deploy-stack 0.12.3 → 0.14.0

package/src/commands/secrets.js

@@ -4,6 +4,7 @@ import fs from 'fs/promises';
 import { spinner } from '@clack/prompts';
 import color from 'picocolors';
 import path from 'path';
+import { trackEvent, flushTelemetry } from '../core/telemetry.js';
 
 export async function pushSecrets(envFilePath, projectName) {
     const s = spinner();
@@ -42,7 +43,21 @@ export async function pushSecrets(envFilePath, projectName) {
         console.log(color.cyan(`\nUpdated ${keysFilePath}`));
         console.log(color.green('Commit this file and push to GitHub to trigger a deployment with your new variables.'));
 
+        trackEvent('secrets_pushed', {
+            projectName,
+            secret_count: Object.keys(parsedSecrets).length,
+            success: true
+        });
+        await flushTelemetry();
+
     } catch (error) {
         s.stop(`❌ Failed to push secrets: ${error.message}`);
+
+        trackEvent('secrets_pushed', {
+            projectName,
+            success: false,
+            error_code: error.name || 'UNKNOWN'
+        });
+        await flushTelemetry();
     }
 }

package/src/core/telemetry.js

@@ -26,6 +26,7 @@ export function trackEvent(eventName, properties) {
         properties: {
             os: process.platform,
             node_version: process.version,
+            is_ci: Boolean(process.env.CI || process.env.CONTINUOUS_INTEGRATION),
             ...properties
         }
     };

package/src/utils/aws.js

@@ -21,7 +21,7 @@ export async function provisionStateBucket(region, projectName) {
     try {
         await s3Client.send(new CreateBucketCommand({
             Bucket: stateBucketName,
-            CreateBucketConfiguration: region === 'us-east-1' ? undefined : { LocationConstraint: region }
+            CreateBucketConfiguration: region === 'us-east-2' ? undefined : { LocationConstraint: region }
         }));
 
         await s3Client.send(new PutBucketTaggingCommand({

package/src/utils/detector.js

@@ -1,6 +1,7 @@
 import fsSync from 'fs';
 import path from 'path';
 
+// Detects the framework based on the presence of framework-specific files.
 export function detectFramework(targetDir) {
     const packageJsonPath = path.join(targetDir, 'package.json');
     const requirementsTxtPath = path.join(targetDir, 'requirements.txt');
@@ -62,4 +63,130 @@ export function detectFramework(targetDir) {
 
     // 5. Fallback
     return null;
+}
+
+// Parses a Heroku/Render Procfile and formats the commands for Terraform ECS.
+export function parseProcfile(targetDir) {
+    const procfilePath = path.join(targetDir, 'Procfile');
+
+    if (!fsSync.existsSync(procfilePath)) return null;
+
+    const content = fsSync.readFileSync(procfilePath, 'utf-8');
+    const processes = {};
+
+    // Match lines like "web: gunicorn myapp.wsgi"
+    const lines = content.split('\n');
+    const procRegex = /^([A-Za-z0-9_-]+):\s*(.+)$/;
+
+    for (const line of lines) {
+        const match = line.trim().match(procRegex);
+        if (match) {
+            const type = match[1].toLowerCase();
+            const rawCommand = match[2].trim();
+
+            // Terraform requires the command as a JSON array of strings
+            // This splits by spaces but respects single and double quotes
+            const commandArray = rawCommand.match(/[^\s"']+|"([^"]*)"|'([^']*)'/g)
+                .map(str => str.replace(/^["']|["']$/g, '')); // Strip the quotes
+
+            processes[type] = commandArray;
+        }
+    }
+
+    return Object.keys(processes).length > 0 ? processes : null;
+}
+
+// Parses a vercel.json file to extract routing and edge rules
+export function parseVercelConfig(targetDir) {
+    const vercelConfigPath = path.join(targetDir, 'vercel.json');
+    if (!fsSync.existsSync(vercelConfigPath)) return null;
+
+    try {
+        const content = fsSync.readFileSync(vercelConfigPath, 'utf-8');
+        const vercelJson = JSON.parse(content);
+
+        // We only care about network-level edge rules that AWS needs to handle
+        const rules = {
+            redirects: vercelJson.redirects || null,
+            headers: vercelJson.headers || null,
+            rewrites: vercelJson.rewrites || null
+        };
+
+        // If it's just an empty vercel.json, return null
+        if (!rules.redirects && !rules.headers && !rules.rewrites) {
+            return null;
+        }
+
+        return rules;
+    } catch (e) {
+        // Silently fail on malformed JSON
+        return null;
+    }
+}
+
+// Checks if Next.js is configured for 'standalone' output
+export function analyzeNextConfig(targetDir) {
+    const extensions = ['js', 'mjs', 'cjs', 'ts'];
+    let configPath = null;
+    let configContent = '';
+
+    for (const ext of extensions) {
+        const tempPath = path.join(targetDir, `next.config.${ext}`);
+        if (fsSync.existsSync(tempPath)) {
+            configPath = tempPath;
+            configContent = fsSync.readFileSync(tempPath, 'utf-8');
+            break;
+        }
+    }
+
+    if (!configPath) return { hasConfig: false, isStandalone: false };
+
+    // Regex looks for output: 'standalone' or output: "standalone" (handling spacing)
+    const isStandalone = /output\s*:\s*['"`]standalone['"`]/.test(configContent);
+
+    return {
+        hasConfig: true,
+        isStandalone: isStandalone,
+        configPath: configPath
+    };
+}
+
+// Checks if SvelteKit is locked into Vercel
+export function analyzeSvelteConfig(targetDir) {
+    const configPath = path.join(targetDir, 'svelte.config.js');
+    if (!fsSync.existsSync(configPath)) return { hasConfig: false, adapter: 'unknown' };
+
+    const content = fsSync.readFileSync(configPath, 'utf-8');
+
+    let adapter = 'unknown';
+    if (content.includes('@sveltejs/adapter-vercel')) adapter = 'vercel';
+    else if (content.includes('@sveltejs/adapter-node')) adapter = 'node';
+    else if (content.includes('@sveltejs/adapter-static')) adapter = 'static';
+    else if (content.includes('@sveltejs/adapter-auto')) adapter = 'auto'; // Vercel's default
+
+    return { hasConfig: true, adapter };
+}
+
+// Checks if Astro is locked into Vercel
+export function analyzeAstroConfig(targetDir) {
+    const extensions = ['mjs', 'js', 'ts', 'cjs'];
+    let configPath = null;
+    let content = '';
+
+    for (const ext of extensions) {
+        const tempPath = path.join(targetDir, `astro.config.${ext}`);
+        if (fsSync.existsSync(tempPath)) {
+            configPath = tempPath;
+            content = fsSync.readFileSync(tempPath, 'utf-8');
+            break;
+        }
+    }
+
+    if (!configPath) return { hasConfig: false, adapter: 'unknown' };
+
+    let adapter = 'unknown';
+    if (content.includes('@astrojs/vercel')) adapter = 'vercel';
+    else if (content.includes('@astrojs/node')) adapter = 'node';
+
+    return { hasConfig: true, adapter };
 }

package/src/utils/frameworks.js

@@ -0,0 +1,55 @@
+import fsSync from 'fs';
+import path from 'path';
+import { text, confirm, cancel, log } from '@clack/prompts';
+import color from 'picocolors';
+
+export async function resolveDjangoWsgi(targetDir, procfile, framework, isHeadless) {
+    if (framework !== 'django') return 'core.wsgi';
+
+    let extractedWsgi = null;
+    if (procfile && procfile.web) {
+        const webCommand = procfile.web.join(' ');
+        const wsgiMatch = webCommand.match(/([a-zA-Z0-9_]+)\.wsgi/);
+        if (wsgiMatch) extractedWsgi = `${wsgiMatch[1]}.wsgi`;
+    }
+
+    if (extractedWsgi) {
+        if (!isHeadless) log.success(`Auto-detected Django WSGI from Procfile: ${color.cyan(extractedWsgi)}`);
+        return extractedWsgi;
+    }
+
+    if (isHeadless) return 'core.wsgi';
+
+    const djangoWsgi = await text({
+        message: 'What is the Python module path to your Django wsgi.py?',
+        placeholder: 'core.wsgi',
+        initialValue: 'core.wsgi',
+    });
+
+    if (typeof djangoWsgi === 'symbol') process.exit(0);
+    return djangoWsgi;
+}
+
+export async function handleRailsCI(targetDir, framework, isHeadless) {
+    if (framework !== 'rails') return false;
+
+    const ciPath = path.join(targetDir, '.github', 'workflows', 'ci.yml');
+    const dependabotPath = path.join(targetDir, '.github', 'dependabot.yml');
+
+    if (fsSync.existsSync(ciPath) || fsSync.existsSync(dependabotPath)) {
+        if (isHeadless) return true;
+
+        console.log('');
+        const disable = await confirm({
+            message: color.yellow('We detected default Rails GitHub Actions (ci.yml, dependabot.yml) that usually crash in isolated CI environments without a database. Would you like deploy-stack to safely disable them by renaming them to .bak?'),
+            initialValue: true,
+        });
+
+        if (typeof disable === 'symbol') {
+            cancel('Provisioning cancelled.');
+            process.exit(0);
+        }
+        return disable;
+    }
+    return false;
+}

package/src/utils/generator.js

@@ -26,8 +26,28 @@ export async function generateTemplates(targetDir, config) {
         { src: 'README.md', dest: 'README.md' }
     ];
 
+    // 3. Configure Compute Commands & Environment Variables
     let secretsArray = [];
 
+    // 3.1. Format the ECS Task Command (Heroku Procfile Support)
+    // If a Procfile exists and has a 'web' process, override the Docker CMD
+    if (config.PROCFILE && config.PROCFILE.web) {
+        // e.g., ["gunicorn", "myproject.wsgi"] -> JSON string for Terraform
+        config.TASK_COMMAND = `command = ${JSON.stringify(config.PROCFILE.web)}`;
+    } else {
+        // Fallback to the default Dockerfile CMD
+        config.TASK_COMMAND = '';
+    }
+
+    if (config.PROCFILE && config.PROCFILE.worker) {
+        config.WORKER_COMMAND = `command = ${JSON.stringify(config.PROCFILE.worker)}`;
+        // Dynamically add worker.tf to the generation list
+        filesToProcess.push({ src: 'terraform/worker.tf', dest: 'terraform/worker.tf' });
+    } else {
+        config.WORKER_COMMAND = '';
+    }
+
+    // 3.2. Inject Managed Database Variables
     if (config.NEEDS_DATABASE) {
         filesToProcess.push({ src: 'terraform/database.tf', dest: 'terraform/database.tf' });
 
@@ -42,10 +62,11 @@ export async function generateTemplates(targetDir, config) {
         config.DB_ENV_VARS = '';
     }
 
+    // 4. Configure AWS Secrets Manager Integration
     // Build the initial HCL map for AWS Secrets Manager
     let initialSecretMap = `{\n    EXAMPLE_API_KEY = "replace_me_in_aws_console"`;
 
-    // Inject Rails Master Key if applicable
+    // 4.1. Inject Rails Master Key if applicable
     if (config.finalFramework === 'rails') {
         secretsArray.push(`{ "name": "RAILS_MASTER_KEY", "valueFrom": "\${aws_secretsmanager_secret.app_secrets.arn}:RAILS_MASTER_KEY::" }`);
 
@@ -64,7 +85,51 @@ export async function generateTemplates(targetDir, config) {
     config.TASK_SECRETS = secretsArray.join(',\n        ');
     config.INITIAL_SECRET_MAP = initialSecretMap;
 
-    // 3. Process standard files
+    config.SAFE_ALB_NAME = config.PROJECT_NAME.length > 27
+        ? config.PROJECT_NAME.substring(0, 27).replace(/-$/, '') // Remove trailing hyphens
+        : config.PROJECT_NAME;
+
+    // 4.5. Translate Vercel Rules to AWS ALB Listener Rules
+    let vercelTerraformRules = '';
+
+    if (config.VERCEL_RULES && config.VERCEL_RULES.redirects) {
+        config.VERCEL_RULES.redirects.forEach((rule, index) => {
+            // Vercel uses 'permanent: true' for 301, false for 302
+            const statusCode = rule.permanent === false ? "HTTP_302" : "HTTP_301";
+
+            // Map Vercel's source path to AWS ALB Path Pattern
+            let sourcePath = rule.source;
+            // Vercel sometimes uses regex syntax like '/blog/(.*)'. ALB uses '/blog/*'
+            sourcePath = sourcePath.replace(/\(\.\*\)/g, '*');
+
+            vercelTerraformRules += `
+# Auto-generated from vercel.json redirect
+resource "aws_lb_listener_rule" "vercel_redirect_${index}" {
+  listener_arn = aws_lb_listener.http.arn
+  priority     = ${100 + index} # Start at 100 to avoid conflicts
+
+  action {
+    type = "redirect"
+    redirect {
+      status_code = "${statusCode}"
+      path        = "${rule.destination}"
+    }
+  }
+
+  condition {
+    path_pattern {
+      values = ["${sourcePath}"]
+    }
+  }
+}
+`;
+        });
+    }
+
+    // Assign the compiled HCL to the config object so the template engine can inject it
+    config.VERCEL_EDGE_ROUTING = vercelTerraformRules;
+
+    // 5. Process standard files
     for (const file of filesToProcess) {
         let content = await fs.readFile(path.join(templatesDir, file.src), 'utf-8');
 
@@ -76,10 +141,10 @@ export async function generateTemplates(targetDir, config) {
         await fs.writeFile(path.join(targetDir, file.dest), content);
     }
 
-    // 4. Create empty secrets file
+    // 6. Create empty secrets file
     await fs.writeFile(path.join(targetDir, 'terraform', 'secret_keys.json'), "[]");
 
-    // 5. Handle .gitignore dynamically based on framework
+    // 7. Handle .gitignore dynamically based on framework
     const targetGitignore = path.join(targetDir, '.gitignore');
 
     if (!fsSync.existsSync(targetGitignore)) {
@@ -92,7 +157,7 @@ export async function generateTemplates(targetDir, config) {
         }
     }
 
-    // 6. Create .dockerignore to keep images lean and secure
+    // 8. Create .dockerignore to keep images lean and secure
     const dockerignorePath = path.join(targetDir, '.dockerignore');
     const appendDockerIgnore = '\n# Infrastructure (deploy-stack)\nterraform/\n**/.terraform/\n**/.terraform.*\n**/*.tfstate*\n.env\n';
 
@@ -146,7 +211,7 @@ Thumbs.db
         return (baseIgnore + frameworkIgnore).trim();
     }
 
-    // 7. Framework-specific cleanup
+    // 9. Framework-specific cleanup
     // Disable default workflows that crash in isolated CI environments
     if (config.finalFramework === 'rails') {
         const railsCiPath = path.join(targetDir, '.github', 'workflows', 'ci.yml');

package/src/utils/prompts.js

@@ -0,0 +1,156 @@
+import path from 'path';
+import { text, select, confirm, group, cancel, log } from '@clack/prompts';
+import color from 'picocolors';
+import { execSync } from 'child_process';
+
+export async function getTargetDirectory(isHeadless, headlessOptions) {
+    if (isHeadless) {
+        const projectName = headlessOptions.dir || '.';
+        return {
+            projectName,
+            actualProjectName: projectName === '.' ? path.basename(process.cwd()) : projectName,
+            targetDir: projectName === '.' ? process.cwd() : path.join(process.cwd(), projectName)
+        };
+    }
+
+    const projectName = await text({
+        message: 'Where should we generate the infrastructure? (Type "." for current directory)',
+        placeholder: '.',
+        initialValue: '.',
+        validate: (value) => {
+            if (!value) return 'Please enter a name or directory.';
+            if (value !== '.' && value.includes(' ')) return 'Name cannot contain spaces.';
+        },
+    });
+
+    if (typeof projectName === 'symbol') {
+        cancel('Operation cancelled.');
+        process.exit(0);
+    }
+
+    return {
+        projectName,
+        actualProjectName: projectName === '.' ? path.basename(process.cwd()) : projectName,
+        targetDir: projectName === '.' ? process.cwd() : path.join(process.cwd(), projectName)
+    };
+}
+
+export async function getProjectConfig(isHeadless, headlessOptions, targetDir, detectedFramework) {
+    if (isHeadless) {
+        return {
+            framework: headlessOptions.framework || (detectedFramework ? detectedFramework.id : 'static'),
+            region: headlessOptions.region || 'us-east-2',
+            port: headlessOptions.port || (headlessOptions.framework === 'static' ? '8080' : '3000'),
+            size: headlessOptions.size || 'micro',
+            healthCheckPath: headlessOptions.healthCheckPath || '/',
+            desiredCount: headlessOptions.desiredCount || '1',
+            branch: headlessOptions.branch || 'main',
+            needsDatabase: false,
+            setupType: 'headless'
+        };
+    }
+
+    let finalFramework = detectedFramework ? detectedFramework.id : null;
+
+    if (!finalFramework) {
+        finalFramework = await select({
+            message: 'Which framework preset should we configure?',
+            options: [
+                { value: 'node', label: 'Node.js / Express' },
+                { value: 'nextjs', label: 'Next.js (Standalone)' },
+                { value: 'nuxt', label: 'Nuxt 3 (SSR)' },
+                { value: 'python', label: 'Python FastAPI' },
+                { value: 'django', label: 'Django (Python)' },
+                { value: 'rails', label: 'Ruby on Rails' },
+                { value: 'go', label: 'Go (Golang)' },
+                { value: 'static', label: 'Static Site (Gatsby, React, plain HTML via Nginx)' },
+            ],
+        });
+        if (typeof finalFramework === 'symbol') process.exit(0);
+    }
+
+    const setupType = await select({
+        message: 'Choose your setup mode:',
+        options: [
+            { value: 'quick', label: '⚡ Quickstart (Recommended)', hint: 'Production defaults, minimal prompts' },
+            { value: 'advanced', label: '🛠️  Advanced Configuration', hint: 'Customize health checks, task count, branch, etc.' },
+        ],
+    });
+    if (typeof setupType === 'symbol') process.exit(0);
+
+    let defaultPort = '3000';
+    if (finalFramework === 'static' || finalFramework === 'go') defaultPort = '8080';
+    if (finalFramework === 'python' || finalFramework === 'django') defaultPort = '8000';
+
+    let currentGitBranch = 'main';
+    try {
+        currentGitBranch = execSync('git symbolic-ref --short HEAD', { cwd: targetDir, stdio: 'pipe' }).toString().trim();
+    } catch (e) { }
+
+    let needsDatabase = false;
+    const isBackendFramework = ['node', 'nextjs', 'nuxt', 'python', 'django', 'rails', 'go'].includes(finalFramework);
+
+    if (isBackendFramework) {
+        const dbChoice = await confirm({
+            message: 'Do you need a managed AWS RDS PostgreSQL database? (Adds ~$14/month or uses AWS Free Tier)',
+            initialValue: false,
+        });
+        if (typeof dbChoice === 'symbol') process.exit(0);
+        needsDatabase = dbChoice;
+    }
+
+    const project = await group({
+        region: () => select({
+            message: 'Which AWS region do you want to deploy to?',
+            options: [
+                { value: 'us-east-1', label: 'us-east-1 (N. Virginia)' },
+                { value: 'us-east-2', label: 'us-east-2 (Ohio)' },
+                { value: 'eu-west-1', label: 'eu-west-1 (Ireland)' },
+                { value: 'eu-central-1', label: 'EU (Frankfurt)' },
+                { value: 'ap-southeast-2', label: 'Asia Pacific (Sydney)' },
+            ],
+        }),
+        port: () => text({
+            message: 'What port does your container expose?',
+            placeholder: defaultPort,
+            defaultValue: defaultPort,
+        }),
+        size: () => select({
+            message: 'Select your Fargate compute size:',
+            options: [
+                { value: 'micro', label: 'Micro (0.25 vCPU, 512MB RAM) - Best for POCs' },
+                { value: 'small', label: 'Small (0.5 vCPU, 1GB RAM) - Best for small Projects' },
+            ],
+        }),
+        healthCheckPath: () => setupType === 'quick' ? undefined : text({
+            message: 'ALB Health Check Path:',
+            placeholder: '/',
+            defaultValue: '/',
+        }),
+        desiredCount: () => setupType === 'quick' ? undefined : select({
+            message: 'How many container replicas (tasks) should run?',
+            options: [
+                { value: '1', label: '1 Task (Single instance - lowest cost)' },
+                { value: '2', label: '2 Tasks (High Availability across AZs)' },
+            ],
+            defaultValue: '1',
+        }),
+        branch: () => setupType === 'quick' ? undefined : text({
+            message: 'Primary Git deployment branch for CI/CD:',
+            placeholder: currentGitBranch,
+            defaultValue: currentGitBranch,
+        }),
+    }, { onCancel: () => process.exit(0) });
+
+    return {
+        framework: finalFramework,
+        region: project.region,
+        port: project.port,
+        size: project.size,
+        healthCheckPath: project.healthCheckPath || '/',
+        desiredCount: project.desiredCount || '1',
+        branch: project.branch || currentGitBranch,
+        needsDatabase,
+        setupType
+    };
+}

package/src/utils/visualizer.js

@@ -3,7 +3,7 @@ import pc from 'picocolors';
 import fs from 'fs';
 import path from 'path';
 
-// Cost benchmarks for AWS us-east-1 baseline (Fargate + ALB)
+// Cost benchmarks for AWS us-east-2 baseline (Fargate + ALB)
 const PRICING_TABLE = {
     fargate: {
         cpuPerHour: 0.04048,   // per vCPU hour
@@ -22,7 +22,7 @@ const PRICING_TABLE = {
 // 1. Parse the local terraform files to extract the actual configuration
 export function parseTerraformConfig(tfDir) {
     const tfvarsPath = path.join(tfDir, 'terraform.tfvars');
-    let region = 'us-east-1';
+    let region = 'us-east-2';
     let cpu = 256;
     let memory = 512;
     let framework = 'Application';
@@ -43,18 +43,22 @@ export function parseTerraformConfig(tfDir) {
 
     // Check if database files exist
     const hasDb = fs.existsSync(path.join(tfDir, 'rds.tf')) || fs.existsSync(path.join(tfDir, 'database.tf'));
+    const hasWorker = fs.existsSync(path.join(tfDir, 'worker.tf'));
 
-    return { framework, region, cpu, memory, hasDb };
+    return { framework, region, cpu, memory, hasDb, hasWorker };
 }
 
 // 2. Calculate itemized monthly costs based on task definition settings
-export function estimateMonthlyCost({ cpu = 256, memory = 512, hasDb = false }) {
+export function estimateMonthlyCost({ cpu = 256, memory = 512, hasDb = false, hasWorker = false }) {
     const vCpu = cpu / 1024;
     const memGb = memory / 1024;
     const hoursInMonth = 730;
 
+    // If a worker service exists, we are running a second identical Fargate task
+    const taskMultiplier = hasWorker ? 2 : 1;
+
     const fargateCost = ((vCpu * PRICING_TABLE.fargate.cpuPerHour) +
-        (memGb * PRICING_TABLE.fargate.memoryPerHour)) * hoursInMonth;
+        (memGb * PRICING_TABLE.fargate.memoryPerHour)) * hoursInMonth * taskMultiplier;
     const albCost = (PRICING_TABLE.alb.basePerHour + PRICING_TABLE.alb.lcuPerHour) * hoursInMonth;
     const dbCost = hasDb ? (PRICING_TABLE.rds.microPerHour * hoursInMonth) + PRICING_TABLE.rds.storagePerMonth : 0;
 
@@ -70,17 +74,21 @@ export function estimateMonthlyCost({ cpu = 256, memory = 512, hasDb = false })
 
 // 3. Render the terminal architecture visualization and requests confirmation
 export async function renderDryRunPreview(config, isDryRunFlag = false) {
-    const { framework = 'Node.js', region = 'us-east-1', cpu = 256, memory = 512, hasDb = false } = config;
-    const cost = estimateMonthlyCost({ cpu, memory, hasDb });
+    const { framework = 'Node.js', region = 'us-east-2', cpu = 256, memory = 512, hasDb = false, hasWorker = false } = config;
+
+    // Fixed the duplicate hasWorker argument
+    const cost = estimateMonthlyCost({ cpu, memory, hasDb, hasWorker });
 
     const hourlyRate = (cost.totalMonthly / 730).toFixed(3); // 730 hours in a month
 
+    // Flattened the tree to eliminate nesting and vertical bloat
     const treeOutput = [
         `${pc.bold('Topology')} (${pc.cyan(region)}):`,
         `  ${pc.gray('├──')} 🌐 ${pc.bold('ALB')} (Public Entry & Health: ${pc.green('200 OK')})`,
         `  ${pc.gray('├──')} 🔒 ${pc.bold('IAM OIDC')} (GitHub Auth) & 🐳 ${pc.bold('ECR')} (Registry)`,
-        `  ${pc.gray('└──')} 📦 ${pc.bold('ECS Fargate Cluster')} 🟢 ${pc.green(framework)} [${cpu} CPU / ${memory} MB]`,
-        hasDb ? `       └── 🛢️  ${pc.yellow('Amazon RDS')} (PostgreSQL managed instance)` : '',
+        hasDb ? `  ${pc.gray('├──')} 🐘 ${pc.yellow('Amazon RDS')} (PostgreSQL managed instance)` : '',
+        `  ${pc.gray(hasWorker ? '├──' : '└──')} 📦 ${pc.bold('ECS Web Service')} 🟢 ${pc.green(framework)} [${cpu} CPU / ${memory} MB]`,
+        hasWorker ? `  ${pc.gray('└──')} 📦 ${pc.bold('ECS Worker Service')} 🔄 Background Tasks [${cpu} CPU / ${memory} MB]` : '',
         '',
         `${pc.bold('Est. Monthly Cost:')} ${pc.green(pc.bold(`~$${cost.totalMonthly}`))} ${pc.dim(`(ALB: $${cost.albMonthly}, Fargate: $${cost.fargateMonthly}${hasDb ? `, RDS: $${cost.dbMonthly}` : ''})`)}`,
         `  ${pc.dim(`* Hourly billing: ~$${hourlyRate}/hr. Destroy anytime with "npx deploy-stack destroy --yes"`)}`

package/templates/docker/django.Dockerfile

@@ -1,5 +1,8 @@
 FROM python:3.12-alpine
 
+# --- DevSecOps Patch: Upgrade Alpine system packages to clear OS-level CVEs ---
+RUN apk upgrade --no-cache
+
 # Prevent Python from writing .pyc files and buffer stdout for cleaner logs
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1

package/templates/terraform/main.tf

@@ -99,6 +99,8 @@ resource "aws_ecs_task_definition" "app" {
         ]
       )
       
+      {{TASK_COMMAND}}
+
       portMappings = [
         {
           containerPort = {{PORT}}
@@ -122,7 +124,7 @@ resource "aws_ecs_task_definition" "app" {
 # --- Application Load Balancer ---
 # trivy:ignore:AVD-AWS-0053 - This ALB is intended to be publicly facing behind CloudFront
 resource "aws_lb" "main" {
-  name               = "{{PROJECT_NAME}}-alb"
+  name               = "{{SAFE_ALB_NAME}}-alb"
   load_balancer_type = "application"
   security_groups    = [aws_security_group.alb.id]
   subnets            = aws_subnet.public[*].id
@@ -130,7 +132,7 @@ resource "aws_lb" "main" {
 }
 
 resource "aws_lb_target_group" "app" {
-  name        = "{{PROJECT_NAME}}-tg"
+  name        = "{{SAFE_ALB_NAME}}-tg"
   port        = {{PORT}}
   protocol    = "HTTP"
   vpc_id      = aws_vpc.main.id

package/templates/terraform/network.tf

@@ -90,4 +90,6 @@ resource "aws_security_group" "ecs_tasks" {
     # trivy:ignore:AVD-AWS-0104 - Allow containers to pull images and hit external APIs
     cidr_blocks = ["0.0.0.0/0"]
   }
-}
+}
+
+{{VERCEL_EDGE_ROUTING}}