deploy-stack 0.15.2 → 0.17.0

package/README.md

@@ -48,6 +48,8 @@ You retain complete ownership of your infrastructure code without relying on bla
 * **Zero Vendor Lock-In:** Generates standard, readable Terraform (`.tf`) files. You own the infrastructure.
 * **Native S3 State Locking:** Automatically creates an encrypted S3 state bucket utilizing modern Terraform concurrency locking.
 * **Safe Iteration:** Idempotent CLI safely backs up existing configurations to `.bak` files to guarantee zero data loss.
+* **Ephemeral PR Previews (Opt-In):** Automatically spins up completely isolated AWS Fargate environments for every Pull Request and posts the live preview URL to GitHub, accelerating team code reviews.
+* **🤖 IDE AI Integration:** Automatically generates contextual rules for Cursor, Windsurf, Copilot, and Claude to prevent Terraform hallucinations.
 
 ---
 
@@ -57,6 +59,7 @@ Transitioning from PaaS to AWS involves a few architectural shifts. We've writte
 * [Managing Secrets & Environment Variables](./docs/guides/secrets-management.md)
 * [Zero-Trust Database Connections](./docs/guides/database-connections.md)
 * [Migrating Next.js from Vercel](./docs/migrations/nextjs-vercel-to-aws.md)
+* [Ephemeral PR Previews & AWS Costs](./docs/guides/ephemeral-pr-previews.md)
 
 ---
 
@@ -95,6 +98,9 @@ The interactive wizard will analyze your codebase, detect your framework, estima
 * **`npx deploy-stack --headless`**
   Bypasses the interactive wizard for fully programmatic execution. Perfect for CI/CD pipelines, custom scripts, or AI agent integration. Accepts flags like `--framework=static`, `--region=us-east-2`, and `--size=micro`.
 
+* **`npx deploy-stack sync-ai`**
+  Selectively generates architecture rules for AI coding assistants (Cursor, Copilot, Windsurf, Claude). Automatically extracts your AWS Region and Container Port to prevent Terraform hallucinations.
+
 ---
 
 ## 📁 Generated File Structure
@@ -131,14 +137,16 @@ your-project/
 
 ---
 
-## 🤖 AI Agent Integration
+## 🤖 AI Context Management (Cursor, Copilot, Windsurf, Claude)
+
+AI coding assistants are incredible, but they often hallucinate custom Terraform or raw AWS CLI commands that can break your infrastructure state. `deploy-stack` natively intercepts and guides AI agents directly in your IDE by providing strict deployment rules and project-specific context (like your exact AWS Region and Container Port).
 
-Are you using Cursor, Windsurf, or GitHub Copilot? AI coding assistants often hallucinate complex, broken infrastructure code when asked to "deploy to AWS." 
+**How it works:**
+* **Quickstart Flow:** The CLI silently auto-detects if you are using AI tools in your repository and safely injects context.
+* **Advanced Flow:** You are explicitly prompted to choose which AI assistants your team uses.
+* **Standalone Command:** You can run `npx deploy-stack sync-ai` at any time to selectively generate these rules later.
 
-To teach your AI to natively use this CLI instead, copy our [Agent Ruleset](./agent-rules.md) into your repository's specific instruction file:
-* **Cursor:** Save as `.cursorrules` in your project root.
-* **Windsurf:** Save as `.windsurfrules` in your project root.
-* **GitHub Copilot:** Save as `.github/copilot-instructions.md`.
+**Safe & Non-Destructive:** We use isolated rule files (like `.cursor/rules/deploy-stack.mdc`) or strictly delimited blocks (``) to ensure your team's existing agent instructions, coding standards, and project prompts are **never overwritten**.
 
 ---
 
@@ -154,11 +162,11 @@ npx deploy-stack --no-telemetry
 
 ## 🗺️ Roadmap
 
-### Current Focus (Phase 6: Migration & Trust Engine)
-- [x] **Dry-Run Visualization:** Interactive pre-flight terminal UI with ASCII topology maps and precise, dynamic AWS cost estimation.
-- [x] **PaaS Importers:** Auto-parse `vercel.json` and Heroku `Procfile` configurations to map routing rules, web commands, and background workers automatically.
-- [x] **Docker Compose to ECS Translator:** Automatically converting a familiar local `docker-compose.yml` into production ECS task definitions.
-- [x] **AI Agent Rulesets:** Publishing `.cursorrules` and Copilot instructions that teach AI assistants exactly how to utilize the CLI on the user's behalf.
+### Current Focus (Phase 7: Team Workflows & Ecosystem Integrations)
+- [x] **Ephemeral PR Previews:** Generate GitHub Actions workflows that spin up temporary ECS Fargate tasks and post live preview URLs directly in pull request comments to streamline team code reviews.
+- [x] **AI Context Synchronization:** Implement `deploy-stack sync-ai` to automatically generate `.cursorrules` and AI context files, ensuring coding assistants generate accurate deployment commands tailored to the project.
+- [ ] **Native Ecosystem Integrations:** Publish seamless, push-button plugins across major frameworks. Targets include a `svelte-adapter-deploy-stack`, an official `create-next-app` AWS template, a `vite-plugin-deploy-stack`, a NestJS schematic, and a Django Cookiecutter template.
+- [ ] **Automated Troubleshooting:** Build `deploy-stack diagnose` (alias: `wtf`) to automatically analyze and troubleshoot common day-2 AWS operational issues (e.g., Fargate OOM kills, ALB 502s) directly from the terminal.
 
 👉 **[See the full project history and future plans in ROADMAP.md](./ROADMAP.md)**
 

package/bin/cli.js

@@ -6,6 +6,7 @@ import { runDoctor } from '../src/commands/doctor.js';
 import { pushSecrets } from '../src/commands/secrets.js';
 import { ejectStack } from '../src/commands/eject.js';
 import { applyStack } from '../src/commands/apply.js';
+import { syncAi } from '../src/commands/sync-ai.js';
 
 // 1. Extract the telemetry flag and set the environment variable
 const rawArgs = process.argv.slice(2);
@@ -40,15 +41,17 @@ const headlessOptions = isHeadless ? {
 if (args[0] === 'secrets' && args[1] === 'push') {
     const envFile = args[2] || '.env';
     const projectName = path.basename(process.cwd());
-    pushSecrets(envFile, projectName).catch(console.error);
+    pushSecrets(envFile, projectName).catch(e => { console.error(e); process.exit(1); });
 } else if (args[0] === 'apply') {
-    applyStack({ isDryRun }).catch(console.error);
+    applyStack({ isDryRun }).catch(e => { console.error(e); process.exit(1); });
 } else if (args[0] === 'doctor') {
-    runDoctor().catch(console.error);
+    runDoctor().catch(e => { console.error(e); process.exit(1); });
 } else if (args[0] === 'destroy') {
-    destroyStack().catch(console.error);
+    destroyStack().catch(e => { console.error(e); process.exit(1); });
 } else if (args[0] === 'eject') {
-    ejectStack().catch(console.error);
+    ejectStack().catch(e => { console.error(e); process.exit(1); });
+} else if (args[0] === 'sync-ai') {
+    syncAi().catch(e => { console.error(e); process.exit(1); });
 } else {
     mainStack({ isHeadless, headlessOptions }).catch(e => { console.error(e); process.exit(1); });
 }

package/docs/ROADMAP.md

@@ -16,8 +16,15 @@
 - [x] **Local Execution Wrapper:** Native `deploy-stack apply` command with terminal-optimized streaming to eliminate Terraform context switching.
 - [x] **Ecosystem Integrations:** Official plugins published to the Astro Integrations directory (`astro-deploy-stack`) and Nuxt module registry (`nuxt-deploy-stack`).
 
-### Phase 6: Migration & Trust Engine (Current)
+### Phase 6: Migration & Trust Engine (Completed)
 - [x] **Dry-Run Visualization:** Interactive pre-flight terminal UI with ASCII topology maps and precise, dynamic AWS cost estimation.
 - [x] **PaaS Importers:** Auto-parse `vercel.json` and Heroku `Procfile` configurations to map routing rules, web commands, and background workers automatically.
 - [x] **Docker Compose to ECS Translator:** Automatically converting a familiar local `docker-compose.yml` into production ECS task definitions.
-- [ ] **AI Agent Rulesets:** Publishing `.cursorrules` and Copilot instructions that teach AI assistants exactly how to utilize the CLI on the user's behalf.
+- [x] **AI Agent Rulesets:** Publishing `.cursorrules` and Copilot instructions that teach AI assistants exactly how to utilize the CLI on the user's behalf.
+
+### Phase 7: Team Workflows & Ecosystem Integrations (Current)
+*Focus: Enhance collaborative development and expand native support across major framework ecosystems.*
+- [x] **Ephemeral PR Previews:** Generate GitHub Actions workflows that spin up temporary ECS Fargate tasks and post live URLs directly in PR comments to streamline team code reviews.
+- [x] **AI Context Synchronization:** Implement `deploy-stack sync-ai` to automatically generate `.cursorrules` and AI context files, ensuring IDE assistants understand the infrastructure.
+- [ ] **Native Ecosystem Integrations:** Publish push-button plugins across major frameworks (e.g., `svelte-adapter-deploy-stack`, `create-next-app` AWS template, `vite-plugin-deploy-stack`, NestJS deployment schematic, Django Cookiecutter).
+- [ ] **Automated Troubleshooting:** Build `deploy-stack diagnose` to auto-diagnose common day-2 AWS failures (e.g., Fargate OOM kills, ALB 502s) to establish immediate technical credibility and simplify maintenance.

package/docs/guides/ephemeral-pr-previews.md

@@ -0,0 +1,32 @@
+# 🚀 Ephemeral PR Previews
+
+When enabled, `deploy-stack` automatically configures your GitHub Actions pipeline to spin up isolated, temporary AWS environments every time a developer opens a Pull Request.
+
+A bot will comment on the PR with a live URL (e.g., `http://pr-123-your-app...`), allowing your team to test features, UI changes, and API updates before merging to `main`. When the PR is closed or merged, the environment is automatically destroyed.
+
+### 🏗️ How it Works
+
+Under the hood, `deploy-stack` utilizes **Terraform Workspaces**. 
+
+When a PR is opened, Terraform creates a new workspace (e.g., `pr-12`). It provisions a completely isolated Application Load Balancer and ECS Fargate Task using the exact same infrastructure definitions as your production environment, ensuring 100% parity.
+
+To save time and simplify architecture, PR environments **share** your production AWS Secrets Manager vault and ECR Image Repository.
+
+### ⚖️ The Rule of Thumb: Should I enable this?
+
+**✅ Enable PR Previews if:**
+* You are working on a team of 2+ developers and require visual QA or UX sign-off before merging code.
+* You are building a frontend application or full-stack monolith where seeing the live UI is critical.
+
+**❌ Do NOT enable PR Previews if:**
+* You are a solo developer (you can just test locally).
+* You have a massive volume of PRs (e.g., automated Dependabot updates). Spinning up an AWS Load Balancer takes ~3 minutes, which will slow down rapid automated merges.
+
+### 💰 AWS Cost Implications
+
+Because PR previews provision a real Application Load Balancer (ALB) and ECS Fargate compute tasks, **they are not free.**
+
+* **Compute:** You are charged standard AWS Fargate rates per minute while the PR environment is running.
+* **Load Balancing:** AWS charges ~$16/month per active Load Balancer. If a PR is open for 2 days, you pay the prorated ALB cost for those 48 hours (~$1.00).
+
+To keep costs low, ensure your team closes or merges Pull Requests promptly so the `teardown.yml` workflow can destroy the resources and stop the billing clock!

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.15.2",
+  "version": "0.17.0",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "engines": {
     "node": ">=18.0.0"

package/src/commands/init.js

@@ -20,7 +20,8 @@ import { handleExistingFiles } from '../utils/backup.js';
 import { estimateMonthlyCost } from '../utils/visualizer.js';
 import { getTargetDirectory, getProjectConfig } from '../utils/prompts.js';
 import { resolveDjangoWsgi, handleRailsCI } from '../utils/frameworks.js';
-import { hasDockerCompose, parseDockerCompose } from '../utils/dockerCompose.js';
+import { parseDockerCompose } from '../utils/dockerCompose.js';
+import { getBaseRules, getCursorRules, injectManagedBlock } from '../utils/ai-rules.js';
 
 const pkg = JSON.parse(fsSync.readFileSync(new URL('../../package.json', import.meta.url)));
 const CLI_VERSION = pkg.version;
@@ -143,7 +144,8 @@ export async function mainStack({ isHeadless = false, headlessOptions = {} } = {
         DISABLE_DEFAULT_CI: disableDefaultCI,
         PROCFILE: procfile,
         VERCEL_RULES: vercelRules,
-        DOCKER_COMPOSE: dockerCompose
+        DOCKER_COMPOSE: dockerCompose,
+        ENABLE_PR_PREVIEWS: config.enablePrPreviews
     });
 
     // 8. Telemetry
@@ -169,10 +171,54 @@ export async function mainStack({ isHeadless = false, headlessOptions = {} } = {
         is_heroku_migration: !!procfile,
         is_vercel_migration: !!vercelRules,
         is_docker_compose: !!dockerCompose,
+        has_pr_previews: config.enablePrPreviews,
+        ai_assistants_configured: config.aiAssistants || [],
     });
 
     s.stop('Infrastructure provisioned successfully!');
 
+    // 8.5 Configure AI Context
+    s.start('Configuring AI workspace rules...');
+    const aiContext = { region: config.region, port: config.port };
+
+    if (config.setupType === 'advanced') {
+        // --- ADVANCED MODE: Explicitly respect user choices ---
+        if (config.aiAssistants.includes('cursor')) {
+            const cursorDir = path.join(dirConfig.targetDir, '.cursor', 'rules');
+            if (!fsSync.existsSync(cursorDir)) fsSync.mkdirSync(cursorDir, { recursive: true });
+            fsSync.writeFileSync(path.join(cursorDir, 'deploy-stack.mdc'), getCursorRules(aiContext));
+        }
+        if (config.aiAssistants.includes('windsurf')) {
+            injectManagedBlock(path.join(dirConfig.targetDir, '.windsurfrules'), getBaseRules(aiContext), false);
+        }
+        if (config.aiAssistants.includes('claude')) {
+            injectManagedBlock(path.join(dirConfig.targetDir, 'CLAUDE.md'), getBaseRules(aiContext), true);
+        }
+        if (config.aiAssistants.includes('copilot')) {
+            const copilotPath = path.join(dirConfig.targetDir, '.github', 'copilot-instructions.md');
+            if (!fsSync.existsSync(path.dirname(copilotPath))) fsSync.mkdirSync(path.dirname(copilotPath), { recursive: true });
+            injectManagedBlock(copilotPath, getBaseRules(aiContext), true);
+        }
+    } else {
+        // --- QUICKSTART MODE: Silent Auto-Detection ---
+        if (fsSync.existsSync(path.join(dirConfig.targetDir, '.cursor'))) {
+            const cursorDir = path.join(dirConfig.targetDir, '.cursor', 'rules');
+            if (!fsSync.existsSync(cursorDir)) fsSync.mkdirSync(cursorDir, { recursive: true });
+            fsSync.writeFileSync(path.join(cursorDir, 'deploy-stack.mdc'), getCursorRules(aiContext));
+        }
+        if (fsSync.existsSync(path.join(dirConfig.targetDir, '.windsurf')) || fsSync.existsSync(path.join(dirConfig.targetDir, '.windsurfrules'))) {
+            injectManagedBlock(path.join(dirConfig.targetDir, '.windsurfrules'), getBaseRules(aiContext), false);
+        }
+        if (fsSync.existsSync(path.join(dirConfig.targetDir, 'CLAUDE.md'))) {
+            injectManagedBlock(path.join(dirConfig.targetDir, 'CLAUDE.md'), getBaseRules(aiContext), true);
+        }
+        const copilotPath = path.join(dirConfig.targetDir, '.github', 'copilot-instructions.md');
+        if (fsSync.existsSync(copilotPath)) {
+            injectManagedBlock(copilotPath, getBaseRules(aiContext), true);
+        }
+    }
+    s.stop('AI rules configured successfully!');
+
     // 9. Output
     let frameworkWarnings = '';
     if (!(config.framework === 'static' && detectedFramework?.buildDir)) {

package/src/commands/sync-ai.js

@@ -0,0 +1,83 @@
+import fsSync from 'fs';
+import path from 'path';
+import { intro, outro, spinner, log } from '@clack/prompts';
+import color from 'picocolors';
+import { getAiAssistants } from '../utils/prompts.js';
+import { getBaseRules, getCursorRules, injectManagedBlock } from '../utils/ai-rules.js';
+import { trackEvent, flushTelemetry } from '../core/telemetry.js';
+
+function getProjectContext(cwd) {
+    const context = { region: '', port: '' };
+    const mainTfPath = path.join(cwd, 'terraform', 'main.tf');
+
+    if (fsSync.existsSync(mainTfPath)) {
+        const tfContent = fsSync.readFileSync(mainTfPath, 'utf8');
+
+        // Extract Region
+        const regionMatch = tfContent.match(/region\s*=\s*"([^"]+)"/);
+        if (regionMatch) context.region = regionMatch[1];
+
+        // Extract Port
+        const portMatch = tfContent.match(/containerPort\s*=\s*(\d+)/);
+        if (portMatch) context.port = portMatch[1];
+    }
+
+    return context;
+}
+
+export async function syncAi() {
+    intro(color.bgCyan(color.black(' deploy-stack sync-ai 🤖 ')));
+
+    const assistants = await getAiAssistants();
+
+    if (!assistants || assistants.length === 0) {
+        log.warn('No AI assistants selected. Skipping synchronization.');
+        process.exit(0);
+    }
+
+    const s = spinner();
+    s.start('Writing AI context rules...');
+    const cwd = process.cwd();
+
+    const context = getProjectContext(cwd);
+
+    try {
+        if (assistants.includes('cursor')) {
+            const cursorDir = path.join(cwd, '.cursor', 'rules');
+            if (!fsSync.existsSync(cursorDir)) fsSync.mkdirSync(cursorDir, { recursive: true });
+            fsSync.writeFileSync(path.join(cursorDir, 'deploy-stack.mdc'), getCursorRules(context));
+        }
+
+        if (assistants.includes('copilot')) {
+            const githubDir = path.join(cwd, '.github');
+            if (!fsSync.existsSync(githubDir)) fsSync.mkdirSync(githubDir, { recursive: true });
+            injectManagedBlock(path.join(githubDir, 'copilot-instructions.md'), getBaseRules(context), true);
+        }
+
+        if (assistants.includes('windsurf')) {
+            injectManagedBlock(path.join(cwd, '.windsurfrules'), getBaseRules(context), false);
+        }
+
+        if (assistants.includes('claude')) {
+            injectManagedBlock(path.join(cwd, 'CLAUDE.md'), getBaseRules(context), true);
+        }
+
+        trackEvent('sync_ai_executed', {
+            assistants_selected: assistants,
+            has_cursor: assistants.includes('cursor'),
+            has_copilot: assistants.includes('copilot'),
+            has_windsurf: assistants.includes('windsurf'),
+            has_claude: assistants.includes('claude')
+        });
+        await flushTelemetry();
+
+        s.stop('AI context synchronized successfully!');
+
+        outro(`${color.green('✅ AI Assistant Rules generated!')} 
+Your AI tools now know exactly how to deploy your app without hallucinating Terraform.`);
+    } catch (error) {
+        s.stop('❌ Failed to write AI context files.');
+        console.error(color.red(error.message));
+        process.exit(1);
+    }
+}

package/src/utils/ai-rules.js

@@ -0,0 +1,54 @@
+import fsSync from 'fs';
+
+export const getBaseRules = (context = {}) => `
+# deploy-stack Infrastructure Context
+
+This project's AWS infrastructure is managed strictly by the \`deploy-stack\` CLI. 
+**DO NOT** generate custom Terraform, AWS CloudFormation, or raw AWS CLI commands to deploy this application or modify the architecture.
+
+### Standard Operating Procedures
+
+1. **Applying Changes:** If the user asks to deploy, provision, or update the infrastructure, instruct them to run:
+   \`npx deploy-stack apply\`
+
+2. **Environment Variables:** If the user adds a new environment variable and needs it available in production, instruct them to run:
+   \`npx deploy-stack secrets push <path-to-env-file>\`
+
+3. **Teardown:** If the user wants to destroy the AWS environment, instruct them to run:
+   \`npx deploy-stack destroy\`
+
+4. **Architecture Details:** 
+   - **AWS Region:** \`${context.region || 'Unknown (Check terraform/main.tf)'}\`
+   - **Container Port:** \`${context.port || 'Unknown'}\`
+   - The infrastructure is an AWS ECS Fargate cluster.
+   - It uses an Application Load Balancer (ALB).
+   - CI/CD is handled securely via GitHub Actions OIDC (no long-lived IAM keys).
+   - Preview environments (Ephemeral PRs) are managed via Terraform Workspaces.
+`;
+
+export const getCursorRules = (context = {}) => `---
+description: "Rules for deploying the application and managing AWS infrastructure"
+globs: ["terraform/*.tf", ".github/workflows/*.yml", "Dockerfile"]
+---${getBaseRules(context)}`;
+
+export function injectManagedBlock(filePath, content, isMarkdown = true) {
+    const beginMarker = isMarkdown ? '<!-- BEGIN DEPLOY-STACK CONTEXT -->' : '# BEGIN DEPLOY-STACK CONTEXT';
+    const endMarker = isMarkdown ? '<!-- END DEPLOY-STACK CONTEXT -->' : '# END DEPLOY-STACK CONTEXT';
+    const block = `\n${beginMarker}\n${content.trim()}\n${endMarker}\n`;
+
+    if (fsSync.existsSync(filePath)) {
+        let fileContent = fsSync.readFileSync(filePath, 'utf8');
+        // Look for the existing block to replace it
+        const regex = new RegExp(`\\n?${beginMarker}[\\s\\S]*?${endMarker}\\n?`);
+
+        if (regex.test(fileContent)) {
+            fileContent = fileContent.replace(regex, block); // Replace our old rules
+        } else {
+            fileContent = fileContent.trim() + '\n' + block; // Append to bottom
+        }
+        fsSync.writeFileSync(filePath, fileContent);
+    } else {
+        // File doesn't exist, create it cleanly
+        fsSync.writeFileSync(filePath, block.trim() + '\n');
+    }
+}

package/src/utils/dockerCompose.js

@@ -2,13 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import { load } from 'js-yaml';
 
-// 1. Check if a Docker Compose file exists in the target directory.
-export function hasDockerCompose(targetDir) {
-    return fs.existsSync(path.join(targetDir, 'docker-compose.yml')) ||
-        fs.existsSync(path.join(targetDir, 'docker-compose.yaml'));
-}
-
-// 2. Parse docker-compose.yml and normalize it into an array of services.
+// Parse docker-compose.yml and normalize it into an array of services.
 export function parseDockerCompose(targetDir) {
     let composePath = path.join(targetDir, 'docker-compose.yml');
     if (!fs.existsSync(composePath)) {

package/src/utils/generator.js

@@ -14,6 +14,8 @@ export async function generateTemplates(targetDir, config) {
 
     // 2. Define paths
     const templatesDir = path.join(__dirname, '../../templates');
+    const readmeExists = fsSync.existsSync(path.join(targetDir, 'README.md'));
+    const readmeDest = readmeExists ? 'DEPLOYMENT.md' : 'README.md';
     const filesToProcess = [
         { src: 'terraform/main.tf', dest: 'terraform/main.tf' },
         { src: 'terraform/network.tf', dest: 'terraform/network.tf' },
@@ -23,9 +25,21 @@ export async function generateTemplates(targetDir, config) {
         { src: 'terraform/cloudfront.tf', dest: 'terraform/cloudfront.tf' },
         { src: `docker/${config.finalFramework}.Dockerfile`, dest: 'Dockerfile' },
         { src: 'github/deploy.yml', dest: '.github/workflows/deploy.yml' },
-        { src: 'README.md', dest: 'README.md' }
+        { src: 'README.md', dest: readmeDest }
     ];
 
+    // 2.1 Check if README.md exists (append DEPLOYMENT.md note if yes, generate new if no)
+    if (readmeExists) {
+        const readmeNotice = `\n## 🚀 Deployment\nAWS Fargate infrastructure is managed via [deploy-stack](./DEPLOYMENT.md).\n`;
+        fsSync.appendFileSync(path.join(targetDir, 'README.md'), readmeNotice);
+    }
+
+    // 2.1 Add Ephemeral PR workflows only if opted in
+    if (config.ENABLE_PR_PREVIEWS) {
+        filesToProcess.push({ src: 'github/preview.yml', dest: '.github/workflows/preview.yml' });
+        filesToProcess.push({ src: 'github/teardown.yml', dest: '.github/workflows/teardown.yml' });
+    }
+
     // 3. Configure Compute Commands & Environment Variables
     let secretsArray = [];
 
@@ -122,7 +136,7 @@ export async function generateTemplates(targetDir, config) {
 
     // 4.1. Inject Rails Master Key if applicable
     if (config.finalFramework === 'rails') {
-        secretsArray.push(`{ "name": "RAILS_MASTER_KEY", "valueFrom": "\${aws_secretsmanager_secret.app_secrets.arn}:RAILS_MASTER_KEY::" }`);
+        secretsArray.push(`{ "name": "RAILS_MASTER_KEY", "valueFrom": "\${local.secret_arn}:RAILS_MASTER_KEY::" }`);
 
         initialSecretMap += `,\n    RAILS_MASTER_KEY = var.rails_master_key`;
 

package/src/utils/prompts.js

@@ -1,5 +1,5 @@
 import path from 'path';
-import { text, select, confirm, group, cancel, log } from '@clack/prompts';
+import { text, select, multiselect, confirm, group, cancel } from '@clack/prompts';
 import color from 'picocolors';
 import { execSync } from 'child_process';
 
@@ -46,6 +46,7 @@ export async function getProjectConfig(isHeadless, headlessOptions, targetDir, d
             desiredCount: headlessOptions.desiredCount || '1',
             branch: headlessOptions.branch || 'main',
             needsDatabase: false,
+            enablePrPreviews: headlessOptions.enablePrPreviews || false,
             setupType: 'headless'
         };
     }
@@ -99,6 +100,19 @@ export async function getProjectConfig(isHeadless, headlessOptions, targetDir, d
         needsDatabase = dbChoice;
     }
 
+    let enablePrPreviews = false;
+    let aiAssistants = [];
+    if (setupType === 'advanced') {
+        const prChoice = await confirm({
+            message: `Enable Ephemeral PR Previews? (Spins up isolated, temporary AWS environments for PRs)\n  ${color.gray('📖 Learn more: https://github.com/anton-codes-iac/deploy-stack/blob/main/docs/guides/ephemeral-pr-previews.md')}`,
+            initialValue: false,
+        });
+        if (typeof prChoice === 'symbol') process.exit(0);
+        enablePrPreviews = prChoice;
+
+        aiAssistants = await getAiAssistants();
+    }
+
     const project = await group({
         region: () => select({
             message: 'Which AWS region do you want to deploy to?',
@@ -151,6 +165,28 @@ export async function getProjectConfig(isHeadless, headlessOptions, targetDir, d
         desiredCount: project.desiredCount || '1',
         branch: project.branch || currentGitBranch,
         needsDatabase,
+        enablePrPreviews,
+        aiAssistants,
         setupType
     };
+}
+
+export async function getAiAssistants() {
+    const selected = await multiselect({
+        message: 'Which AI coding assistants does your team use?',
+        options: [
+            { value: 'cursor', label: 'Cursor', hint: 'Generates .cursor/rules/deploy-stack.mdc' },
+            { value: 'copilot', label: 'GitHub Copilot', hint: 'Generates .github/copilot-instructions.md' },
+            { value: 'windsurf', label: 'Windsurf', hint: 'Generates .windsurfrules' },
+            { value: 'claude', label: 'Claude Code / CLI Agents', hint: 'Generates CLAUDE.md' }
+        ],
+        required: false,
+    });
+
+    if (typeof selected === 'symbol') {
+        cancel('Operation cancelled.');
+        process.exit(0);
+    }
+
+    return selected;
 }

package/templates/github/preview.yml

@@ -0,0 +1,69 @@
+name: Ephemeral PR Preview
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+env:
+  AWS_REGION: {{REGION}}
+  ECR_REPOSITORY: {{PROJECT_NAME}}-repo
+  WORKSPACE: pr-${{ github.event.pull_request.number }}
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write # Required to post the comment
+
+jobs:
+  deploy-preview:
+    name: Provision Preview Environment
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::{{AWS_ACCOUNT_ID}}:role/{{PROJECT_NAME}}-github-actions-role
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build and Push Docker image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+        run: |
+          # We tag the image specifically for this PR workspace
+          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:${{ env.WORKSPACE }} .
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:${{ env.WORKSPACE }}
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform Init & Apply
+        id: tf-apply
+        working-directory: ./terraform
+        run: |
+          terraform init
+          # Create or select the workspace specific to this PR
+          terraform workspace select -or-create ${{ env.WORKSPACE }}
+          terraform apply -auto-approve
+          
+          # Extract the ALB URL to post to GitHub
+          ALB_URL=$(terraform output -raw alb_direct_url)
+          echo "PREVIEW_URL=$ALB_URL" >> $GITHUB_ENV
+
+      - name: Comment PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `🚀 **Preview Environment Deployed!**\n\nYour ephemeral AWS Fargate environment is live at:\n[${process.env.PREVIEW_URL}](${process.env.PREVIEW_URL})\n\n_This environment will be automatically destroyed when the PR is merged or closed._\n\n---\n<div align="right"><sup>☁️ Generated by <a href="https://github.com/anton-codes-iac/deploy-stack">deploy-stack</a></sup></div>`
+            })

package/templates/github/teardown.yml

@@ -0,0 +1,43 @@
+name: Destroy PR Preview
+
+on:
+  pull_request:
+    types: [closed]
+
+env:
+  AWS_REGION: {{REGION}}
+  WORKSPACE: pr-${{ github.event.pull_request.number }}
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  destroy-preview:
+    name: Teardown Preview Environment
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::{{AWS_ACCOUNT_ID}}:role/{{PROJECT_NAME}}-github-actions-role
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform Init & Destroy
+        working-directory: ./terraform
+        run: |
+          terraform init
+          # Select the PR workspace
+          terraform workspace select ${{ env.WORKSPACE }}
+          # Destroy all resources in this workspace safely
+          terraform destroy -auto-approve
+          # Switch back to default and delete the PR workspace
+          terraform workspace select default
+          terraform workspace delete ${{ env.WORKSPACE }}

package/templates/terraform/database.tf

@@ -6,19 +6,19 @@ resource "aws_subnet" "db_isolated" {
   availability_zone = data.aws_availability_zones.available.names[count.index]
 
   tags = {
-    Name = "{{PROJECT_NAME}}-db-isolated-${count.index}"
+    Name = "${local.app_name}-db-isolated-${count.index}"
   }
 }
 
 resource "aws_db_subnet_group" "main" {
-  name       = "{{PROJECT_NAME}}-db-subnet-group"
+  name       = "${local.app_name}-db-subnet-group"
   subnet_ids = aws_subnet.db_isolated[*].id
 }
 
 # 2. Database Security Group
 resource "aws_security_group" "rds" {
-  name        = "{{PROJECT_NAME}}-rds-sg"
-  vpc_id      = aws_vpc.main.id
+  name   = "${local.app_name}-rds-sg"
+  vpc_id = aws_vpc.main.id
 
   # ONLY allow inbound traffic from the ECS Fargate tasks
   ingress {
@@ -31,31 +31,31 @@ resource "aws_security_group" "rds" {
 
 # 3. The PostgreSQL Instance
 resource "aws_db_instance" "postgres" {
-  identifier                  = "{{PROJECT_NAME}}-db"
-  engine                      = "postgres"
-  engine_version              = "16"
-  instance_class              = "db.t4g.micro"
-  allocated_storage           = 20
-  storage_encrypted           = true
-  
+  identifier        = "${local.app_name}-db"
+  engine            = "postgres"
+  engine_version    = "16"
+  instance_class    = "db.t4g.micro"
+  allocated_storage = 20
+  storage_encrypted = true
+
   # Clean up dashes for the database name (e.g. my-project -> my_project)
-  db_name                     = replace("{{PROJECT_NAME}}", "-", "_") 
-  username                    = "dbadmin"
-  
+  db_name  = replace("${local.app_name}", "-", "_")
+  username = "dbadmin"
+
   # AWS automatically creates and manages the secret in Secrets Manager!
-  manage_master_user_password = true 
+  manage_master_user_password = true
 
-  db_subnet_group_name        = aws_db_subnet_group.main.name
-  vpc_security_group_ids      = [aws_security_group.rds.id]
-  
-  skip_final_snapshot         = true
-  publicly_accessible         = false
+  db_subnet_group_name   = aws_db_subnet_group.main.name
+  vpc_security_group_ids = [aws_security_group.rds.id]
+
+  skip_final_snapshot = true
+  publicly_accessible = false
 }
 
 # 4. IAM Permission for RDS Master Password Secret
 resource "aws_iam_role_policy" "rds_secret_access" {
-  name   = "{{PROJECT_NAME}}-rds-secret-policy"
-  role   = aws_iam_role.execution_role.id
+  name = "${local.app_name}-rds-secret-policy"
+  role = aws_iam_role.execution_role.id
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -68,4 +68,4 @@ resource "aws_iam_role_policy" "rds_secret_access" {
       }
     ]
   })
-}
+}

package/templates/terraform/main.tf

@@ -12,16 +12,23 @@ provider "aws" {
 locals {
   # Safely read the keys generated by the CLI, default to empty list if file doesn't exist
   secret_keys = fileexists("${path.module}/secret_keys.json") ? jsondecode(file("${path.module}/secret_keys.json")) : []
+  
+  # Workspace suffix for PR preview environments (e.g., "-pr-123"). Empty for production.
+  env_suffix = terraform.workspace == "default" ? "" : "-${terraform.workspace}"
+  
+  # Dynamic naming variable to prevent collisions
+  app_name = "{{PROJECT_NAME}}${local.env_suffix}"
 }
 
 # --- CloudWatch Logs ---
 resource "aws_cloudwatch_log_group" "app_logs" {
-  name              = "/ecs/{{PROJECT_NAME}}"
+  name              = "/ecs/${local.app_name}"
   retention_in_days = 14
 }
 
-# --- ECR Repository ---
+# --- ECR Repository (Shared across workspaces) ---
 resource "aws_ecr_repository" "app" {
+  count                = terraform.workspace == "default" ? 1 : 0
   name                 = "{{PROJECT_NAME}}-repo"
   # trivy:ignore:AVD-AWS-0031 - Mutable tags allow the CI/CD pipeline to reuse the 'latest' tag for simplified deployments
   image_tag_mutability = "MUTABLE"
@@ -32,6 +39,16 @@ resource "aws_ecr_repository" "app" {
   }
 }
 
+# In PR workspaces, fetch the existing production repository
+data "aws_ecr_repository" "existing_app" {
+  count = terraform.workspace != "default" ? 1 : 0
+  name  = "{{PROJECT_NAME}}-repo"
+}
+
+locals {
+  ecr_url = terraform.workspace == "default" ? aws_ecr_repository.app[0].repository_url : data.aws_ecr_repository.existing_app[0].repository_url
+}
+
 # --- IAM: Execution Role ---
 # Allows the underlying AWS Fargate agent to pull images and push logs
 data "aws_iam_policy_document" "ecs_trust" {
@@ -45,7 +62,7 @@ data "aws_iam_policy_document" "ecs_trust" {
 }
 
 resource "aws_iam_role" "execution_role" {
-  name               = "{{PROJECT_NAME}}-execution-role"
+  name               = "${local.app_name}-execution-role"
   assume_role_policy = data.aws_iam_policy_document.ecs_trust.json
 }
 
@@ -57,18 +74,18 @@ resource "aws_iam_role_policy_attachment" "execution_role_policy" {
 # --- IAM: Task Role ---
 # Allows your application code running INSIDE the container to access AWS services
 resource "aws_iam_role" "task_role" {
-  name               = "{{PROJECT_NAME}}-task-role"
+  name               = "${local.app_name}-task-role"
   assume_role_policy = data.aws_iam_policy_document.ecs_trust.json
 }
 
 # --- ECS Cluster ---
 resource "aws_ecs_cluster" "main" {
-  name = "{{PROJECT_NAME}}-cluster"
+  name = "${local.app_name}-cluster"
 }
 
 # --- ECS Task Definition ---
 resource "aws_ecs_task_definition" "app" {
-  family                   = "{{PROJECT_NAME}}-task"
+  family                   = "${local.app_name}-task"
   network_mode             = "awsvpc"
   requires_compatibilities = ["FARGATE"]
   cpu                      = "{{CPU}}"
@@ -78,8 +95,8 @@ resource "aws_ecs_task_definition" "app" {
 
   container_definitions = jsonencode([
     {
-      name      = "{{PROJECT_NAME}}-container"
-      image     = "${aws_ecr_repository.app.repository_url}:latest"
+      name      = "${local.app_name}-container"
+      image     = "${local.ecr_url}:${terraform.workspace == "default" ? "latest" : terraform.workspace}"
       essential = true
 
       environment = [
@@ -92,7 +109,7 @@ resource "aws_ecs_task_definition" "app" {
         [
           for key in local.secret_keys : {
             name      = key
-            valueFrom = "${aws_secretsmanager_secret.app_secrets.arn}:${key}::"
+            valueFrom = "${local.secret_arn}:${key}::"
           }
         ],
         [
@@ -125,7 +142,7 @@ resource "aws_ecs_task_definition" "app" {
 # --- Application Load Balancer ---
 # trivy:ignore:AVD-AWS-0053 - This ALB is intended to be publicly facing behind CloudFront
 resource "aws_lb" "main" {
-  name               = "{{SAFE_ALB_NAME}}-alb"
+  name               = substr("${local.app_name}-alb", 0, 32)
   load_balancer_type = "application"
   security_groups    = [aws_security_group.alb.id]
   subnets            = aws_subnet.public[*].id
@@ -133,7 +150,7 @@ resource "aws_lb" "main" {
 }
 
 resource "aws_lb_target_group" "app" {
-  name        = "{{SAFE_ALB_NAME}}-tg"
+  name        = substr("${local.app_name}-tg", 0, 32)
   port        = {{PORT}}
   protocol    = "HTTP"
   vpc_id      = aws_vpc.main.id
@@ -163,7 +180,7 @@ resource "aws_lb_listener" "http" {
 
 # --- ECS Service ---
 resource "aws_ecs_service" "app" {
-  name            = "{{PROJECT_NAME}}-service"
+  name            = "${local.app_name}-service"
   cluster         = aws_ecs_cluster.main.id
   task_definition = aws_ecs_task_definition.app.arn
   launch_type     = "FARGATE"
@@ -177,7 +194,7 @@ resource "aws_ecs_service" "app" {
 
   load_balancer {
     target_group_arn = aws_lb_target_group.app.arn
-    container_name   = "{{PROJECT_NAME}}-container"
+    container_name   = "${local.app_name}-container"
     container_port   = {{PORT}}
   }
 
@@ -194,7 +211,7 @@ resource "aws_iam_role_policy" "secrets_policy" {
       {
         Effect = "Allow"
         Action = ["secretsmanager:GetSecretValue"]
-        Resource = [aws_secretsmanager_secret.app_secrets.arn]
+        Resource = [local.secret_arn]
       }
     ]
   })
@@ -208,12 +225,12 @@ output "alb_direct_url" {
 
 output "ecr_repository_url" {
   description = "The URL of the ECR repository"
-  value       = aws_ecr_repository.app.repository_url
+  value       = local.ecr_url
 }
 
 # --- CloudWatch Alarms ---
 resource "aws_cloudwatch_metric_alarm" "alb_5xx_errors" {
-  alarm_name          = "{{PROJECT_NAME}}-high-5xx-errors"
+  alarm_name          = "${local.app_name}-high-5xx-errors"
   comparison_operator = "GreaterThanThreshold"
   evaluation_periods  = "2"
   metric_name         = "HTTPCode_Target_5XX_Count"

package/templates/terraform/network.tf

@@ -5,7 +5,7 @@ resource "aws_vpc" "main" {
   enable_dns_support   = true
 
   tags = {
-    Name = "{{PROJECT_NAME}}-vpc"
+    Name = "${local.app_name}-vpc"
   }
 }
 
@@ -28,7 +28,7 @@ resource "aws_subnet" "public" {
   map_public_ip_on_launch = true
 
   tags = {
-    Name = "{{PROJECT_NAME}}-public-subnet-${count.index + 1}"
+    Name = "${local.app_name}-public-subnet-${count.index + 1}"
   }
 }
 
@@ -50,7 +50,7 @@ resource "aws_route_table_association" "public" {
 # --- Security Groups ---
 # ALB SG: Allow public internet access on HTTP
 resource "aws_security_group" "alb" {
-  name        = "{{PROJECT_NAME}}-alb-sg"
+  name        = "${local.app_name}-alb-sg"
   description = "Allow inbound HTTP to ALB"
   vpc_id      = aws_vpc.main.id
 
@@ -72,7 +72,7 @@ resource "aws_security_group" "alb" {
 
 # ECS SG: Allow traffic ONLY from the ALB on the app's specific port
 resource "aws_security_group" "ecs_tasks" {
-  name        = "{{PROJECT_NAME}}-ecs-sg"
+  name        = "${local.app_name}-ecs-sg"
   description = "Allow inbound access from the ALB only"
   vpc_id      = aws_vpc.main.id
 

package/templates/terraform/oidc.tf

@@ -9,9 +9,9 @@ variable "create_oidc_provider" {
   default     = true
 }
 
-# Register GitHub as an Identity Provider in AWS
+# Register GitHub as an Identity Provider in AWS (Production Only)
 resource "aws_iam_openid_connect_provider" "github" {
-  count           = var.create_oidc_provider ? 1 : 0
+  count           = (var.create_oidc_provider && terraform.workspace == "default") ? 1 : 0
   url             = "https://token.actions.githubusercontent.com"
   client_id_list  = ["sts.amazonaws.com"]
   thumbprint_list = [data.tls_certificate.github.certificates[0].sha1_fingerprint]
@@ -19,18 +19,19 @@ resource "aws_iam_openid_connect_provider" "github" {
 
 # Reference the Provider (whether newly created or already existing)
 data "aws_iam_openid_connect_provider" "github_existing" {
-  count = var.create_oidc_provider ? 0 : 1
-  url = "https://token.actions.githubusercontent.com"
+  count = (var.create_oidc_provider && terraform.workspace == "default") ? 0 : 1
+  url   = "https://token.actions.githubusercontent.com"
 }
 
 # Dynamically pick the ARN of the provider based on the variable
 locals {
-  github_provider_arn = var.create_oidc_provider ? aws_iam_openid_connect_provider.github[0].arn : data.aws_iam_openid_connect_provider.github_existing[0].arn
+  github_provider_arn = (var.create_oidc_provider && terraform.workspace == "default") ? aws_iam_openid_connect_provider.github[0].arn : data.aws_iam_openid_connect_provider.github_existing[0].arn
 }
 
 # Create the IAM Role that GitHub Actions will assume
 resource "aws_iam_role" "github_actions" {
-  name = "{{PROJECT_NAME}}-github-actions-role"
+  count = terraform.workspace == "default" ? 1 : 0
+  name  = "{{PROJECT_NAME}}-github-actions-role"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -44,10 +45,10 @@ resource "aws_iam_role" "github_actions" {
         Condition = {
           StringLike = {
             # ⚠️ SECURITY: Update "repo:*" to "repo:your-github-username/your-repo-name:*" in production
-            "token.actions.githubusercontent.com:sub" : "repo:*" 
+            "token.actions.githubusercontent.com:sub" : "repo:*"
           }
           StringEquals = {
-            "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
+            "token.actions.githubusercontent.com:aud" : "sts.amazonaws.com"
           }
         }
       }
@@ -57,6 +58,7 @@ resource "aws_iam_role" "github_actions" {
 
 # Grant the CI/CD pipeline permissions to provision infrastructure
 resource "aws_iam_role_policy_attachment" "github_actions_admin" {
-  role       = aws_iam_role.github_actions.name
-  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess" 
-}
+  count      = terraform.workspace == "default" ? 1 : 0
+  role       = aws_iam_role.github_actions[0].name
+  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
+}

package/templates/terraform/secrets.tf

@@ -1,10 +1,24 @@
-# --- AWS Secrets Manager ---
+# --- Shared AWS Secrets Manager ---
+
+# 1. Only create the Secret Vault in the default (production) workspace
 resource "aws_secretsmanager_secret" "app_secrets" {
+  count                   = terraform.workspace == "default" ? 1 : 0
   name                    = "{{PROJECT_NAME}}-secrets"
   description             = "Environment variables for {{PROJECT_NAME}}"
   recovery_window_in_days = 0 # Allows instant deletion for dev/POC environments
 }
 
+# 2. Fetch the existing Secret Vault when running in a PR workspace
+data "aws_secretsmanager_secret" "existing_secrets" {
+  count = terraform.workspace != "default" ? 1 : 0
+  name  = "{{PROJECT_NAME}}-secrets"
+}
+
+# 3. Export a single local variable that works in both environments
+locals {
+  secret_arn = terraform.workspace == "default" ? aws_secretsmanager_secret.app_secrets[0].arn : data.aws_secretsmanager_secret.existing_secrets[0].arn
+}
+
 # Fallback dummy key for CI/CD environments where the real key isn't present
 variable "rails_master_key" {
   type    = string
@@ -13,7 +27,8 @@ variable "rails_master_key" {
 
 # Initial placeholder secret so the ECS task doesn't fail on first boot
 resource "aws_secretsmanager_secret_version" "app_secrets_initial" {
-  secret_id = aws_secretsmanager_secret.app_secrets.id
+  count         = terraform.workspace == "default" ? 1 : 0
+  secret_id     = aws_secretsmanager_secret.app_secrets[0].id
   secret_string = jsonencode({{INITIAL_SECRET_MAP}})
 
   lifecycle {

package/templates/terraform/worker.tf

@@ -1,6 +1,6 @@
 # --- Worker ECS Task Definition ---
 resource "aws_ecs_task_definition" "worker" {
-  family                   = "{{PROJECT_NAME}}-worker-task"
+  family                   = "${local.app_name}-worker-task"
   network_mode             = "awsvpc"
   requires_compatibilities = ["FARGATE"]
   cpu                      = "{{CPU}}"
@@ -10,8 +10,8 @@ resource "aws_ecs_task_definition" "worker" {
 
   container_definitions = jsonencode([
     {
-      name      = "{{PROJECT_NAME}}-worker-container"
-      image     = "${aws_ecr_repository.app.repository_url}:latest"
+      name      = "${local.app_name}-worker-container"
+      image     = "${aws_ecr_repository.app.repository_url}:${terraform.workspace == "default" ? "latest" : terraform.workspace}"
       essential = true
 
       environment = [
@@ -23,7 +23,7 @@ resource "aws_ecs_task_definition" "worker" {
         [
           for key in local.secret_keys : {
             name      = key
-            valueFrom = "${aws_secretsmanager_secret.app_secrets.arn}:${key}::"
+            valueFrom = "${local.secret_arn}:${key}::"
           }
         ],
         [
@@ -48,7 +48,7 @@ resource "aws_ecs_task_definition" "worker" {
 # --- Worker ECS Service ---
 # Notice there is NO load_balancer block. This service is strictly private.
 resource "aws_ecs_service" "worker" {
-  name            = "{{PROJECT_NAME}}-worker-service"
+  name            = "${local.app_name}-worker-service"
   cluster         = aws_ecs_cluster.main.id
   task_definition = aws_ecs_task_definition.worker.arn
   launch_type     = "FARGATE"