  return candidates.includes(origin);
+}
+
+// src/deploy.ts
+var AMPLIFY_BUILD_SPEC = `version: 1
+frontend:
+  phases:
+    preBuild:
+      commands:
+        - npm install
+    build:
+      commands:
+        - npx ampx pipeline-deploy --branch $AWS_BRANCH --app-id $AWS_APP_ID
+        - npm run build
+  artifacts:
+    baseDirectory: .next
+    files:
+      - '**/*'
+  cache:
+    paths:
+      - node_modules/**/*
+      - .next/cache/**/*
+`;
+async function resolveGithubToken(explicit, env = process.env) {
+  if (explicit && explicit.trim()) return explicit.trim();
+  const envToken = env.GITHUB_TOKEN;
+  if (envToken && envToken.trim()) return envToken.trim();
+  try {
+    const { stdout } = await execa2("gh", ["auth", "token"], { reject: false });
+    const trimmed = stdout?.trim();
+    if (trimmed) return trimmed;
+  } catch {
+  }
+  return void 0;
+}
+function extractRegistrableDomain(domain) {
+  const labels = domain.replace(/\.$/, "").split(".");
+  if (labels.length <= 2) return labels.join(".");
+  const MULTI_PART_SUFFIXES = /* @__PURE__ */ new Set([
+    "co.uk",
+    "org.uk",
+    "me.uk",
+    "gov.uk",
+    "ac.uk",
+    "co.jp",
+    "ne.jp",
+    "or.jp",
+    "ac.jp",
+    "go.jp",
+    "ad.jp",
+    "gr.jp",
+    "lg.jp",
+    "com.au",
+    "net.au",
+    "org.au",
+    "edu.au",
+    "gov.au",
+    "co.nz",
+    "net.nz",
+    "org.nz",
+    "com.br",
+    "com.mx",
+    "com.cn",
+    "com.sg",
+    "com.hk",
+    "com.tw",
+    "co.kr",
+    "or.kr",
+    "co.in",
+    "co.id",
+    "co.za"
+  ]);
+  const lastTwo = labels.slice(-2).join(".");
+  if (MULTI_PART_SUFFIXES.has(lastTwo) && labels.length >= 3) {
+    return labels.slice(-3).join(".");
+  }
+  return lastTwo;
+}
+function splitDomain(domain, subdomain) {
+  const registrable = extractRegistrableDomain(domain);
+  if (subdomain !== void 0) {
+    return { registrable, subdomain };
+  }
+  if (domain === registrable) {
+    return { registrable, subdomain: "" };
+  }
+  const prefix = domain.slice(0, domain.length - registrable.length - 1);
+  return { registrable, subdomain: prefix };
+}
+async function rewriteCmsConfigForDomain(projectDir, fullDomain) {
+  const path = resolve4(projectDir, "cms.config.ts");
+  if (!existsSync4(path)) {
+    return { urlRewritten: false, sitesInjected: false };
+  }
+  let content = await readFile2(path, "utf-8");
+  let urlRewritten = false;
+  let sitesInjected = false;
+  const urlRe = /url:\s*['"]http:\/\/localhost:3000['"]/;
+  if (urlRe.test(content)) {
+    content = content.replace(urlRe, `url: 'https://${fullDomain}'`);
+    urlRewritten = true;
+  }
+  const sitesActiveRe = /^\s*sites:\s*\{/m;
+  if (!sitesActiveRe.test(content)) {
+    const siteCloseRe = /(\n(\s*)site:\s*\{[\s\S]*?\n\2\},)/;
+    const m = siteCloseRe.exec(content);
+    if (m) {
+      const indent = m[2] ?? "  ";
+      const inner = indent + "  ";
+      const innermost = inner + "  ";
+      const inject = `
+${indent}sites: {
+${inner}default: {
+${innermost}domains: ['${fullDomain}'],
+${inner}},
+${indent}},`;
+      content = content.replace(siteCloseRe, `$1${inject}`);
+      sitesInjected = true;
+    }
+  }
+  if (urlRewritten || sitesInjected) {
+    await writeFile2(path, content, "utf-8");
+  }
+  return { urlRewritten, sitesInjected };
+}
+async function run(cmd, args, opts = {}) {
+  const { step, ...execaOpts } = opts;
+  try {
+    const result = await execa2(cmd, args, { stdio: "pipe", ...execaOpts });
+    return result.stdout?.toString() ?? "";
+  } catch (err) {
+    const e = err;
+    const detail = (e.stderr || e.stdout || e.shortMessage || e.message || String(err)).trim();
+    const prefix = step ? `${step}: ` : "";
+    throw new Error(`${prefix}${cmd} ${args.join(" ")}
+${detail}`);
+  }
+}
+function awsArgs(opts, extra) {
+  const base = [];
+  if (opts.awsProfile) base.push("--profile", opts.awsProfile);
+  if (opts.awsRegion) base.push("--region", opts.awsRegion);
+  base.push(...extra);
+  base.push("--output", "json");
+  return base;
+}
+async function isGitRepo(dir) {
+  const r = await execa2("git", ["rev-parse", "--git-dir"], { cwd: dir, reject: false });
+  return r.exitCode === 0;
+}
+async function isDirty(dir) {
+  const r = await execa2("git", ["status", "--porcelain"], { cwd: dir, reject: false });
+  return (r.stdout?.toString() ?? "").trim().length > 0;
+}
+async function currentBranch(dir) {
+  const r = await execa2("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    cwd: dir,
+    reject: false
+  });
+  if (r.exitCode !== 0) return null;
+  const name = r.stdout?.toString().trim();
+  return name && name !== "HEAD" ? name : null;
+}
+async function ensureGitignore(dir) {
+  const target = resolve4(dir, ".gitignore");
+  if (existsSync4(target)) return;
+  await writeFile2(target, DEFAULT_GITIGNORE, "utf-8");
+}
+async function gitInitOrReuse(dir, mount) {
+  const repo = await isGitRepo(dir);
+  if (!repo) {
+    await run("git", ["init", "-b", "main"], { cwd: dir, step: "git init" });
+  }
+  const dirty = await isDirty(dir);
+  if (dirty) {
+    await run("git", ["add", "."], { cwd: dir, step: "git add" });
+    const message = mount && repo ? "Prepare for create-ampless --mount" : "Initial scaffold (create-ampless)";
+    await run("git", ["commit", "-m", message], { cwd: dir, step: "git commit" });
+  }
+  if (mount) {
+    const branch = await currentBranch(dir);
+    if (branch && branch !== "main") {
+      log.warn(
+        `Current branch is "${branch}" \u2014 Amplify Hosting will be wired to the "main" branch. Push from "main" later, or rename your branch with \`git branch -m main\`.`
+      );
+    }
+  }
+}
+function shortName2(opts) {
+  return basename2(opts.projectDir);
+}
+async function ghRepoExists(name, token) {
+  const r = await execa2("gh", ["repo", "view", name, "--json", "nameWithOwner"], {
+    reject: false,
+    env: { ...process.env, GH_TOKEN: token }
+  });
+  if (r.exitCode !== 0) return false;
+  try {
+    const parsed = JSON.parse(r.stdout?.toString() ?? "{}");
+    const resolved = parsed.nameWithOwner?.toLowerCase();
+    return resolved === name.toLowerCase();
+  } catch {
+    return true;
+  }
+}
+async function getOriginUrl(dir) {
+  const r = await execa2("git", ["remote", "get-url", "origin"], {
+    cwd: dir,
+    reject: false
+  });
+  if (r.exitCode !== 0) return null;
+  const url = r.stdout?.toString().trim();
+  return url ? url : null;
+}
+function repoHttpsUrl(owner, name) {
+  return `https://github.com/${owner}/${name}`;
+}
+async function ghRepoCreate(opts) {
+  const owner = opts.githubOwner;
+  const name = shortName2(opts);
+  const fullName = `${owner}/${name}`;
+  const visibility = opts.githubPrivate ? "--private" : "--public";
+  const exists = await ghRepoExists(fullName, opts.githubToken);
+  if (exists) {
+    const origin = await getOriginUrl(opts.projectDir);
+    if (origin && !originPointsAt(origin, owner, name)) {
+      throw new Error(
+        `Existing 'origin' remote points at ${origin}, but --mount expects ${fullName}.
+Remove or rename the existing remote (\`git remote remove origin\`) and re-run.`
+      );
+    }
+    if (!origin) {
+      await run(
+        "git",
+        ["remote", "add", "origin", `https://github.com/${fullName}.git`],
+        { cwd: opts.projectDir, step: "git remote add origin" }
+      );
+    }
+    await run(
+      "git",
+      ["push", "-u", "origin", "HEAD:main"],
+      {
+        cwd: opts.projectDir,
+        step: "git push origin main",
+        env: { ...process.env, GH_TOKEN: opts.githubToken }
+      }
+    );
+    return repoHttpsUrl(owner, name);
+  }
+  const out = await run(
+    "gh",
+    [
+      "repo",
+      "create",
+      fullName,
+      "--source",
+      opts.projectDir,
+      "--push",
+      visibility,
+      "--description",
+      "Created by create-ampless"
+    ],
+    {
+      cwd: opts.projectDir,
+      step: "gh repo create",
+      env: { ...process.env, GH_TOKEN: opts.githubToken }
+    }
+  );
+  const match = out.match(/https:\/\/github\.com\/[^\s]+/g);
+  if (match && match.length > 0) return match[match.length - 1].replace(/[.,]$/, "");
+  return repoHttpsUrl(owner, name);
+}
+async function amplifyCreateApp(opts, repoUrl, iamServiceRoleArn) {
+  const cmd = [
+    "amplify",
+    "create-app",
+    "--name",
+    shortName2(opts),
+    "--repository",
+    repoUrl,
+    "--access-token",
+    opts.githubToken,
+    "--platform",
+    "WEB_COMPUTE",
+    "--build-spec",
+    AMPLIFY_BUILD_SPEC
+  ];
+  if (iamServiceRoleArn) {
+    cmd.push("--iam-service-role-arn", iamServiceRoleArn);
+  }
+  const out = await run(
+    "aws",
+    awsArgs(opts, cmd),
+    { step: "aws amplify create-app" }
+  );
+  const parsed = JSON.parse(out);
+  const appId = parsed.app?.appId;
+  if (!appId) throw new Error("aws amplify create-app: missing app.appId in response");
+  return {
+    appId,
+    defaultDomain: parsed.app?.defaultDomain ?? "amplifyapp.com"
+  };
+}
+async function amplifyCreateBranch(opts, appId) {
+  await run(
+    "aws",
+    awsArgs(opts, [
+      "amplify",
+      "create-branch",
+      "--app-id",
+      appId,
+      "--branch-name",
+      "main",
+      "--stage",
+      "PRODUCTION"
+    ]),
+    { step: "aws amplify create-branch" }
+  );
+}
+async function amplifyStartJob(opts, appId) {
+  await run(
+    "aws",
+    awsArgs(opts, [
+      "amplify",
+      "start-job",
+      "--app-id",
+      appId,
+      "--branch-name",
+      "main",
+      "--job-type",
+      "RELEASE"
+    ]),
+    { step: "aws amplify start-job" }
+  );
+}
+async function findRoute53Zone(opts, registrable) {
+  try {
+    const out = await run(
+      "aws",
+      awsArgs(opts, [
+        "route53",
+        "list-hosted-zones-by-name",
+        "--dns-name",
+        registrable,
+        "--max-items",
+        "1"
+      ]),
+      { step: "aws route53 list-hosted-zones-by-name" }
+    );
+    const parsed = JSON.parse(out);
+    const zones = parsed.HostedZones ?? [];
+    for (const z of zones) {
+      if (z.Name && z.Name.replace(/\.$/, "") === registrable && z.Id) {
+        return z.Id.replace("/hostedzone/", "");
+      }
+    }
+  } catch {
+  }
+  return void 0;
+}
+async function amplifyCreateDomain(opts, appId) {
+  const { registrable, subdomain } = splitDomain(opts.domain, opts.subdomain);
+  const fullName = subdomain ? `${subdomain}.${registrable}` : registrable;
+  const route53Zone = await findRoute53Zone(opts, registrable);
+  if (route53Zone) {
+    log.info(
+      `Route 53 hosted zone detected for ${pc2.cyan(registrable)} \u2014 Amplify will auto-create DNS records once ACM validates.`
+    );
+  }
+  const out = await run(
+    "aws",
+    awsArgs(opts, [
+      "amplify",
+      "create-domain-association",
+      "--app-id",
+      appId,
+      "--domain-name",
+      registrable,
+      "--sub-domain-settings",
+      `prefix=${subdomain},branchName=main`
+    ]),
+    { step: "aws amplify create-domain-association" }
+  );
+  const parsed = JSON.parse(out);
+  const verification = [];
+  const certRecord = parsed.domainAssociation?.certificateVerificationDNSRecord;
+  if (certRecord) {
+    const parts = certRecord.trim().split(/\s+/);
+    if (parts.length >= 3) {
+      verification.push({
+        cname: parts[0].replace(/\.$/, ""),
+        target: parts.slice(2).join(" ").replace(/\.$/, "")
+      });
+    }
+  }
+  for (const sd of parsed.domainAssociation?.subDomains ?? []) {
+    if (!sd.dnsRecord) continue;
+    const parts = sd.dnsRecord.trim().split(/\s+/);
+    if (parts.length >= 3) {
+      const prefix = sd.subDomainSetting?.prefix ?? "";
+      const cname = prefix ? `${prefix}.${registrable}` : registrable;
+      verification.push({
+        cname,
+        target: parts.slice(2).join(" ").replace(/\.$/, "")
+      });
+    }
+  }
+  return {
+    domainUrl: `https://${fullName}`,
+    verification: route53Zone ? void 0 : verification.length > 0 ? verification : void 0
+  };
+}
+async function provisionIamServiceRole(opts) {
+  const roleName = DEFAULT_AMPLIFY_ROLE_NAME;
+  const trustPolicy = JSON.stringify({
+    Version: "2012-10-17",
+    Statement: [
+      {
+        Effect: "Allow",
+        Principal: { Service: "amplify.amazonaws.com" },
+        Action: "sts:AssumeRole"
+      }
+    ]
+  });
+  const createArgs = [
+    "iam",
+    "create-role",
+    "--role-name",
+    roleName,
+    "--assume-role-policy-document",
+    trustPolicy,
+    "--description",
+    "Amplify Hosting service role created by create-ampless"
+  ];
+  try {
+    await run("aws", awsArgs(opts, createArgs), { step: "aws iam create-role" });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (!/EntityAlreadyExists/i.test(msg) && !/already exists/i.test(msg)) {
+      throw err;
+    }
+  }
+  await run(
+    "aws",
+    awsArgs(opts, [
+      "iam",
+      "attach-role-policy",
+      "--role-name",
+      roleName,
+      "--policy-arn",
+      AMPLIFY_BACKEND_POLICY_ARN
+    ]),
+    { step: "aws iam attach-role-policy" }
+  );
+  const out = await run(
+    "aws",
+    awsArgs(opts, ["iam", "get-role", "--role-name", roleName]),
+    { step: "aws iam get-role" }
+  );
+  const parsed = JSON.parse(out);
+  const arn = parsed.Role?.Arn;
+  if (!arn) {
+    throw new Error(`aws iam get-role for ${roleName}: missing Role.Arn in response`);
+  }
+  return arn;
+}
+var PreflightError = class extends Error {
+  result;
+  constructor(result) {
+    super("create-ampless --deploy: pre-flight failed");
+    this.name = "PreflightError";
+    this.result = result;
+  }
+};
+async function runDeploy(opts) {
+  const pre = await runPreflight(opts, {
+    iamServiceRoleArn: opts.iamServiceRoleArn,
+    createIamRole: opts.createIamRole === true,
+    mountMode: opts.mount === true
+  });
+  if (pre.problems.length > 0) {
+    printPreflightReport(pre.problems);
+    throw new PreflightError(pre);
+  }
+  const resolution = pre.resolution;
+  let serviceRoleArn = resolution.iamServiceRoleArn;
+  if (resolution.willCreateIamRole && !serviceRoleArn) {
+    const s0 = spinner();
+    s0.start(`Provisioning IAM service role ${DEFAULT_AMPLIFY_ROLE_NAME}`);
+    try {
+      serviceRoleArn = await provisionIamServiceRole(opts);
+      s0.stop(`IAM role: ${serviceRoleArn}`);
+    } catch (err) {
+      s0.stop("IAM role provisioning: failed");
+      throw new Error(
+        `Failed to provision IAM service role: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  await writeFile2(resolve4(opts.projectDir, "amplify.yml"), AMPLIFY_BUILD_SPEC, "utf-8");
+  if (opts.domain) {
+    const { registrable, subdomain } = splitDomain(opts.domain, opts.subdomain);
+    const fullDomain = subdomain ? `${subdomain}.${registrable}` : registrable;
+    const mutations = await rewriteCmsConfigForDomain(opts.projectDir, fullDomain);
+    if (mutations.urlRewritten || mutations.sitesInjected) {
+      const parts = [];
+      if (mutations.urlRewritten) parts.push(`site.url \u2192 https://${fullDomain}`);
+      if (mutations.sitesInjected) parts.push(`sites.default.domains += ${fullDomain}`);
+      log.info(`cms.config.ts updated: ${parts.join(", ")}`);
+    }
+  }
+  const created = {};
+  const fail = (step, cause) => {
+    const msg = cause instanceof Error ? cause.message : String(cause);
+    const cleanup = [];
+    if (created.appId) {
+      cleanup.push(
+        `  - Amplify app: ${created.appId} (delete: aws amplify delete-app --app-id ${created.appId}${opts.awsProfile ? ` --profile ${opts.awsProfile}` : ""}${opts.awsRegion ? ` --region ${opts.awsRegion}` : ""})`
+      );
+    }
+    if (created.repoUrl) {
+      cleanup.push(
+        `  - GitHub repo: ${created.repoUrl} (delete: gh repo delete ${opts.githubOwner}/${shortName2(opts)} --yes)`
+      );
+    }
+    const cleanupBlock = cleanup.length > 0 ? `
+Created so far:
+${cleanup.join("\n")}
+
+Re-run after cleaning up.` : "";
+    throw new Error(`Deploy failed at: ${step}
+${msg}${cleanupBlock}`);
+  };
+  let s = spinner();
+  const gitMsg = opts.mount ? "git: preparing repo for mount" : "git init + initial commit";
+  s.start(gitMsg);
+  try {
+    if (opts.mount) {
+      await ensureGitignore(opts.projectDir);
+    }
+    await gitInitOrReuse(opts.projectDir, opts.mount === true);
+    s.stop(opts.mount ? "git: ready" : "git: committed initial scaffold");
+  } catch (err) {
+    s.stop("git: failed");
+    fail("git init / commit", err);
+  }
+  s = spinner();
+  s.start("Creating GitHub repo + pushing");
+  try {
+    created.repoUrl = await ghRepoCreate(opts);
+    s.stop(`GitHub: ${created.repoUrl}`);
+  } catch (err) {
+    s.stop("GitHub: failed");
+    fail("gh repo create", err);
+  }
+  let app;
+  s = spinner();
+  s.start("Creating Amplify Hosting app");
+  try {
+    app = await amplifyCreateApp(opts, created.repoUrl, serviceRoleArn);
+    created.appId = app.appId;
+    s.stop(`Amplify app: ${app.appId}`);
+  } catch (err) {
+    s.stop("Amplify create-app: failed");
+    return fail("aws amplify create-app", err);
+  }
+  s = spinner();
+  s.start("Creating main branch");
+  try {
+    await amplifyCreateBranch(opts, app.appId);
+    s.stop("Amplify branch: main");
+  } catch (err) {
+    s.stop("Amplify create-branch: failed");
+    fail("aws amplify create-branch", err);
+  }
+  s = spinner();
+  s.start("Starting first deployment");
+  try {
+    await amplifyStartJob(opts, app.appId);
+    s.stop("Amplify: first job started");
+  } catch (err) {
+    s.stop("Amplify start-job: failed");
+    fail("aws amplify start-job", err);
+  }
+  const amplifyAppUrl = `https://main.${app.defaultDomain}`;
+  const result = {
+    githubRepoUrl: created.repoUrl,
+    amplifyAppId: app.appId,
+    amplifyAppUrl
+  };
+  if (opts.domain) {
+    s = spinner();
+    s.start(`Associating custom domain ${opts.domain}`);
+    try {
+      const dom = await amplifyCreateDomain(opts, app.appId);
+      result.domainUrl = dom.domainUrl;
+      result.domainVerification = dom.verification;
+      s.stop(`Custom domain queued: ${opts.domain}`);
+    } catch (err) {
+      s.stop("Custom domain: failed");
+      const msg = err instanceof Error ? err.message : String(err);
+      log.warn(`Custom domain step failed:
+${msg}`);
+    }
+  }
+  return result;
+}
+
+// src/deploy-prompts.ts
+async function detectGithubLogin() {
+  try {
+    const { stdout } = await execa3("gh", ["api", "user", "--jq", ".login"], { reject: false });
+    const trimmed = stdout?.trim();
+    return trimmed || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function detectAwsRegion() {
+  if (process.env.AWS_REGION?.trim()) return process.env.AWS_REGION.trim();
+  if (process.env.AWS_DEFAULT_REGION?.trim()) return process.env.AWS_DEFAULT_REGION.trim();
+  try {
+    const { stdout } = await execa3("aws", ["configure", "get", "region"], { reject: false });
+    const trimmed = stdout?.trim();
+    return trimmed || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function gatherDeployOptions(args, projectDir, projectName) {
+  p2.log.info("Configuring deploy (GitHub + Amplify Hosting)");
+  let githubOwner = args.githubOwner;
+  if (!githubOwner) {
+    const detected = await detectGithubLogin();
+    const answer = await p2.text({
+      message: "GitHub owner (user or org)",
+      placeholder: detected ?? "your-github-username",
+      defaultValue: detected ?? "",
+      validate: (v) => !v?.trim() ? "GitHub owner is required" : void 0
+    });
+    if (p2.isCancel(answer)) {
+      p2.cancel("Cancelled.");
+      return null;
+    }
+    githubOwner = answer.trim();
+  }
+  let githubPrivate = args.githubPrivate;
+  if (!args.githubPrivate && !args.skipConfirm) {
+    const choice = await p2.select({
+      message: "Repository visibility",
+      options: [
+        { value: "public", label: "Public" },
+        { value: "private", label: "Private" }
+      ],
+      initialValue: "public"
+    });
+    if (p2.isCancel(choice)) {
+      p2.cancel("Cancelled.");
+      return null;
+    }
+    githubPrivate = choice === "private";
+  }
+  let githubToken = await resolveGithubToken(args.githubToken);
+  if (!githubToken) {
+    const answer = await p2.password({
+      message: "GitHub token (needs `repo` scope) \u2014 or run `gh auth login` first",
+      validate: (v) => !v?.trim() ? "Token is required" : void 0
+    });
+    if (p2.isCancel(answer)) {
+      p2.cancel("Cancelled.");
+      return null;
+    }
+    githubToken = answer.trim();
+  }
+  let awsRegion = args.awsRegion;
+  if (!awsRegion) {
+    const detected = await detectAwsRegion();
+    const answer = await p2.text({
+      message: "AWS region",
+      placeholder: detected ?? "us-east-1",
+      defaultValue: detected ?? "us-east-1"
+    });
+    if (p2.isCancel(answer)) {
+      p2.cancel("Cancelled.");
+      return null;
+    }
+    awsRegion = answer.trim() || detected || "us-east-1";
+  }
+  let domain = args.domain;
+  let subdomain = args.subdomain;
+  if (!domain) {
+    const wantDomain = await p2.confirm({
+      message: "Attach a custom domain?",
+      initialValue: false
+    });
+    if (p2.isCancel(wantDomain)) {
+      p2.cancel("Cancelled.");
+      return null;
+    }
+    if (wantDomain) {
+      const dom = await p2.text({
+        message: "Domain (apex or subdomain, e.g. example.com or blog.example.com)",
+        validate: (v) => {
+          if (!v?.trim()) return "Domain is required";
+          if (!/^[a-z0-9.-]+\.[a-z]{2,}$/i.test(v.trim())) return "Looks invalid";
+        }
+      });
+      if (p2.isCancel(dom)) {
+        p2.cancel("Cancelled.");
+        return null;
+      }
+      domain = dom.trim();
+      if (!subdomain) {
+        const sub = await p2.text({
+          message: "Subdomain prefix (leave blank for apex)",
+          placeholder: "",
+          defaultValue: ""
+        });
+        if (p2.isCancel(sub)) {
+          p2.cancel("Cancelled.");
+          return null;
+        }
+        subdomain = sub.trim() || void 0;
+      }
+    }
+  }
+  if (!args.skipConfirm) {
+    const proceed = await p2.confirm({
+      message: `Proceed?
+  GitHub: ${githubOwner}/${projectName} (${githubPrivate ? "private" : "public"})
+  Region: ${awsRegion}` + (domain ? `
+  Domain: ${subdomain ? `${subdomain}.` : ""}${domain}` : ""),
+      initialValue: true
+    });
+    if (p2.isCancel(proceed) || !proceed) {
+      p2.cancel("Cancelled.");
+      return null;
+    }
+  }
+  return {
+    projectDir,
+    projectName,
+    githubOwner,
+    githubPrivate,
+    githubToken,
+    awsProfile: args.awsProfile,
+    awsRegion,
+    domain,
+    subdomain,
+    iamServiceRoleArn: args.iamServiceRole,
+    createIamRole: args.createIamRole,
+    skipConfirm: args.skipConfirm
+  };
+}
+
+// src/upgrade.ts
+import { cp as cp2, readFile as readFile3, writeFile as writeFile3, readdir as readdir3, mkdir as mkdir2, rm as rm2 } from "fs/promises";
+import { existsSync as existsSync5 } from "fs";
+import { join as join3, relative, extname as extname2, dirname } from "path";
+import { log as log3, outro } from "@clack/prompts";
+import pc3 from "picocolors";
+import { execa as execa4 } from "execa";
+var AMPLESS_MANAGED_APP_PATHS = [
+  "app/(admin)/admin",
+  "app/api/admin",
+  "app/api/media",
+  "app/api/mcp",
+  "app/login",
+  "app/site"
+];
+var AMPLESS_PACKAGES = /* @__PURE__ */ new Set([
+  "ampless",
+  "@ampless/admin",
+  "@ampless/backend",
+  "@ampless/runtime",
+  "@ampless/plugin-seo",
+  "@ampless/plugin-rss",
+  "@ampless/plugin-webhook",
+  "@ampless/plugin-og-image"
+]);
+var AMPLESS_MANAGED_SCRIPTS = /* @__PURE__ */ new Set([
+  "sandbox",
+  "sandbox:dev",
+  "update-ampless",
+  "copy-theme"
+]);
+var PROTECTED_PATTERNS = [
+  /^cms\.config\.ts$/,
+  // `themes/` and `themes-registry.ts` are handled separately — see
+  // syncThemes() below. The themes directory is owned per-entry by
+  // either ampless (default themes, resynced on upgrade) or the user
+  // (`my-*` themes, preserved). The registry is regenerated to match
+  // whatever is on disk afterward.
+  /^\.env/,
+  /^node_modules(\/|$)/,
+  /^\.next(\/|$)/,
+  /^\.turbo(\/|$)/,
+  /^\.amplify(\/|$)/,
+  /^amplify_outputs\.json$/,
+  /^next-env\.d\.ts$/,
+  /^tsconfig\.tsbuildinfo$/,
+  /^pnpm-lock\.yaml$/,
+  /^package-lock\.json$/,
+  // Anything under themes/ is handled by syncThemes; the file-walk
+  // classifier must not double-process it.
+  /^themes(\/|$)/,
+  /^themes-registry\.ts$/
+];
+var SEED_IF_MISSING_PATTERN = /\.custom\.ts$/;
+var TEXT_EXTENSIONS2 = /* @__PURE__ */ new Set([
+  ".json",
+  ".md",
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".html",
+  ".css",
+  ".env",
+  ".txt",
+  ".yaml",
+  ".yml",
+  ".toml",
+  ".gitignore"
+]);
+function isProtected(relPath) {
+  return PROTECTED_PATTERNS.some((re) => re.test(relPath));
+}
+async function listShippedThemes(templatesRoot) {
+  if (!existsSync5(templatesRoot)) return [];
+  const entries = await readdir3(templatesRoot, { withFileTypes: true });
+  return entries.filter((e) => e.isDirectory() && e.name !== "_shared").map((e) => e.name).sort();
+}
+var USER_OWNED_THEME_FILES = /* @__PURE__ */ new Set(["README.md", ".gitignore"]);
+function isUserOwnedThemeFile(path) {
+  const name = path.split(/[/\\]/).pop() ?? "";
+  return USER_OWNED_THEME_FILES.has(name);
+}
+async function captureUserOwnedFiles(dir) {
+  const out = /* @__PURE__ */ new Map();
+  if (!existsSync5(dir)) return out;
+  for (const name of USER_OWNED_THEME_FILES) {
+    const p3 = join3(dir, name);
+    if (existsSync5(p3)) {
+      out.set(name, await readFile3(p3));
+    }
+  }
+  return out;
+}
+async function restorePreservedFiles(dir, files) {
+  for (const [name, content] of files) {
+    await mkdir2(dir, { recursive: true });
+    await writeFile3(join3(dir, name), content);
+  }
+}
+async function syncThemes(destDir, templatesRoot) {
+  const shipped = await listShippedThemes(templatesRoot);
+  const themesDir = join3(destDir, "themes");
+  await mkdir2(themesDir, { recursive: true });
+  for (const name of shipped) {
+    const src = join3(templatesRoot, name);
+    const dst = join3(themesDir, name);
+    const preservedFiles = await captureUserOwnedFiles(dst);
+    await rm2(dst, { recursive: true, force: true });
+    await cp2(src, dst, {
+      recursive: true,
+      filter: (sourcePath) => !isUserOwnedThemeFile(sourcePath)
+    });
+    await restorePreservedFiles(dst, preservedFiles);
+  }
+  const installed = await discoverInstalledThemes(destDir);
+  const shippedSet = new Set(shipped);
+  const preserved = installed.filter((t) => !shippedSet.has(t));
+  const all = [...shipped, ...preserved];
+  await writeFile3(join3(destDir, "themes-registry.ts"), buildRegistry(all), "utf-8");
+  return { synced: shipped, preserved };
+}
+async function walkDir(dir, base, out) {
+  const entries = await readdir3(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const full = join3(dir, entry.name);
+    const rel = relative(base, full);
+    if (entry.isDirectory()) {
+      await walkDir(full, base, out);
+    } else {
+      out.push(rel);
+    }
+  }
+}
+async function listFilesRecursive(root) {
+  const out = [];
+  async function walk(current, relPrefix) {
+    const entries = await readdir3(current, { withFileTypes: true });
+    for (const entry of entries) {
+      const rel = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        await walk(join3(current, entry.name), rel);
+      } else if (entry.isFile()) {
+        out.push(rel);
+      }
+    }
+  }
+  if (!existsSync5(root)) return out;
+  await walk(root, "");
+  return out;
+}
+async function pruneEmptyDirs(root) {
+  if (!existsSync5(root)) return;
+  const entries = await readdir3(root, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      await pruneEmptyDirs(join3(root, entry.name));
+    }
+  }
+  const remaining = await readdir3(root);
+  if (remaining.length === 0) {
+    await rm2(root, { recursive: true, force: true });
+  }
+}
+async function findObsoleteAppFiles(destDir, sharedDir) {
+  const obsolete = [];
+  for (const managedPath of AMPLESS_MANAGED_APP_PATHS) {
+    const userPath = join3(destDir, managedPath);
+    if (!existsSync5(userPath)) continue;
+    const templatePath2 = join3(sharedDir, managedPath);
+    const templateFiles = new Set(await listFilesRecursive(templatePath2));
+    const userFiles = await listFilesRecursive(userPath);
+    for (const f of userFiles) {
+      if (!templateFiles.has(f)) {
+        obsolete.push(`${managedPath}/${f}`);
+      }
+    }
+  }
+  return obsolete;
+}
+async function removeObsoleteAppFiles(destDir, paths) {
+  for (const rel of paths) {
+    const abs = join3(destDir, rel);
+    if (existsSync5(abs)) {
+      await rm2(abs, { force: true });
+    }
+  }
+  for (const managedPath of AMPLESS_MANAGED_APP_PATHS) {
+    await pruneEmptyDirs(join3(destDir, managedPath));
+  }
+}
+function substituteVars(content, vars) {
+  return content.replace(/\{\{(\w+)\}\}/g, (_, key) => vars[key] ?? `{{${key}}}`);
+}
+async function copyWithSubstitution(src, dst, vars) {
+  const ext = extname2(src) || (src.endsWith(".gitignore") ? ".gitignore" : "");
+  await mkdir2(dirname(dst), { recursive: true });
+  if (TEXT_EXTENSIONS2.has(ext)) {
+    const content = await readFile3(src, "utf-8");
+    await writeFile3(dst, substituteVars(content, vars), "utf-8");
+  } else {
+    const buf = await readFile3(src);
+    await writeFile3(dst, buf);
+  }
+}
+function detectIndent(jsonStr) {
+  const m = jsonStr.match(/^{\n(\s+)/);
+  if (!m) return 2;
+  return m[1].length;
+}
+async function runUpgradeIn(destDir, sharedDir, opts = {}) {
+  const derivedRoot = opts.templatesRoot ?? join3(sharedDir, "..");
+  const themeSyncEnabled = existsSync5(join3(derivedRoot, "_shared"));
+  const templatesRoot = themeSyncEnabled ? derivedRoot : "";
+  const problem = validateMountableProject(destDir);
+  if (problem) {
+    throw new Error(problem);
+  }
+  const projectPkgPath = join3(destDir, "package.json");
+  const projectPkgRaw = await readFile3(projectPkgPath, "utf-8");
+  const projectPkg = JSON.parse(projectPkgRaw);
+  const projectName = typeof projectPkg.name === "string" && projectPkg.name ? projectPkg.name : "my-ampless-site";
+  const vars = { projectName };
+  const allRelPaths = [];
+  await walkDir(sharedDir, sharedDir, allRelPaths);
+  const classification = { replace: [], merge: [], seed: [], protected: [] };
+  for (const rel of allRelPaths) {
+    if (SEED_IF_MISSING_PATTERN.test(rel)) {
+      classification.seed.push(rel);
+    } else if (isProtected(rel)) {
+      classification.protected.push(rel);
+    } else if (rel === "package.json") {
+      classification.merge.push(rel);
+    } else {
+      classification.replace.push(rel);
+    }
+  }
+  const replaceNew = classification.replace.filter((r) => !existsSync5(join3(destDir, r)));
+  const replaceUpdate = classification.replace.filter((r) => existsSync5(join3(destDir, r)));
+  const seedNew = classification.seed.filter((r) => !existsSync5(join3(destDir, r)));
+  const seedSkipped = classification.seed.filter((r) => existsSync5(join3(destDir, r)));
+  const shippedThemes = themeSyncEnabled ? await listShippedThemes(templatesRoot) : [];
+  const existingThemes = themeSyncEnabled ? await discoverInstalledThemes(destDir) : [];
+  const preservedThemes = existingThemes.filter((t) => !shippedThemes.includes(t));
+  const obsoleteFiles = await findObsoleteAppFiles(destDir, sharedDir);
+  log3.info(
+    `replace: ${pc3.green(`${replaceNew.length} added`)} / ${pc3.yellow(`${replaceUpdate.length} updated`)}`
+  );
+  log3.info(`merge:   ${pc3.cyan("package.json: sync ampless deps and managed scripts with the template")}`);
+  if (classification.seed.length > 0) {
+    log3.info(
+      `seed:    ${pc3.green(`${seedNew.length} added`)} / ${pc3.dim(`${seedSkipped.length} kept (existing *.custom.ts left untouched)`)}`
+    );
+  }
+  if (themeSyncEnabled) {
+    log3.info(
+      `themes:  ${pc3.cyan(`${shippedThemes.length} default themes synced`)} / ${pc3.dim(`${preservedThemes.length} custom (my-*) themes preserved`)}`
+    );
+  }
+  if (obsoleteFiles.length > 0) {
+    log3.info(`cleanup: ${pc3.yellow(`${obsoleteFiles.length} removed`)} (files under ampless-managed app/ paths that no longer exist in the template)`);
+  }
+  log3.info(`protected: ${pc3.dim(`${classification.protected.length} template files left untouched`)}`);
+  if (opts.dryRun) {
+    return {
+      added: replaceNew,
+      updated: replaceUpdate,
+      seeded: seedNew,
+      protected: classification.protected,
+      themesSynced: shippedThemes,
+      themesPreserved: preservedThemes,
+      packageJsonMerged: false,
+      obsoleteRemoved: obsoleteFiles
+    };
+  }
+  for (const rel of classification.replace) {
+    const src = join3(sharedDir, rel);
+    const dst = join3(destDir, rel);
+    await copyWithSubstitution(src, dst, vars);
+  }
+  for (const rel of seedNew) {
+    const src = join3(sharedDir, rel);
+    const dst = join3(destDir, rel);
+    await copyWithSubstitution(src, dst, vars);
+  }
+  const themeResult = themeSyncEnabled ? await syncThemes(destDir, templatesRoot) : { synced: [], preserved: [] };
+  await removeObsoleteAppFiles(destDir, obsoleteFiles);
+  const templatePkgRaw = await readFile3(join3(sharedDir, "package.json"), "utf-8");
+  const templatePkg = JSON.parse(templatePkgRaw);
+  const indent = detectIndent(projectPkgRaw);
+  for (const section of ["dependencies", "devDependencies"]) {
+    const templateDeps = templatePkg[section] ?? {};
+    const projectDeps = projectPkg[section] ?? {};
+    for (const [name, version] of Object.entries(templateDeps)) {
+      if (!AMPLESS_PACKAGES.has(name)) continue;
+      projectDeps[name] = version;
+    }
+    if (Object.keys(projectDeps).length > 0) {
+      projectPkg[section] = projectDeps;
+    }
+  }
+  const templateScripts = templatePkg["scripts"] ?? {};
+  const projectScripts = projectPkg["scripts"] ?? {};
+  for (const name of AMPLESS_MANAGED_SCRIPTS) {
+    if (name in templateScripts) {
+      projectScripts[name] = templateScripts[name];
+    } else {
+      delete projectScripts[name];
+    }
+  }
+  if (Object.keys(projectScripts).length > 0) {
+    projectPkg["scripts"] = projectScripts;
+  }
+  await writeFile3(projectPkgPath, JSON.stringify(projectPkg, null, indent) + "\n", "utf-8");
+  if (!opts.noInstall) {
+    const usePnpm = existsSync5(join3(destDir, "pnpm-lock.yaml"));
+    const pm = usePnpm ? "pnpm" : "npm";
+    await execa4(pm, ["install"], { cwd: destDir, stdio: "inherit" });
+  }
+  return {
+    added: replaceNew,
+    updated: replaceUpdate,
+    seeded: seedNew,
+    protected: classification.protected,
+    themesSynced: themeResult.synced,
+    themesPreserved: themeResult.preserved,
+    packageJsonMerged: true,
+    obsoleteRemoved: obsoleteFiles
+  };
+}
+async function runUpgrade(args) {
+  const destDir = process.cwd();
+  try {
+    await runUpgradeIn(destDir, sharedTemplateDir(), {
+      dryRun: args.dryRun,
+      noInstall: args.noInstall
+    });
+  } catch (err) {
+    log3.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+  if (args.dryRun) {
+    outro(`${pc3.dim("(dry-run) No files were changed.")}`);
+    return;
+  }
+  outro(
+    `${pc3.green("\u2714")} Upgrade complete
+
+  Next steps:
+    ${pc3.cyan("git diff")}              ${pc3.dim("# review changes")}
+    ${pc3.cyan("git commit && git push")}  ${pc3.dim("# deploy via Amplify Hosting")}`
+  );
+}
+
+// src/copy-theme.ts
+import { cp as cp3, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
+import { existsSync as existsSync6 } from "fs";
+import { join as join4 } from "path";
+import { log as log4, outro as outro2 } from "@clack/prompts";
+import pc4 from "picocolors";
+async function runCopyThemeIn(destDir, source, target) {
+  const problem = validateMountableProject(destDir);
+  if (problem) {
+    throw new Error(problem);
+  }
+  if (!isCustomTheme(target)) {
+    throw new Error(
+      `Target theme name must start with "${CUSTOM_THEME_PREFIX}" (got "${target}"). This prefix marks the theme as user-owned so create-ampless upgrade leaves it alone.`
+    );
+  }
+  if (source === target) {
+    throw new Error(`Source and target are identical (${source}).`);
+  }
+  const themesDir = join4(destDir, "themes");
+  const sourceDir = join4(themesDir, source);
+  const targetDir = join4(themesDir, target);
+  if (!existsSync6(sourceDir)) {
+    throw new Error(`Source theme not found: themes/${source}/`);
+  }
+  if (existsSync6(targetDir)) {
+    throw new Error(`Target theme already exists: themes/${target}/`);
+  }
+  await cp3(sourceDir, targetDir, { recursive: true });
+  const filesRewritten = await rewriteThemeName(targetDir, source, target);
+  const installed = await discoverInstalledThemes(destDir);
+  await writeFile4(join4(destDir, "themes-registry.ts"), buildRegistry(installed), "utf-8");
+  return { source, target, filesRewritten };
+}
+async function rewriteThemeName(targetDir, source, target) {
+  const touched = [];
+  await rewriteFile(
+    join4(targetDir, "index.ts"),
+    (s) => s.replace(new RegExp(`name:\\s*'${escapeRegex(source)}'`), `name: '${target}'`).replace(new RegExp(`name:\\s*"${escapeRegex(source)}"`), `name: "${target}"`),
+    touched
+  );
+  await rewriteFile(
+    join4(targetDir, "manifest.ts"),
+    (s) => s.replace(new RegExp(`name:\\s*'${escapeRegex(source)}'`), `name: '${target}'`).replace(new RegExp(`name:\\s*"${escapeRegex(source)}"`), `name: "${target}"`),
+    touched
+  );
+  await rewriteFile(
+    join4(targetDir, "tokens.css"),
+    (s) => s.replace(new RegExp(`\\[data-theme='${escapeRegex(source)}'\\]`, "g"), `[data-theme='${target}']`).replace(new RegExp(`\\[data-theme="${escapeRegex(source)}"\\]`, "g"), `[data-theme="${target}"]`),
+    touched
+  );
+  return touched;
+}
+async function rewriteFile(path, transform, touched) {
+  if (!existsSync6(path)) return;
+  const before = await readFile4(path, "utf-8");
+  const after = transform(before);
+  if (after === before) return;
+  await writeFile4(path, after, "utf-8");
+  touched.push(path);
+}
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+async function runCopyTheme(args) {
+  const destDir = process.cwd();
+  const source = args.copyThemeSource;
+  const target = args.copyThemeTarget;
+  if (!source || !target) {
+    log4.error("Usage: npx create-ampless@latest copy-theme <source> <target>");
+    log4.info("Example: npx create-ampless@latest copy-theme blog my-blog");
+    process.exit(1);
+  }
+  try {
+    const result = await runCopyThemeIn(destDir, source, target);
+    outro2(
+      `${pc4.green("\u2714")} Copied themes/${result.source}/ \u2192 themes/${result.target}/
+
+  Files rewritten:
+` + result.filesRewritten.map((f) => `    ${pc4.dim(f)}`).join("\n") + `
+
+  themes-registry.ts updated. Next:
+    ${pc4.cyan(`Open themes/${result.target}/ and start customising`)}
+    ${pc4.cyan(`Activate via /admin/sites/<siteId>/theme`)}`
+    );
+  } catch (err) {
+    log4.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+
+// src/index.ts
+import pc5 from "picocolors";
+var DEFAULT_THEMES = VALID_THEMES;
+function buildNonInteractiveOpts(args) {
+  const projectName = args.projectName ?? (() => {
+    const b = basename3(process.cwd());
+    return b && b !== "/" ? b : "my-ampless-site";
+  })();
+  const siteName = args.siteName ?? "My Blog";
+  const themes = args.themes ?? [...DEFAULT_THEMES];
+  const plugins = args.plugins ?? ["seo"];
+  return {
+    projectName,
+    siteName,
+    themes,
+    defaultTheme: themes[0],
+    plugins
+  };
+}
+function warnIgnoredScaffoldFlags(args) {
+  const ignored = [];
+  if (args.siteName) ignored.push("--site-name");
+  if (args.themes) ignored.push("--themes");
+  if (args.plugins) ignored.push("--plugins");
+  if (args.projectName) ignored.push("<project-name> positional");
+  if (ignored.length > 0) {
+    log5.warn(`--mount mode ignores: ${ignored.join(", ")}`);
+  }
+}
+async function runMount(args) {
+  const destDir = process.cwd();
+  const projectName = basename3(destDir);
+  warnIgnoredScaffoldFlags(args);
+  const problem = validateMountableProject(destDir);
+  if (problem) {
+    log5.error(problem);
+    log5.info(
+      "Run `npx create-ampless@latest <name>` first to scaffold, or `cd` into a scaffolded project before passing --mount."
+    );
+    process.exit(1);
+  }
+  const deployOpts = await gatherDeployOptions(args, destDir, projectName);
+  if (!deployOpts) return;
+  try {
+    const result = await runDeploy({ ...deployOpts, mount: true });
+    printDeployResult(result);
+  } catch (err) {
+    if (err instanceof PreflightError) {
+      process.exit(1);
+    }
+    log5.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+function printDeployResult(result) {
+  const lines = [
+    `${pc5.green("\u2714")} Project deployed`,
+    ``,
+    `  GitHub:        ${pc5.cyan(result.githubRepoUrl)}`,
+    `  Amplify app:   ${pc5.cyan(result.amplifyAppId)}`,
+    `  Amplify URL:   ${pc5.cyan(result.amplifyAppUrl)}`
+  ];
+  if (result.domainUrl) {
+    lines.push(`  Custom domain: ${pc5.cyan(result.domainUrl)}`);
+  }
+  if (result.domainVerification && result.domainVerification.length > 0) {
+    lines.push("", `  ${pc5.bold("Add these DNS records to verify the domain:")}`);
+    for (const v of result.domainVerification) {
+      lines.push(`    ${v.cname}  CNAME  ${v.target}`);
+    }
+  }
+  lines.push(
+    "",
+    `  First build is now running in Amplify Hosting.`,
+    `  Watch it at ${pc5.cyan(`https://console.aws.amazon.com/amplify/home#/${result.amplifyAppId}`)}`
+  );
+  outro3(lines.join("\n"));
+}
 async function main() {
-  const argProjectName = process.argv[2];
-  const opts = await runPrompts(argProjectName);
+  const args = parseDeployArgs(process.argv.slice(2));
+  if (args.help) {
+    process.stdout.write(HELP_TEXT);
+    return;
+  }
+  for (const flag of args.unknown) {
+    log5.warn(`Unknown argument ignored: ${flag}`);
+  }
+  if (args.upgrade) {
+    await runUpgrade(args);
+    return;
+  }
+  if (args.copyTheme) {
+    await runCopyTheme(args);
+    return;
+  }
+  if (args.mount) {
+    await runMount(args);
+    return;
+  }
+  let opts;
+  if (args.skipConfirm) {
+    opts = buildNonInteractiveOpts(args);
+  } else {
+    opts = await runPrompts(args.projectName);
+  }
   if (!opts) return;
-  const destDir = resolve3(process.cwd(), opts.projectName);
-  if (existsSync2(destDir)) {
-    log.error(`Directory already exists: ${destDir}`);
+  const destDir = resolve5(process.cwd(), opts.projectName);
+  if (existsSync7(destDir)) {
+    log5.error(`Directory already exists: ${destDir}`);
     process.exit(1);
   }
   const sharedDir = sharedTemplateDir();
-  const s = spinner();
+  const s = spinner2();
   s.start("Scaffolding project...");
   try {
     await scaffold(sharedDir, templatesDir, destDir, opts);
     s.stop("Done!");
   } catch (err) {
     s.stop("Failed.");
-    log.error(String(err));
+    log5.error(String(err));
     process.exit(1);
   }
-  outro(
-    `${pc.green("\u2714")} Project created at ${pc.bold(opts.projectName)}
+  if (args.deploy) {
+    const deployOpts = await gatherDeployOptions(args, destDir, opts.projectName);
+    if (!deployOpts) return;
+    try {
+      const result = await runDeploy(deployOpts);
+      printDeployResult(result);
+    } catch (err) {
+      if (err instanceof PreflightError) {
+        process.exit(1);
+      }
+      log5.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+    return;
+  }
+  outro3(
+    `${pc5.green("\u2714")} Project created at ${pc5.bold(opts.projectName)}
 
   Next steps:
-    ${pc.cyan("cd")} ${opts.projectName}
-    ${pc.cyan("npm install")}
-    ${pc.cyan("npx ampx sandbox")}   ${pc.dim("# start Amplify backend")}
-    ${pc.cyan("npm run dev")}         ${pc.dim("# start Next.js")}`
+    ${pc5.cyan("cd")} ${opts.projectName}
+    ${pc5.cyan("npm install")}
+    ${pc5.cyan("npm run sandbox")}   ${pc5.dim("# deploy sandbox + start Next.js")}`
   );
 }
 main().catch((err) => {