create-ampless 0.2.0-alpha.5 → 0.2.0-alpha.7

package/dist/index.js

@@ -2,8 +2,8 @@
 
 // src/index.ts
 import { spinner as spinner2, outro, log as log3 } from "@clack/prompts";
-import { existsSync as existsSync2 } from "fs";
-import { resolve as resolve4 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { basename as basename3, resolve as resolve5 } from "path";
 
 // src/prompts.ts
 import * as p from "@clack/prompts";
@@ -192,17 +192,25 @@ async function scaffold(sharedDir, themesRoot, destDir, opts) {
 }
 
 // src/args.ts
+var VALID_THEMES = ["blog", "minimal", "landing", "corporate", "docs", "dads"];
+var VALID_PLUGINS = ["seo", "rss", "webhook"];
 var STRING_FLAGS = /* @__PURE__ */ new Set([
+  "--site-name",
+  "--themes",
+  "--plugins",
   "--github-owner",
   "--github-token",
   "--aws-profile",
   "--aws-region",
   "--domain",
-  "--subdomain"
+  "--subdomain",
+  "--iam-service-role"
 ]);
 var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "--deploy",
+  "--mount",
   "--github-private",
+  "--create-iam-role",
   "--skip-confirm",
   "--help",
   "-h"
@@ -210,7 +218,9 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
 function parseDeployArgs(argv) {
   const out = {
     deploy: false,
+    mount: false,
     githubPrivate: false,
+    createIamRole: false,
     skipConfirm: false,
     help: false,
     unknown: []
@@ -229,9 +239,15 @@ function parseDeployArgs(argv) {
         case "--deploy":
           out.deploy = true;
           break;
+        case "--mount":
+          out.mount = true;
+          break;
         case "--github-private":
           out.githubPrivate = true;
           break;
+        case "--create-iam-role":
+          out.createIamRole = true;
+          break;
         case "--skip-confirm":
           out.skipConfirm = true;
           break;
@@ -248,6 +264,31 @@ function parseDeployArgs(argv) {
         throw new Error(`Missing value for ${token}`);
       }
       switch (token) {
+        case "--site-name":
+          out.siteName = value;
+          break;
+        case "--themes": {
+          const themes = value.split(",").map((t) => t.trim()).filter(Boolean);
+          const invalid = themes.filter((t) => !VALID_THEMES.includes(t));
+          if (invalid.length > 0) {
+            throw new Error(
+              `Invalid theme(s): ${invalid.join(", ")}. Valid values: ${VALID_THEMES.join(", ")}`
+            );
+          }
+          out.themes = themes;
+          break;
+        }
+        case "--plugins": {
+          const plugins = value.split(",").map((p3) => p3.trim()).filter(Boolean);
+          const invalid = plugins.filter((p3) => !VALID_PLUGINS.includes(p3));
+          if (invalid.length > 0) {
+            throw new Error(
+              `Invalid plugin(s): ${invalid.join(", ")}. Valid values: ${VALID_PLUGINS.join(", ")}`
+            );
+          }
+          out.plugins = plugins;
+          break;
+        }
         case "--github-owner":
           out.githubOwner = value;
           break;
@@ -266,6 +307,9 @@ function parseDeployArgs(argv) {
         case "--subdomain":
           out.subdomain = value;
           break;
+        case "--iam-service-role":
+          out.iamServiceRole = value;
+          break;
       }
       continue;
     }
@@ -285,10 +329,24 @@ var HELP_TEXT = `create-ampless \u2014 scaffold an ampless project
 
 Usage:
   npx create-ampless@alpha <project-name> [options]
+  npx create-ampless@alpha --mount [options]    # in an existing project dir
 
 Options:
+  --site-name <name>          Site display name (default: "My Blog")
+  --themes <list>             Comma-separated theme names to install
+                              Valid: blog, minimal, landing, corporate, docs, dads
+                              (default: blog)
+  --plugins <list>            Comma-separated plugin names to install
+                              Valid: seo, rss, webhook
+                              (default: seo)
   --deploy                    Also create GitHub repo + Amplify Hosting app and
                               kick off the first deploy after scaffolding
+  --mount                     Skip scaffolding and mount the CURRENT directory
+                              onto a new GitHub repo + Amplify Hosting app.
+                              Use after you've scaffolded and tested locally
+                              with 'npx ampx sandbox' and now want to publish.
+                              Implies --deploy. Scaffold flags (--site-name,
+                              --themes, --plugins) are ignored.
   --github-owner <login>      GitHub owner (user or org). Defaults to the
                               authenticated 'gh' user
   --github-private            Create a private repo (default: public)
@@ -298,26 +356,557 @@ Options:
   --aws-region <region>       AWS region (defaults to aws config / env)
   --domain <name>             Custom domain (apex or subdomain) to attach
   --subdomain <prefix>        Subdomain prefix for the domain (default: apex)
-  --skip-confirm              Don't ask 'proceed?' before running
+  --iam-service-role <arn>    Existing IAM role for Amplify Hosting (must trust
+                              amplify.amazonaws.com and have
+                              AdministratorAccess-Amplify attached)
+  --create-iam-role           Let create-ampless provision the Amplify Hosting
+                              service role (idempotent; defaults to role name
+                              AmplifyDeployBackend)
+  --skip-confirm              Skip all interactive prompts and use defaults /
+                              flag values (for CI / automation)
   -h, --help                  Show this message
 `;
 
 // src/deploy-prompts.ts
 import * as p2 from "@clack/prompts";
-import { execa as execa2 } from "execa";
+import { execa as execa3 } from "execa";
 
 // src/deploy.ts
-import { execa } from "execa";
+import { execa as execa2 } from "execa";
+import { existsSync as existsSync3 } from "fs";
 import { writeFile as writeFile2 } from "fs/promises";
-import { resolve as resolve3 } from "path";
+import { basename as basename2, resolve as resolve4 } from "path";
 import { spinner, log } from "@clack/prompts";
+import pc2 from "picocolors";
+
+// src/preflight.ts
+import { execa } from "execa";
+import { basename } from "path";
 import pc from "picocolors";
+var DEFAULT_AMPLIFY_ROLE_NAME = "AmplifyDeployBackend";
+var AMPLIFY_BACKEND_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess-Amplify";
+var TRUST_POLICY_JSON = JSON.stringify({
+  Version: "2012-10-17",
+  Statement: [
+    {
+      Effect: "Allow",
+      Principal: { Service: "amplify.amazonaws.com" },
+      Action: "sts:AssumeRole"
+    }
+  ]
+});
+async function tryExec(cmd, args) {
+  try {
+    const r = await execa(cmd, args, { reject: false, stdio: "pipe" });
+    return {
+      exitCode: r.exitCode ?? 0,
+      stdout: r.stdout?.toString() ?? "",
+      stderr: r.stderr?.toString() ?? ""
+    };
+  } catch (err) {
+    const e = err;
+    return {
+      exitCode: 1,
+      stdout: e.stdout ?? "",
+      stderr: e.stderr ?? e.message ?? String(err)
+    };
+  }
+}
+function awsBaseArgs(opts) {
+  const out = [];
+  if (opts.awsProfile) out.push("--profile", opts.awsProfile);
+  if (opts.awsRegion) out.push("--region", opts.awsRegion);
+  return out;
+}
+function awsCmd(opts, extra) {
+  return [...awsBaseArgs(opts), ...extra, "--output", "json"];
+}
+function shortName(opts) {
+  return basename(opts.projectDir);
+}
+async function checkGhInstalled(problems) {
+  const r = await tryExec("gh", ["--version"]);
+  if (r.exitCode !== 0) {
+    problems.push({
+      id: "gh-not-installed",
+      message: "GitHub CLI (`gh`) is not installed.",
+      remediation: [
+        "Install it (macOS: `brew install gh`; other OS: https://cli.github.com/),",
+        "then run `gh auth login` to sign in."
+      ]
+    });
+    return false;
+  }
+  return true;
+}
+async function checkGhAuth(problems) {
+  const r = await tryExec("gh", ["auth", "status"]);
+  const combined = `${r.stdout}
+${r.stderr}`;
+  if (r.exitCode !== 0 || /not logged in/i.test(combined)) {
+    problems.push({
+      id: "gh-not-authenticated",
+      message: "GitHub CLI is not authenticated.",
+      remediation: ["Run `gh auth login` and choose a method that includes the `repo` scope."]
+    });
+    return false;
+  }
+  const scopesMatch = combined.match(/Token scopes?:\s*([^\n]+)/i);
+  if (!scopesMatch) {
+    problems.push({
+      id: "gh-scopes-unknown",
+      message: "Could not determine GitHub token scopes from `gh auth status`.",
+      remediation: ["Run `gh auth refresh -s repo` to ensure the `repo` scope is granted."]
+    });
+    return false;
+  }
+  const hasRepo = /(^|[^a-z])repo([^a-z]|$)/i.test(scopesMatch[1]);
+  if (!hasRepo) {
+    problems.push({
+      id: "gh-missing-repo-scope",
+      message: "GitHub token is missing the `repo` scope.",
+      remediation: ["Run `gh auth refresh -s repo` to add the `repo` scope to your token."]
+    });
+    return false;
+  }
+  return true;
+}
+async function checkAwsInstalled(problems) {
+  const r = await tryExec("aws", ["--version"]);
+  if (r.exitCode !== 0) {
+    problems.push({
+      id: "aws-not-installed",
+      message: "AWS CLI (`aws`) is not installed.",
+      remediation: [
+        "Install it (macOS: `brew install awscli`; other OS: https://aws.amazon.com/cli/),",
+        "then run `aws configure` to set credentials."
+      ]
+    });
+    return false;
+  }
+  return true;
+}
+async function checkAwsCreds(opts, problems) {
+  const r = await tryExec("aws", [...awsBaseArgs(opts), "sts", "get-caller-identity", "--output", "json"]);
+  if (r.exitCode !== 0) {
+    problems.push({
+      id: "aws-credentials-missing",
+      message: "AWS credentials are not configured (sts get-caller-identity failed).",
+      remediation: [
+        "Run `aws configure` (or set AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN),",
+        opts.awsProfile ? `or check that profile \`${opts.awsProfile}\` exists in ~/.aws/config.` : "or pass --aws-profile <name> if you use named profiles."
+      ]
+    });
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(r.stdout);
+    const account = parsed.Account;
+    if (!account) {
+      problems.push({
+        id: "aws-identity-malformed",
+        message: "aws sts get-caller-identity did not return an Account field.",
+        remediation: ["Re-run `aws sts get-caller-identity` manually to inspect the response."]
+      });
+      return void 0;
+    }
+    let region = opts.awsRegion;
+    if (!region) {
+      const fromEnv = process.env.AWS_REGION?.trim() || process.env.AWS_DEFAULT_REGION?.trim();
+      if (fromEnv) region = fromEnv;
+    }
+    if (!region) {
+      const cfg = await tryExec("aws", [...awsBaseArgs(opts), "configure", "get", "region"]);
+      const trimmed = cfg.stdout.trim();
+      if (trimmed) region = trimmed;
+    }
+    if (!region) {
+      problems.push({
+        id: "aws-region-missing",
+        message: "AWS region is not set.",
+        remediation: [
+          "Pass --aws-region <name>, set AWS_REGION env var, or run `aws configure set region <name>`."
+        ]
+      });
+      return void 0;
+    }
+    return { account, region };
+  } catch (err) {
+    problems.push({
+      id: "aws-identity-parse-failed",
+      message: `Could not parse aws sts get-caller-identity response: ${err instanceof Error ? err.message : String(err)}`,
+      remediation: ["Re-run `aws sts get-caller-identity` manually to inspect the response."]
+    });
+    return void 0;
+  }
+}
+async function checkGithubRepoFree(opts, owner, problems) {
+  if (!owner) return;
+  const name = `${owner}/${shortName(opts)}`;
+  const r = await tryExec("gh", ["repo", "view", name]);
+  if (r.exitCode === 0) {
+    problems.push({
+      id: "github-repo-exists",
+      message: `GitHub repo ${name} already exists.`,
+      remediation: [
+        "Pick a different project name, or delete the existing repo first:",
+        `  gh repo delete ${name} --yes`
+      ]
+    });
+  }
+}
+async function checkAmplifyAppNameFree(opts, problems) {
+  const name = shortName(opts);
+  const r = await tryExec(
+    "aws",
+    awsCmd(opts, [
+      "amplify",
+      "list-apps",
+      "--query",
+      `apps[?name=='${name}']`
+    ])
+  );
+  if (r.exitCode !== 0) {
+    problems.push({
+      id: "amplify-list-apps-failed",
+      message: "Could not list Amplify Hosting apps to check for a name collision.",
+      remediation: [
+        "Verify your IAM identity has `amplify:ListApps` permission, then re-run.",
+        `Raw error: ${r.stderr.trim() || r.stdout.trim()}`
+      ]
+    });
+    return;
+  }
+  try {
+    const arr = JSON.parse(r.stdout);
+    if (Array.isArray(arr) && arr.length > 0) {
+      problems.push({
+        id: "amplify-app-name-taken",
+        message: `Amplify Hosting already has an app named "${name}" in this region.`,
+        remediation: [
+          "Pick a different project name, or delete the existing app first:",
+          `  aws amplify list-apps --query "apps[?name=='${name}'].appId" --output text${opts.awsProfile ? ` --profile ${opts.awsProfile}` : ""}${opts.awsRegion ? ` --region ${opts.awsRegion}` : ""}`,
+          "  aws amplify delete-app --app-id <appId>"
+        ]
+      });
+    }
+  } catch {
+  }
+}
+async function checkCdkBootstrap(opts, identity, problems) {
+  const r = await tryExec(
+    "aws",
+    [
+      ...awsBaseArgs(opts),
+      "ssm",
+      "get-parameter",
+      "--name",
+      "/cdk-bootstrap/hnb659fds/version",
+      "--output",
+      "json"
+    ]
+  );
+  if (r.exitCode !== 0) {
+    problems.push({
+      id: "cdk-not-bootstrapped",
+      message: `CDK is not bootstrapped in region ${identity.region}.`,
+      remediation: [
+        `Run: npx cdk bootstrap aws://${identity.account}/${identity.region}`
+      ]
+    });
+  }
+}
+async function checkRoute53Zone(opts, problems) {
+  if (!opts.domain) return;
+  const registrable = extractRegistrableDomain(opts.domain);
+  const r = await tryExec(
+    "aws",
+    [
+      ...awsBaseArgs(opts),
+      "route53",
+      "list-hosted-zones-by-name",
+      "--dns-name",
+      registrable,
+      "--max-items",
+      "1",
+      "--output",
+      "json"
+    ]
+  );
+  if (r.exitCode !== 0) {
+    problems.push({
+      id: "route53-list-failed",
+      message: `Could not query Route 53 for zone ${registrable}.`,
+      remediation: [
+        "Either grant `route53:ListHostedZonesByName` to your IAM identity,",
+        "or be prepared to add the CNAME records Amplify prints manually after deploy.",
+        `Raw error: ${r.stderr.trim() || r.stdout.trim()}`
+      ]
+    });
+    return;
+  }
+  try {
+    const parsed = JSON.parse(r.stdout);
+    const zones = parsed.HostedZones ?? [];
+    const found = zones.some(
+      (z) => z.Name && z.Name.replace(/\.$/, "") === registrable
+    );
+    if (!found) {
+      problems.push({
+        id: "route53-zone-missing",
+        message: `No Route 53 hosted zone for ${registrable} found in this AWS account.`,
+        remediation: [
+          "Amplify will still issue an ACM certificate, but you will need to add",
+          "the verification CNAMEs at your DNS provider manually. If you want",
+          "auto-validation, create a hosted zone first:",
+          `  aws route53 create-hosted-zone --name ${registrable} --caller-reference $(date +%s)${opts.awsProfile ? ` --profile ${opts.awsProfile}` : ""}`
+        ]
+      });
+    }
+  } catch {
+  }
+}
+async function resolveIamServiceRole(opts, args, problems) {
+  if (args.explicitArn) {
+    const roleName = args.explicitArn.split("/").pop() ?? args.explicitArn;
+    const r = await tryExec(
+      "aws",
+      [
+        ...awsBaseArgs(opts),
+        "iam",
+        "get-role",
+        "--role-name",
+        roleName,
+        "--output",
+        "json"
+      ]
+    );
+    if (r.exitCode !== 0) {
+      problems.push({
+        id: "iam-service-role-not-found",
+        message: `IAM role ${args.explicitArn} not found or inaccessible.`,
+        remediation: [
+          "Verify the ARN is correct and the role exists:",
+          `  aws iam get-role --role-name ${roleName}${opts.awsProfile ? ` --profile ${opts.awsProfile}` : ""}`
+        ]
+      });
+      return { willCreate: false };
+    }
+    return { arn: args.explicitArn, willCreate: false };
+  }
+  if (args.willCreate) {
+    return { willCreate: true };
+  }
+  const found = await findExistingAmplifyServiceRole(opts);
+  if (found) {
+    return { arn: found, willCreate: false };
+  }
+  problems.push({
+    id: "iam-service-role-missing",
+    message: "No Amplify Hosting service role found.",
+    remediation: [
+      "Either pass --iam-service-role <arn> pointing at an existing role,",
+      "or let create-ampless build one for you with --create-iam-role.",
+      "",
+      "Alternatively, create one yourself:",
+      `  aws iam create-role --role-name ${DEFAULT_AMPLIFY_ROLE_NAME} \\`,
+      `    --assume-role-policy-document '${TRUST_POLICY_JSON}'`,
+      `  aws iam attach-role-policy --role-name ${DEFAULT_AMPLIFY_ROLE_NAME} \\`,
+      `    --policy-arn ${AMPLIFY_BACKEND_POLICY_ARN}`,
+      `  # then re-run with: --iam-service-role $(aws iam get-role --role-name ${DEFAULT_AMPLIFY_ROLE_NAME} --query Role.Arn --output text)`
+    ]
+  });
+  return { willCreate: false };
+}
+function trustPolicyAllowsAmplify(doc) {
+  let parsed = doc;
+  if (typeof doc === "string") {
+    try {
+      parsed = JSON.parse(decodeURIComponent(doc));
+    } catch {
+      try {
+        parsed = JSON.parse(doc);
+      } catch {
+        return false;
+      }
+    }
+  }
+  const stmts = parsed?.Statement;
+  const arr = Array.isArray(stmts) ? stmts : stmts ? [stmts] : [];
+  for (const stmt of arr) {
+    const s = stmt;
+    const svc = s.Principal?.Service;
+    if (typeof svc === "string" && svc === "amplify.amazonaws.com") return true;
+    if (Array.isArray(svc) && svc.includes("amplify.amazonaws.com")) return true;
+  }
+  return false;
+}
+async function findExistingAmplifyServiceRole(opts) {
+  let marker;
+  for (let page = 0; page < 20; page++) {
+    const args = [
+      ...awsBaseArgs(opts),
+      "iam",
+      "list-roles",
+      "--max-items",
+      "200",
+      "--output",
+      "json"
+    ];
+    if (marker) args.push("--starting-token", marker);
+    const r = await tryExec("aws", args);
+    if (r.exitCode !== 0) return void 0;
+    let parsed;
+    try {
+      parsed = JSON.parse(r.stdout);
+    } catch {
+      return void 0;
+    }
+    for (const role of parsed.Roles ?? []) {
+      if (!role.RoleName || !role.Arn) continue;
+      if (!trustPolicyAllowsAmplify(role.AssumeRolePolicyDocument)) continue;
+      const pr = await tryExec(
+        "aws",
+        [
+          ...awsBaseArgs(opts),
+          "iam",
+          "list-attached-role-policies",
+          "--role-name",
+          role.RoleName,
+          "--output",
+          "json"
+        ]
+      );
+      if (pr.exitCode !== 0) continue;
+      try {
+        const policies = JSON.parse(pr.stdout);
+        const attached = (policies.AttachedPolicies ?? []).some(
+          (p3) => p3.PolicyArn === AMPLIFY_BACKEND_POLICY_ARN
+        );
+        if (attached) return role.Arn;
+      } catch {
+        continue;
+      }
+    }
+    if (!parsed.IsTruncated) break;
+    marker = parsed.Marker;
+    if (!marker) break;
+  }
+  return void 0;
+}
+async function runPreflight(opts, extra = {}) {
+  const problems = [];
+  const hasGh = await checkGhInstalled(problems);
+  if (hasGh) await checkGhAuth(problems);
+  const hasAws = await checkAwsInstalled(problems);
+  const identity = hasAws ? await checkAwsCreds(opts, problems) : void 0;
+  if (hasGh && opts.githubOwner && !extra.mountMode) {
+    await checkGithubRepoFree(opts, opts.githubOwner, problems);
+  }
+  if (identity) {
+    await checkAmplifyAppNameFree(opts, problems);
+    await checkCdkBootstrap(opts, identity, problems);
+    await checkRoute53Zone(opts, problems);
+  }
+  let willCreateIamRole = false;
+  let iamServiceRoleArn;
+  if (identity) {
+    const resolved = await resolveIamServiceRole(
+      opts,
+      { explicitArn: extra.iamServiceRoleArn, willCreate: extra.createIamRole === true },
+      problems
+    );
+    willCreateIamRole = resolved.willCreate;
+    iamServiceRoleArn = resolved.arn;
+  }
+  if (problems.length > 0) {
+    return { problems };
+  }
+  return {
+    problems,
+    resolution: {
+      iamServiceRoleArn,
+      willCreateIamRole,
+      awsAccount: identity.account,
+      awsRegion: identity.region
+    }
+  };
+}
+function formatPreflightReport(problems) {
+  const lines = [];
+  lines.push(`${pc.red("\u2717")} create-ampless --deploy: prerequisites missing`);
+  lines.push("");
+  for (const p3 of problems) {
+    lines.push(`  ${pc.red("\u2717")} ${p3.message}`);
+    for (const r of p3.remediation) {
+      lines.push(r ? `    ${r}` : "");
+    }
+    lines.push("");
+  }
+  lines.push("Fix the items above and re-run.");
+  return lines.join("\n");
+}
+function printPreflightReport(problems) {
+  process.stderr.write(`${formatPreflightReport(problems)}
+`);
+}
+
+// src/mount.ts
+import { existsSync as existsSync2 } from "fs";
+import { resolve as resolve3 } from "path";
+function validateMountableProject(destDir) {
+  const required = ["package.json", "cms.config.ts"];
+  for (const f of required) {
+    if (!existsSync2(resolve3(destDir, f))) {
+      return `Not an ampless project (missing ${f} in ${destDir})`;
+    }
+  }
+  const amplifyFiles = ["amplify/backend.ts", "amplify/data/resource.ts"];
+  if (!amplifyFiles.some((f) => existsSync2(resolve3(destDir, f)))) {
+    return `Not an ampless project (missing amplify/ in ${destDir})`;
+  }
+  return null;
+}
+var MOUNT_DEFAULT_GITIGNORE = `# Dependencies
+node_modules/
+
+# Next.js
+.next/
+.amplify/
+
+# Amplify outputs (regenerated on every deploy / sandbox)
+amplify_outputs.json
+
+# Env / OS noise
+.env
+.env.local
+.env.*.local
+.DS_Store
+
+# Logs
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+`;
+function originPointsAt(origin, owner, name) {
+  const candidates = [
+    `https://github.com/${owner}/${name}`,
+    `https://github.com/${owner}/${name}.git`,
+    `git@github.com:${owner}/${name}`,
+    `git@github.com:${owner}/${name}.git`,
+    `ssh://git@github.com/${owner}/${name}`,
+    `ssh://git@github.com/${owner}/${name}.git`
+  ];
+  return candidates.includes(origin);
+}
+
+// src/deploy.ts
 var AMPLIFY_BUILD_SPEC = `version: 1
 frontend:
   phases:
     preBuild:
       commands:
-        - npm ci
+        - npm install
     build:
       commands:
         - npx ampx pipeline-deploy --branch $AWS_BRANCH --app-id $AWS_APP_ID
@@ -336,7 +925,7 @@ async function resolveGithubToken(explicit, env = process.env) {
   const envToken = env.GITHUB_TOKEN;
   if (envToken && envToken.trim()) return envToken.trim();
   try {
-    const { stdout } = await execa("gh", ["auth", "token"], { reject: false });
+    const { stdout } = await execa2("gh", ["auth", "token"], { reject: false });
     const trimmed = stdout?.trim();
     if (trimmed) return trimmed;
   } catch {
@@ -400,7 +989,7 @@ function splitDomain(domain, subdomain) {
 async function run(cmd, args, opts = {}) {
   const { step, ...execaOpts } = opts;
   try {
-    const result = await execa(cmd, args, { stdio: "pipe", ...execaOpts });
+    const result = await execa2(cmd, args, { stdio: "pipe", ...execaOpts });
     return result.stdout?.toString() ?? "";
   } catch (err) {
     const e = err;
@@ -410,15 +999,6 @@ async function run(cmd, args, opts = {}) {
 ${detail}`);
   }
 }
-async function ensureCommandExists(cmd) {
-  try {
-    await execa(cmd, ["--version"], { stdio: "ignore" });
-  } catch {
-    const hint = cmd === "gh" ? "Install with `brew install gh` (or see https://cli.github.com/) then run `gh auth login`." : "Install with `brew install awscli` (or see https://aws.amazon.com/cli/) then run `aws configure`.";
-    throw new Error(`Required command not found: ${cmd}
-${hint}`);
-  }
-}
 function awsArgs(opts, extra) {
   const base = [];
   if (opts.awsProfile) base.push("--profile", opts.awsProfile);
@@ -427,24 +1007,108 @@ function awsArgs(opts, extra) {
   base.push("--output", "json");
   return base;
 }
-async function gitInitCommit(dir) {
-  await run("git", ["init", "-b", "main"], { cwd: dir, step: "git init" });
-  await run("git", ["add", "."], { cwd: dir, step: "git add" });
-  await run(
-    "git",
-    ["commit", "-m", "Initial scaffold (create-ampless)"],
-    { cwd: dir, step: "git commit" }
-  );
+async function isGitRepo(dir) {
+  const r = await execa2("git", ["rev-parse", "--git-dir"], { cwd: dir, reject: false });
+  return r.exitCode === 0;
+}
+async function isDirty(dir) {
+  const r = await execa2("git", ["status", "--porcelain"], { cwd: dir, reject: false });
+  return (r.stdout?.toString() ?? "").trim().length > 0;
+}
+async function currentBranch(dir) {
+  const r = await execa2("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    cwd: dir,
+    reject: false
+  });
+  if (r.exitCode !== 0) return null;
+  const name = r.stdout?.toString().trim();
+  return name && name !== "HEAD" ? name : null;
+}
+async function ensureGitignore(dir) {
+  const target = resolve4(dir, ".gitignore");
+  if (existsSync3(target)) return;
+  await writeFile2(target, MOUNT_DEFAULT_GITIGNORE, "utf-8");
+}
+async function gitInitOrReuse(dir, mount) {
+  const repo = await isGitRepo(dir);
+  if (!repo) {
+    await run("git", ["init", "-b", "main"], { cwd: dir, step: "git init" });
+  }
+  const dirty = await isDirty(dir);
+  if (dirty) {
+    await run("git", ["add", "."], { cwd: dir, step: "git add" });
+    const message = mount && repo ? "Prepare for create-ampless --mount" : "Initial scaffold (create-ampless)";
+    await run("git", ["commit", "-m", message], { cwd: dir, step: "git commit" });
+  }
+  if (mount) {
+    const branch = await currentBranch(dir);
+    if (branch && branch !== "main") {
+      log.warn(
+        `Current branch is "${branch}" \u2014 Amplify Hosting will be wired to the "main" branch. Push from "main" later, or rename your branch with \`git branch -m main\`.`
+      );
+    }
+  }
+}
+function shortName2(opts) {
+  return basename2(opts.projectDir);
+}
+async function ghRepoExists(name, token) {
+  const r = await execa2("gh", ["repo", "view", name], {
+    reject: false,
+    env: { ...process.env, GH_TOKEN: token }
+  });
+  return r.exitCode === 0;
+}
+async function getOriginUrl(dir) {
+  const r = await execa2("git", ["remote", "get-url", "origin"], {
+    cwd: dir,
+    reject: false
+  });
+  if (r.exitCode !== 0) return null;
+  const url = r.stdout?.toString().trim();
+  return url ? url : null;
+}
+function repoHttpsUrl(owner, name) {
+  return `https://github.com/${owner}/${name}`;
 }
 async function ghRepoCreate(opts) {
+  const owner = opts.githubOwner;
+  const name = shortName2(opts);
+  const fullName = `${owner}/${name}`;
   const visibility = opts.githubPrivate ? "--private" : "--public";
-  const name = `${opts.githubOwner}/${opts.projectName}`;
+  const exists = await ghRepoExists(fullName, opts.githubToken);
+  if (exists) {
+    const origin = await getOriginUrl(opts.projectDir);
+    if (origin && !originPointsAt(origin, owner, name)) {
+      throw new Error(
+        `Existing 'origin' remote points at ${origin}, but --mount expects ${fullName}.
+Remove or rename the existing remote (\`git remote remove origin\`) and re-run.`
+      );
+    }
+    if (!origin) {
+      await run(
+        "git",
+        ["remote", "add", "origin", `https://github.com/${fullName}.git`],
+        { cwd: opts.projectDir, step: "git remote add origin" }
+      );
+    }
+    await run(
+      "git",
+      ["push", "-u", "origin", "HEAD:main"],
+      {
+        cwd: opts.projectDir,
+        step: "git push origin main",
+        env: { ...process.env, GH_TOKEN: opts.githubToken }
+      }
+    );
+    return repoHttpsUrl(owner, name);
+  }
   const out = await run(
     "gh",
     [
       "repo",
       "create",
-      name,
+      fullName,
       "--source",
       opts.projectDir,
       "--push",
@@ -460,25 +1124,29 @@ async function ghRepoCreate(opts) {
   );
   const match = out.match(/https:\/\/github\.com\/[^\s]+/g);
   if (match && match.length > 0) return match[match.length - 1].replace(/[.,]$/, "");
-  return `https://github.com/${name}`;
+  return repoHttpsUrl(owner, name);
 }
-async function amplifyCreateApp(opts, repoUrl) {
+async function amplifyCreateApp(opts, repoUrl, iamServiceRoleArn) {
+  const cmd = [
+    "amplify",
+    "create-app",
+    "--name",
+    shortName2(opts),
+    "--repository",
+    repoUrl,
+    "--access-token",
+    opts.githubToken,
+    "--platform",
+    "WEB_COMPUTE",
+    "--build-spec",
+    AMPLIFY_BUILD_SPEC
+  ];
+  if (iamServiceRoleArn) {
+    cmd.push("--iam-service-role-arn", iamServiceRoleArn);
+  }
   const out = await run(
     "aws",
-    awsArgs(opts, [
-      "amplify",
-      "create-app",
-      "--name",
-      opts.projectName,
-      "--repository",
-      repoUrl,
-      "--access-token",
-      opts.githubToken,
-      "--platform",
-      "WEB_COMPUTE",
-      "--build-spec",
-      AMPLIFY_BUILD_SPEC
-    ]),
+    awsArgs(opts, cmd),
     { step: "aws amplify create-app" }
   );
   const parsed = JSON.parse(out);
@@ -552,7 +1220,7 @@ async function amplifyCreateDomain(opts, appId) {
   const route53Zone = await findRoute53Zone(opts, registrable);
   if (route53Zone) {
     log.info(
-      `Route 53 hosted zone detected for ${pc.cyan(registrable)} \u2014 Amplify will auto-create DNS records once ACM validates.`
+      `Route 53 hosted zone detected for ${pc2.cyan(registrable)} \u2014 Amplify will auto-create DNS records once ACM validates.`
     );
   }
   const out = await run(
@@ -598,10 +1266,94 @@ async function amplifyCreateDomain(opts, appId) {
     verification: route53Zone ? void 0 : verification.length > 0 ? verification : void 0
   };
 }
+async function provisionIamServiceRole(opts) {
+  const roleName = DEFAULT_AMPLIFY_ROLE_NAME;
+  const trustPolicy = JSON.stringify({
+    Version: "2012-10-17",
+    Statement: [
+      {
+        Effect: "Allow",
+        Principal: { Service: "amplify.amazonaws.com" },
+        Action: "sts:AssumeRole"
+      }
+    ]
+  });
+  const createArgs = [
+    "iam",
+    "create-role",
+    "--role-name",
+    roleName,
+    "--assume-role-policy-document",
+    trustPolicy,
+    "--description",
+    "Amplify Hosting service role created by create-ampless"
+  ];
+  try {
+    await run("aws", awsArgs(opts, createArgs), { step: "aws iam create-role" });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (!/EntityAlreadyExists/i.test(msg) && !/already exists/i.test(msg)) {
+      throw err;
+    }
+  }
+  await run(
+    "aws",
+    awsArgs(opts, [
+      "iam",
+      "attach-role-policy",
+      "--role-name",
+      roleName,
+      "--policy-arn",
+      AMPLIFY_BACKEND_POLICY_ARN
+    ]),
+    { step: "aws iam attach-role-policy" }
+  );
+  const out = await run(
+    "aws",
+    awsArgs(opts, ["iam", "get-role", "--role-name", roleName]),
+    { step: "aws iam get-role" }
+  );
+  const parsed = JSON.parse(out);
+  const arn = parsed.Role?.Arn;
+  if (!arn) {
+    throw new Error(`aws iam get-role for ${roleName}: missing Role.Arn in response`);
+  }
+  return arn;
+}
+var PreflightError = class extends Error {
+  result;
+  constructor(result) {
+    super("create-ampless --deploy: pre-flight failed");
+    this.name = "PreflightError";
+    this.result = result;
+  }
+};
 async function runDeploy(opts) {
-  await ensureCommandExists("gh");
-  await ensureCommandExists("aws");
-  await writeFile2(resolve3(opts.projectDir, "amplify.yml"), AMPLIFY_BUILD_SPEC, "utf-8");
+  const pre = await runPreflight(opts, {
+    iamServiceRoleArn: opts.iamServiceRoleArn,
+    createIamRole: opts.createIamRole === true,
+    mountMode: opts.mount === true
+  });
+  if (pre.problems.length > 0) {
+    printPreflightReport(pre.problems);
+    throw new PreflightError(pre);
+  }
+  const resolution = pre.resolution;
+  let serviceRoleArn = resolution.iamServiceRoleArn;
+  if (resolution.willCreateIamRole && !serviceRoleArn) {
+    const s0 = spinner();
+    s0.start(`Provisioning IAM service role ${DEFAULT_AMPLIFY_ROLE_NAME}`);
+    try {
+      serviceRoleArn = await provisionIamServiceRole(opts);
+      s0.stop(`IAM role: ${serviceRoleArn}`);
+    } catch (err) {
+      s0.stop("IAM role provisioning: failed");
+      throw new Error(
+        `Failed to provision IAM service role: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  await writeFile2(resolve4(opts.projectDir, "amplify.yml"), AMPLIFY_BUILD_SPEC, "utf-8");
   const created = {};
   const fail = (step, cause) => {
     const msg = cause instanceof Error ? cause.message : String(cause);
@@ -613,7 +1365,7 @@ async function runDeploy(opts) {
     }
     if (created.repoUrl) {
       cleanup.push(
-        `  - GitHub repo: ${created.repoUrl} (delete: gh repo delete ${opts.githubOwner}/${opts.projectName} --yes)`
+        `  - GitHub repo: ${created.repoUrl} (delete: gh repo delete ${opts.githubOwner}/${shortName2(opts)} --yes)`
       );
     }
     const cleanupBlock = cleanup.length > 0 ? `
@@ -625,10 +1377,14 @@ Re-run after cleaning up.` : "";
 ${msg}${cleanupBlock}`);
   };
   let s = spinner();
-  s.start("git init + initial commit");
+  const gitMsg = opts.mount ? "git: preparing repo for mount" : "git init + initial commit";
+  s.start(gitMsg);
   try {
-    await gitInitCommit(opts.projectDir);
-    s.stop("git: committed initial scaffold");
+    if (opts.mount) {
+      await ensureGitignore(opts.projectDir);
+    }
+    await gitInitOrReuse(opts.projectDir, opts.mount === true);
+    s.stop(opts.mount ? "git: ready" : "git: committed initial scaffold");
   } catch (err) {
     s.stop("git: failed");
     fail("git init / commit", err);
@@ -646,7 +1402,7 @@ ${msg}${cleanupBlock}`);
   s = spinner();
   s.start("Creating Amplify Hosting app");
   try {
-    app = await amplifyCreateApp(opts, created.repoUrl);
+    app = await amplifyCreateApp(opts, created.repoUrl, serviceRoleArn);
     created.appId = app.appId;
     s.stop(`Amplify app: ${app.appId}`);
   } catch (err) {
@@ -671,7 +1427,7 @@ ${msg}${cleanupBlock}`);
     s.stop("Amplify start-job: failed");
     fail("aws amplify start-job", err);
   }
-  const amplifyAppUrl = `https://main.${app.appId}.${app.defaultDomain}`;
+  const amplifyAppUrl = `https://main.${app.defaultDomain}`;
   const result = {
     githubRepoUrl: created.repoUrl,
     amplifyAppId: app.appId,
@@ -698,7 +1454,7 @@ ${msg}`);
 // src/deploy-prompts.ts
 async function detectGithubLogin() {
   try {
-    const { stdout } = await execa2("gh", ["api", "user", "--jq", ".login"], { reject: false });
+    const { stdout } = await execa3("gh", ["api", "user", "--jq", ".login"], { reject: false });
     const trimmed = stdout?.trim();
     return trimmed || void 0;
   } catch {
@@ -709,7 +1465,7 @@ async function detectAwsRegion() {
   if (process.env.AWS_REGION?.trim()) return process.env.AWS_REGION.trim();
   if (process.env.AWS_DEFAULT_REGION?.trim()) return process.env.AWS_DEFAULT_REGION.trim();
   try {
-    const { stdout } = await execa2("aws", ["configure", "get", "region"], { reject: false });
+    const { stdout } = await execa3("aws", ["configure", "get", "region"], { reject: false });
     const trimmed = stdout?.trim();
     return trimmed || void 0;
   } catch {
@@ -836,12 +1592,89 @@ async function gatherDeployOptions(args, projectDir, projectName) {
     awsRegion,
     domain,
     subdomain,
+    iamServiceRoleArn: args.iamServiceRole,
+    createIamRole: args.createIamRole,
     skipConfirm: args.skipConfirm
   };
 }
 
 // src/index.ts
-import pc2 from "picocolors";
+import pc3 from "picocolors";
+function buildNonInteractiveOpts(args) {
+  const projectName = args.projectName ?? (() => {
+    const b = basename3(process.cwd());
+    return b && b !== "/" ? b : "my-ampless-site";
+  })();
+  const siteName = args.siteName ?? "My Blog";
+  const themes = args.themes ?? ["blog"];
+  const plugins = args.plugins ?? ["seo"];
+  return {
+    projectName,
+    siteName,
+    themes,
+    defaultTheme: themes[0],
+    plugins
+  };
+}
+function warnIgnoredScaffoldFlags(args) {
+  const ignored = [];
+  if (args.siteName) ignored.push("--site-name");
+  if (args.themes) ignored.push("--themes");
+  if (args.plugins) ignored.push("--plugins");
+  if (args.projectName) ignored.push("<project-name> positional");
+  if (ignored.length > 0) {
+    log3.warn(`--mount mode ignores: ${ignored.join(", ")}`);
+  }
+}
+async function runMount(args) {
+  const destDir = process.cwd();
+  const projectName = basename3(destDir);
+  warnIgnoredScaffoldFlags(args);
+  const problem = validateMountableProject(destDir);
+  if (problem) {
+    log3.error(problem);
+    log3.info(
+      "Run `npx create-ampless@alpha <name>` first to scaffold, or `cd` into a scaffolded project before passing --mount."
+    );
+    process.exit(1);
+  }
+  const deployOpts = await gatherDeployOptions(args, destDir, projectName);
+  if (!deployOpts) return;
+  try {
+    const result = await runDeploy({ ...deployOpts, mount: true });
+    printDeployResult(result);
+  } catch (err) {
+    if (err instanceof PreflightError) {
+      process.exit(1);
+    }
+    log3.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+function printDeployResult(result) {
+  const lines = [
+    `${pc3.green("\u2714")} Project deployed`,
+    ``,
+    `  GitHub:        ${pc3.cyan(result.githubRepoUrl)}`,
+    `  Amplify app:   ${pc3.cyan(result.amplifyAppId)}`,
+    `  Amplify URL:   ${pc3.cyan(result.amplifyAppUrl)}`
+  ];
+  if (result.domainUrl) {
+    lines.push(`  Custom domain: ${pc3.cyan(result.domainUrl)}`);
+  }
+  if (result.domainVerification && result.domainVerification.length > 0) {
+    lines.push("", `  ${pc3.bold("Add these DNS records to verify the domain:")}`);
+    for (const v of result.domainVerification) {
+      lines.push(`    ${v.cname}  CNAME  ${v.target}`);
+    }
+  }
+  lines.push(
+    "",
+    `  First build is now running in Amplify Hosting.`,
+    `  Watch it at ${pc3.cyan(`https://console.aws.amazon.com/amplify/home#/${result.amplifyAppId}`)}`
+  );
+  outro(lines.join("\n"));
+}
 async function main() {
   const args = parseDeployArgs(process.argv.slice(2));
   if (args.help) {
@@ -851,10 +1684,19 @@ async function main() {
   for (const flag of args.unknown) {
     log3.warn(`Unknown argument ignored: ${flag}`);
   }
-  const opts = await runPrompts(args.projectName);
+  if (args.mount) {
+    await runMount(args);
+    return;
+  }
+  let opts;
+  if (args.skipConfirm) {
+    opts = buildNonInteractiveOpts(args);
+  } else {
+    opts = await runPrompts(args.projectName);
+  }
   if (!opts) return;
-  const destDir = resolve4(process.cwd(), opts.projectName);
-  if (existsSync2(destDir)) {
+  const destDir = resolve5(process.cwd(), opts.projectName);
+  if (existsSync4(destDir)) {
     log3.error(`Directory already exists: ${destDir}`);
     process.exit(1);
   }
@@ -874,42 +1716,24 @@ async function main() {
     if (!deployOpts) return;
     try {
       const result = await runDeploy(deployOpts);
-      const lines = [
-        `${pc2.green("\u2714")} Project deployed`,
-        ``,
-        `  GitHub:        ${pc2.cyan(result.githubRepoUrl)}`,
-        `  Amplify app:   ${pc2.cyan(result.amplifyAppId)}`,
-        `  Amplify URL:   ${pc2.cyan(result.amplifyAppUrl)}`
-      ];
-      if (result.domainUrl) {
-        lines.push(`  Custom domain: ${pc2.cyan(result.domainUrl)}`);
-      }
-      if (result.domainVerification && result.domainVerification.length > 0) {
-        lines.push("", `  ${pc2.bold("Add these DNS records to verify the domain:")}`);
-        for (const v of result.domainVerification) {
-          lines.push(`    ${v.cname}  CNAME  ${v.target}`);
-        }
-      }
-      lines.push(
-        "",
-        `  First build is now running in Amplify Hosting.`,
-        `  Watch it at ${pc2.cyan(`https://console.aws.amazon.com/amplify/home#/${result.amplifyAppId}`)}`
-      );
-      outro(lines.join("\n"));
+      printDeployResult(result);
     } catch (err) {
+      if (err instanceof PreflightError) {
+        process.exit(1);
+      }
       log3.error(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
     return;
   }
   outro(
-    `${pc2.green("\u2714")} Project created at ${pc2.bold(opts.projectName)}
+    `${pc3.green("\u2714")} Project created at ${pc3.bold(opts.projectName)}
 
   Next steps:
-    ${pc2.cyan("cd")} ${opts.projectName}
-    ${pc2.cyan("npm install")}
-    ${pc2.cyan("npx ampx sandbox")}   ${pc2.dim("# start Amplify backend")}
-    ${pc2.cyan("npm run dev")}         ${pc2.dim("# start Next.js")}`
+    ${pc3.cyan("cd")} ${opts.projectName}
+    ${pc3.cyan("npm install")}
+    ${pc3.cyan("npx ampx sandbox")}   ${pc3.dim("# start Amplify backend")}
+    ${pc3.cyan("npm run dev")}         ${pc3.dim("# start Next.js")}`
   );
 }
 main().catch((err) => {

package/dist/templates/_shared/amplify/data/resource.ts

@@ -1,6 +1,17 @@
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
 import { a, defineData, type ClientSchema } from '@aws-amplify/backend'
 import { amplessSchemaModels, defaultAuthorizationModes } from '@ampless/backend'
 
+// AppSync's `a.handler.custom({ entry })` paths are resolved by CDK
+// relative to the file that called `a.handler.custom`. When the call
+// originates inside `@ampless/backend` (via amplessSchemaModels), the
+// CDK synth tries to resolve `./list-published-posts.js` relative to
+// `node_modules/@ampless/backend/dist/index.js` and fails with
+// `UnresolvedEntryPathError`. Anchor the resolver paths at THIS file's
+// directory so the result is unambiguous.
+const __dirname = dirname(fileURLToPath(import.meta.url))
+
 // Ampless's built-in models (Post / Page / Media / Taxonomy / PostTag /
 // KvStore) plus the three public-read custom queries
 // (listPublishedPosts / getPublishedPost / listPostsByTag).
@@ -8,19 +19,20 @@ import { amplessSchemaModels, defaultAuthorizationModes } from '@ampless/backend
 // Add project-specific models alongside the spread:
 //
 //   const schema = a.schema({
-//     ...amplessSchemaModels(a),
+//     ...amplessSchemaModels(a, { resolverPaths }),
 //     MyCustomModel: a
 //       .model({ siteId: a.string().required(), foo: a.string() })
 //       .identifier(['siteId', 'foo'])
 //       .authorization((allow) => [allow.groups(['ampless-admin'])]),
 //   })
-//
-// The three AppSync JS resolvers (`*.js` in this directory) stay
-// user-owned — AppSync resolves `entry: './...'` paths at synth time
-// relative to this file. If you relocate them, pass new paths via
-// `amplessSchemaModels(a, { resolverPaths: { ... } })`.
+const resolverPaths = {
+  listPublishedPosts: resolve(__dirname, 'list-published-posts.js'),
+  getPublishedPost: resolve(__dirname, 'get-published-post.js'),
+  listPostsByTag: resolve(__dirname, 'list-posts-by-tag.js'),
+}
+
 const schema = a.schema({
-  ...amplessSchemaModels(a),
+  ...amplessSchemaModels(a, { resolverPaths }),
 })
 
 export type Schema = ClientSchema<typeof schema>

package/dist/templates/_shared/amplify.yml

@@ -3,7 +3,7 @@ frontend:
   phases:
     preBuild:
       commands:
-        - npm ci
+        - npm install
     build:
       commands:
         - npx ampx pipeline-deploy --branch $AWS_BRANCH --app-id $AWS_APP_ID

package/dist/templates/_shared/package.json

@@ -24,9 +24,9 @@
     "@ampless/plugin-rss": "^0.2.0-alpha.1",
     "@ampless/plugin-seo": "^0.2.0-alpha.1",
     "@ampless/plugin-webhook": "^0.2.0-alpha.1",
-    "@ampless/admin": "^0.2.0-alpha.5",
-    "@ampless/backend": "^0.2.0-alpha.1",
-    "@ampless/runtime": "^0.2.0-alpha.2",
+    "@ampless/admin": "^0.2.0-alpha.6",
+    "@ampless/backend": "^0.2.0-alpha.2",
+    "@ampless/runtime": "^0.2.0-alpha.3",
     "@digital-go-jp/tailwind-theme-plugin": "^0.3.4",
     "ampless": "^0.2.0-alpha.1",
     "aws-amplify": "^6.10.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ampless",
-  "version": "0.2.0-alpha.5",
+  "version": "0.2.0-alpha.7",
   "description": "Create a new ampless project",
   "license": "MIT",
   "type": "module",