deploy-stack 0.4.0 → 0.5.0

package/README.md

@@ -33,6 +33,8 @@ You retain complete ownership of your infrastructure code without relying on bla
 * **Remote State with Native S3 Locking:** Automatically creates an encrypted S3 state bucket utilizing modern native S3 concurrency locking.
 * **Built-in Secrets Sync:** Provides a dedicated CLI workflow to securely push local `.env` variables into AWS Secrets Manager and map them directly into containers at runtime.
 * **Non-Destructive:** Safely analyzes existing directories and prompts for confirmation before updating any files.
+* **Zero-Config Detection:** Automatically resolves output directories for Vite, Astro, SvelteKit, CRA, and more.
+* **Safe Teardown:** Completely remove all generated AWS resources and empty S3 state buckets with a single `destroy` command.
 
 ---
 
@@ -81,6 +83,12 @@ npx deploy-stack secrets push .env.production
 
 ---
 
+## 🗑️ Infrastructure Teardown
+To safely completely remove your ECS cluster, load balancers, and empty the remote S3 state bucket, run:
+`npx deploy-stack destroy`
+
+---
+
 ## 📁 Generated File Structure
 
 Running the CLI generates a modular architecture tailored to your service:

package/bin/cli.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import path from 'path';
+import { mainStack } from '../src/commands/init.js';
+import { destroyStack } from '../src/commands/destroy.js';
 import { runDoctor } from '../src/commands/doctor.js';
 import { pushSecrets } from '../src/commands/secrets.js';
-import { mainStack } from '../src/commands/init.js';
 
 // 1. Extract the telemetry flag and set the environment variable
 const rawArgs = process.argv.slice(2);
@@ -22,6 +23,8 @@ if (args[0] === 'secrets' && args[1] === 'push') {
     pushSecrets(envFile, projectName).catch(console.error);
 } else if (args[0] === 'doctor') {
     runDoctor().catch(console.error);
+} else if (args[0] === 'destroy') {
+    destroyStack().catch(console.error);
 } else {
     mainStack().catch(console.error);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "type": "module",
   "bin": {

package/src/commands/destroy.js

@@ -0,0 +1,77 @@
+import fsSync from 'fs';
+import path from 'path';
+import { intro, outro, confirm, spinner, cancel } from '@clack/prompts';
+import color from 'picocolors';
+import { execSync } from 'child_process';
+import { teardownStateBucket } from '../utils/aws.js';
+import { checkDependency } from '../utils/system.js';
+import { trackEvent, flushTelemetry } from '../core/telemetry.js';
+
+export async function destroyStack() {
+    intro(color.bgRed(color.white(' deploy-stack destroy 🗑️  ')));
+
+    const tfDirPath = path.join(process.cwd(), 'terraform');
+    const backendFilePath = path.join(tfDirPath, 'backend.tf');
+
+    if (!fsSync.existsSync(backendFilePath)) {
+        console.error(color.red('✖ No terraform/backend.tf found in the current directory.'));
+        console.log(color.yellow('Are you in the root of a deploy-stack project?'));
+        process.exit(1);
+    }
+
+    const hasTerraform = await checkDependency('terraform');
+    if (!hasTerraform) {
+        console.error(color.red('✖ Terraform is not installed.'));
+        process.exit(1);
+    }
+
+    const proceed = await confirm({
+        message: color.red('⚠️  WARNING: This will permanently destroy all AWS resources associated with this project. Are you absolutely sure?'),
+        initialValue: false,
+    });
+
+    if (!proceed) {
+        cancel('Destruction cancelled. Your infrastructure is safe.');
+        process.exit(0);
+    }
+
+    const s = spinner();
+
+    // 1. Extract Bucket and Region from backend.tf
+    const backendContent = fsSync.readFileSync(backendFilePath, 'utf-8');
+    const bucketMatch = backendContent.match(/bucket\s*=\s*"([^"]+)"/);
+    const regionMatch = backendContent.match(/region\s*=\s*"([^"]+)"/);
+
+    const bucketName = bucketMatch ? bucketMatch[1] : null;
+    const region = regionMatch ? regionMatch[1] : 'us-east-1';
+
+    // 2. Execute Terraform Destroy
+    console.log(color.cyan('\nInitiating Terraform destroy (this may take a few minutes)...\n'));
+    try {
+        execSync('terraform destroy -auto-approve', { cwd: tfDirPath, stdio: 'inherit' });
+    } catch (error) {
+        console.error(color.red('\n✖ Terraform destroy failed. Please check the output above.'));
+        process.exit(1);
+    }
+
+    // 3. Clean up the S3 State Bucket
+    if (bucketName) {
+        s.start(`Emptying and deleting S3 state bucket: ${bucketName}...`);
+        try {
+            await teardownStateBucket(region, bucketName);
+            s.stop(`S3 bucket ${bucketName} successfully deleted.`);
+        } catch (error) {
+            s.stop(`❌ Failed to delete S3 bucket. You may need to delete it manually in the AWS Console.`);
+            console.error(color.red(`AWS Error: ${error.message}`));
+        }
+    }
+
+    trackEvent('project_destroyed', {
+        region,
+        bucket: bucketName,
+        success: true
+    });
+    await flushTelemetry();
+
+    outro(color.green('✅ Infrastructure successfully destroyed. Your AWS bill is safe.'));
+}

package/src/commands/init.js

@@ -232,6 +232,7 @@ export async function mainStack() {
     trackEvent('project_provisioned', {
         projectName: actualProjectName,
         framework: finalFramework,
+        specific_framework: detectedFramework?.name || finalFramework,
         region: project.region,
         size: project.size,
         setup_mode: setupType,

package/src/utils/aws.js

@@ -1,5 +1,6 @@
 import { STSClient, GetCallerIdentityCommand } from '@aws-sdk/client-sts';
-import { S3Client, CreateBucketCommand, PutBucketVersioningCommand } from '@aws-sdk/client-s3';
+import { S3Client, CreateBucketCommand, PutBucketVersioningCommand, PutBucketTaggingCommand } from '@aws-sdk/client-s3';
+import { DeleteBucketCommand, ListObjectVersionsCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
 export async function provisionStateBucket(region, projectName) {
     const stsClient = new STSClient({ region });
@@ -23,6 +24,15 @@ export async function provisionStateBucket(region, projectName) {
             CreateBucketConfiguration: region === 'us-east-1' ? undefined : { LocationConstraint: region }
         }));
 
+        await s3Client.send(new PutBucketTaggingCommand({
+            Bucket: stateBucketName,
+            Tagging: {
+                TagSet: [
+                    { Key: "ManagedBy", Value: "deploy-stack" }
+                ]
+            }
+        }));
+
         await s3Client.send(new PutBucketVersioningCommand({
             Bucket: stateBucketName,
             VersioningConfiguration: { Status: 'Enabled' }
@@ -35,4 +45,36 @@ export async function provisionStateBucket(region, projectName) {
     }
 
     return { awsAccountId, stateBucketName };
+}
+
+export async function teardownStateBucket(region, bucketName) {
+    const client = new S3Client({ region });
+
+    try {
+        // 1. Fetch all object versions and delete markers
+        const listCommand = new ListObjectVersionsCommand({ Bucket: bucketName });
+        const { Versions, DeleteMarkers } = await client.send(listCommand);
+
+        const objectsToDelete = [];
+        if (Versions) objectsToDelete.push(...Versions.map(v => ({ Key: v.Key, VersionId: v.VersionId })));
+        if (DeleteMarkers) objectsToDelete.push(...DeleteMarkers.map(v => ({ Key: v.Key, VersionId: v.VersionId })));
+
+        // 2. Delete all contents if any exist
+        if (objectsToDelete.length > 0) {
+            const deleteCommand = new DeleteObjectsCommand({
+                Bucket: bucketName,
+                Delete: { Objects: objectsToDelete }
+            });
+            await client.send(deleteCommand);
+        }
+
+        // 3. Delete the now-empty bucket
+        const deleteBucketCommand = new DeleteBucketCommand({ Bucket: bucketName });
+        await client.send(deleteBucketCommand);
+
+        return true;
+    } catch (error) {
+        if (error.name === 'NoSuchBucket') return true; // Already deleted
+        throw error;
+    }
 }

package/templates/README.md

@@ -29,7 +29,7 @@ This infrastructure provisions a highly available Application Load Balancer (ALB
    ```
 
 3. **Automated CI/CD (Keyless via OIDC):**
-   Push this repository to GitHub. Your deployment pipeline uses AWS IAM OpenID Connect (OIDC) to authenticate securely with temporary credentials—**no long-lived AWS secret keys are required in GitHub Secrets**. Every push to `main` will automatically build, package, and deploy your application.
+   Push this repository to GitHub. Your deployment pipeline uses AWS IAM OpenID Connect (OIDC) to authenticate securely with temporary credentials—**no long-lived AWS secret keys are required in GitHub Secrets**. Every push to `{{DEPLOY_BRANCH}}` will automatically build, package, and deploy your application.
 
 ### ⚠️ Troubleshooting: OIDC Provider Already Exists
 AWS only permits one GitHub Actions OIDC provider per AWS account. If `terraform apply` fails with an `EntityAlreadyExists` error regarding the OIDC provider, it indicates GitHub Actions was previously configured in this account.
@@ -48,13 +48,11 @@ Re-run `terraform apply` to link directly to your existing provider.
 
 If you are done testing and want to stop all AWS billing, you must destroy the infrastructure. 
 
-Because our Terraform configuration is set to force-delete the ECR image repository (even if images are present), teardown is a single, clean command:
-
+Run the automated teardown command from the root of your project:
 ```bash
-cd terraform
-terraform destroy
+npx deploy-stack destroy
 ```
-*Type `yes` when prompted. This will permanently delete the Load Balancer, ECS cluster, log groups, and associated networking components.*
+*Type `yes` when prompted. This will execute a safe Terraform teardown of your Load Balancer, ECS cluster, and networking components, followed by automatically emptying and deleting your remote S3 state bucket.*
 
 ## ⚠️ Critical Application Prerequisites
 
@@ -94,8 +92,8 @@ Make sure your app is configured correctly:
 * **Express.js:** `app.listen(port, '0.0.0.0', () => ...)`
 * **FastAPI:** `uvicorn.run(app, host="0.0.0.0", port=8000)`
 
-### 4. Static Sites (Vite, Astro, React, Vue)
+### 4. Static Sites (Vite, Astro, React, Vue, SvelteKit)
 
 If you are deploying a static site, your application is served via a highly optimized, unprivileged Nginx container. 
-1. **Build Folder:** Different frameworks output compiled assets to different folders. Open your `Dockerfile` and ensure the `COPY --from=builder` command points to the correct folder (`dist`, `build`, or `out`).
-2. **Health Checks:** You do not need to configure a custom `/health` route. Nginx will automatically return a `200 OK` when AWS pings the root `/` index page.
+* **Zero-Config Build:** The CLI automatically detected your framework's output folder (`dist`, `build`, etc.) and pre-configured your Dockerfile. 
+* **Health Checks:** You do not need to configure a custom `/health` route. Nginx will automatically return a `200 OK` when AWS pings the root `/` index page.