icdev 0.0.3__py3-none-any.whl

tools/forge_studio/deploy/deploy_engine.py

@@ -0,0 +1,1792 @@
+# CUI // SP-CTI
+"""Deploy engine — multi-cloud IaC generation for Forge Studio apps.
+
+Generates deployment artifacts for any cloud provider:
+- AWS (ECS Fargate + RDS + S3 — standard and GovCloud regions)
+- Azure (Container Apps + Azure Database for PostgreSQL + Blob Storage)
+- GCP (Cloud Run + Cloud SQL + Cloud Storage)
+- On-Prem / Docker Compose (existing, re-exported here for consistency)
+
+Each provider generates:
+1. Terraform HCL (main.tf, variables.tf, outputs.tf)
+2. Environment-specific tfvars (dev, staging, prod)
+3. CI/CD pipeline config (GitHub Actions, GitLab CI, Azure DevOps)
+4. Kubernetes manifests (optional, for K8s-based targets)
+
+Architecture decisions:
+- D-FS-DEPLOY-1: Multi-cloud via provider-specific Terraform modules (not CDK/Pulumi — widest adoption)
+- D-FS-DEPLOY-2: All IaC is deterministic template generation (no LLM in deployment path)
+- D-FS-DEPLOY-3: Environment configs are layered: base + provider + env override
+- D-FS-DEPLOY-4: GovCloud is a region variant of AWS, not a separate provider
+
+CLI: python tools/forge_studio/deploy/deploy_engine.py --app-id "..." --provider aws --env prod --json
+"""
+from __future__ import annotations
+
+import json
+import logging
+import os
+import time
+import uuid
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+from tools.forge_studio.audit import log_forge_event
+
+logger = logging.getLogger("forge_studio.deploy")
+
+# ---------------------------------------------------------------------------
+# Supported providers and regions
+# ---------------------------------------------------------------------------
+
+PROVIDERS = {
+    "aws": {
+        "name": "Amazon Web Services",
+        "regions": [
+            "us-east-1", "us-east-2", "us-west-1", "us-west-2",
+            "eu-west-1", "eu-west-2", "eu-central-1",
+            "ap-southeast-1", "ap-northeast-1",
+            "us-gov-west-1", "us-gov-east-1",  # GovCloud
+        ],
+        "govcloud_regions": ["us-gov-west-1", "us-gov-east-1"],
+    },
+    "azure": {
+        "name": "Microsoft Azure",
+        "regions": [
+            "eastus", "eastus2", "westus2", "westus3",
+            "northeurope", "westeurope", "uksouth",
+            "southeastasia", "japaneast",
+            "usgovvirginia", "usgovarizona",  # Azure Government
+        ],
+        "govcloud_regions": ["usgovvirginia", "usgovarizona"],
+    },
+    "gcp": {
+        "name": "Google Cloud Platform",
+        "regions": [
+            "us-central1", "us-east1", "us-west1",
+            "europe-west1", "europe-west2",
+            "asia-southeast1", "asia-northeast1",
+        ],
+        "govcloud_regions": [],
+    },
+    "onprem": {
+        "name": "On-Premises / Docker Compose",
+        "regions": ["local"],
+        "govcloud_regions": [],
+    },
+}
+
+ENVIRONMENTS = ["dev", "staging", "prod"]
+
+
+# ---------------------------------------------------------------------------
+# Main deploy generation entry point
+# ---------------------------------------------------------------------------
+
+def generate_deployment(
+    app_id: str = "",
+    app_name: str = "forge-app",
+    provider: str = "aws",
+    region: str = "",
+    environment: str = "prod",
+    output_dir: str = "",
+    project_id: str = "",
+    enable_k8s: bool = False,
+    enable_cicd: bool = True,
+    domain: str = "",
+    replicas: int = 2,
+) -> Dict[str, Any]:
+    """Generate deployment artifacts for a Forge Studio app.
+
+    Args:
+        app_id: App ID (for audit trail)
+        app_name: App name for resource naming
+        provider: aws | azure | gcp | onprem
+        region: Cloud region (default per provider if empty)
+        environment: dev | staging | prod
+        output_dir: Where to write files (default: .tmp/deploy/{app_name})
+        enable_k8s: Generate K8s manifests in addition to provider-native
+        enable_cicd: Generate CI/CD pipeline configs
+        domain: Custom domain for the app
+        replicas: Number of app replicas
+
+    Returns: {status, provider, region, environment, output_dir, files_created}
+    """
+    start = time.time()
+
+    if provider not in PROVIDERS:
+        return {"status": "error", "error": f"Unknown provider: {provider}. Valid: {list(PROVIDERS.keys())}"}
+    if environment not in ENVIRONMENTS:
+        return {"status": "error", "error": f"Unknown environment: {environment}. Valid: {ENVIRONMENTS}"}
+
+    safe_name = app_name.lower().replace(" ", "-").replace("_", "-")[:40]
+
+    # Default region
+    if not region:
+        region = PROVIDERS[provider]["regions"][0]
+
+    # Default output
+    if not output_dir:
+        output_dir = str(Path.cwd() / ".tmp" / "deploy" / safe_name / provider)
+
+    out = Path(output_dir)
+    out.mkdir(parents=True, exist_ok=True)
+
+    files_created: List[str] = []
+    is_govcloud = region in PROVIDERS[provider].get("govcloud_regions", [])
+
+    config = {
+        "app_name": safe_name,
+        "app_display_name": app_name,
+        "provider": provider,
+        "region": region,
+        "environment": environment,
+        "is_govcloud": is_govcloud,
+        "domain": domain or f"{safe_name}.example.com",
+        "replicas": replicas,
+    }
+
+    # Generate provider-specific Terraform
+    if provider == "aws":
+        tf_files = _generate_aws_terraform(config)
+    elif provider == "azure":
+        tf_files = _generate_azure_terraform(config)
+    elif provider == "gcp":
+        tf_files = _generate_gcp_terraform(config)
+    elif provider == "onprem":
+        tf_files = _generate_onprem_files(config)
+    else:
+        tf_files = {}
+
+    for filepath, content in tf_files.items():
+        _write_file(out, filepath, content, files_created)
+
+    # Environment tfvars
+    tfvars = _generate_tfvars(config)
+    _write_file(out, f"envs/{environment}.tfvars", tfvars, files_created)
+
+    # K8s manifests (optional)
+    if enable_k8s and provider != "onprem":
+        k8s_files = _generate_k8s_manifests(config)
+        for filepath, content in k8s_files.items():
+            _write_file(out, filepath, content, files_created)
+
+    # CI/CD pipeline
+    if enable_cicd:
+        cicd_files = _generate_cicd_pipeline(config)
+        for filepath, content in cicd_files.items():
+            _write_file(out, filepath, content, files_created)
+
+    # Deploy record
+    deploy_id = f"deploy-{uuid.uuid4().hex[:12]}"
+    duration_ms = int((time.time() - start) * 1000)
+
+    _record_deployment(deploy_id, app_id, config, files_created, project_id)
+
+    log_forge_event("forge_studio_deploy_generated", {
+        "deploy_id": deploy_id,
+        "app_id": app_id,
+        "app_name": app_name,
+        "provider": provider,
+        "region": region,
+        "environment": environment,
+        "is_govcloud": is_govcloud,
+        "files_created": len(files_created),
+        "duration_ms": duration_ms,
+    }, project_id=project_id)
+
+    return {
+        "status": "success",
+        "deploy_id": deploy_id,
+        "provider": PROVIDERS[provider]["name"],
+        "region": region,
+        "environment": environment,
+        "is_govcloud": is_govcloud,
+        "output_dir": str(out),
+        "files_created": files_created,
+        "file_count": len(files_created),
+        "duration_ms": duration_ms,
+    }
+
+
+def list_providers() -> List[Dict[str, Any]]:
+    """List available cloud providers with their regions."""
+    return [
+        {
+            "id": pid,
+            "name": p["name"],
+            "regions": p["regions"],
+            "govcloud_regions": p["govcloud_regions"],
+        }
+        for pid, p in PROVIDERS.items()
+    ]
+
+
+def get_deployments(app_id: str) -> List[Dict[str, Any]]:
+    """Get deployment history for an app."""
+    from tools.db.storage import get_connection
+
+    with get_connection() as conn:
+        rows = conn.execute(
+            "SELECT id, app_id, provider, region, environment, status, "
+            "config_json, created_at FROM forge_studio_deployments "
+            "WHERE app_id = ? ORDER BY created_at DESC",
+            (app_id,),
+        ).fetchall()
+
+    return [
+        {
+            "id": r[0], "app_id": r[1], "provider": r[2], "region": r[3],
+            "environment": r[4], "status": r[5],
+            "config": json.loads(r[6]) if r[6] else {},
+            "created_at": r[7],
+        }
+        for r in rows
+    ]
+
+
+# ---------------------------------------------------------------------------
+# AWS Terraform
+# ---------------------------------------------------------------------------
+
+def _generate_aws_terraform(config: Dict[str, Any]) -> Dict[str, str]:
+    name = config["app_name"]
+    region = config["region"]
+    env = config["environment"]
+    is_gov = config["is_govcloud"]
+    domain = config["domain"]
+    replicas = config["replicas"]
+
+    partition = "aws-us-gov" if is_gov else "aws"
+
+    main_tf = f'''# CUI // SP-CTI
+# Terraform — AWS deployment for {config["app_display_name"]}
+# Provider: AWS {"GovCloud " if is_gov else ""}({region})
+# Environment: {env}
+# Generated by Forge Studio
+
+terraform {{
+  required_version = ">= 1.5"
+  required_providers {{
+    aws = {{
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }}
+  }}
+  backend "s3" {{
+    bucket         = "{name}-terraform-state"
+    key            = "{env}/terraform.tfstate"
+    region         = "{region}"
+    encrypt        = true
+    dynamodb_table = "{name}-terraform-locks"
+  }}
+}}
+
+provider "aws" {{
+  region = var.region
+  default_tags {{
+    tags = {{
+      Project     = var.app_name
+      Environment = var.environment
+      ManagedBy   = "terraform"
+      Generator   = "forge-studio"
+    }}
+  }}
+}}
+
+# ── VPC ─────────────────────────────────────────────────────
+module "vpc" {{
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "~> 5.0"
+
+  name = "${{var.app_name}}-${{var.environment}}"
+  cidr = var.vpc_cidr
+
+  azs             = ["${{var.region}}a", "${{var.region}}b", "${{var.region}}c"]
+  private_subnets = var.private_subnets
+  public_subnets  = var.public_subnets
+
+  enable_nat_gateway   = true
+  single_nat_gateway   = var.environment != "prod"
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+}}
+
+# ── RDS PostgreSQL (Supabase-compatible) ────────────────────
+resource "aws_db_subnet_group" "main" {{
+  name       = "${{var.app_name}}-${{var.environment}}"
+  subnet_ids = module.vpc.private_subnets
+}}
+
+resource "aws_security_group" "rds" {{
+  name_prefix = "${{var.app_name}}-rds-"
+  vpc_id      = module.vpc.vpc_id
+
+  ingress {{
+    from_port       = 5432
+    to_port         = 5432
+    protocol        = "tcp"
+    security_groups = [aws_security_group.app.id]
+  }}
+}}
+
+resource "aws_db_instance" "main" {{
+  identifier     = "${{var.app_name}}-${{var.environment}}"
+  engine         = "postgres"
+  engine_version = "15.6"
+  instance_class = var.db_instance_class
+
+  allocated_storage     = var.db_storage_gb
+  max_allocated_storage = var.db_max_storage_gb
+  storage_encrypted     = true
+
+  db_name  = "app"
+  username = "supabase_admin"
+  password = var.db_password
+
+  db_subnet_group_name   = aws_db_subnet_group.main.name
+  vpc_security_group_ids = [aws_security_group.rds.id]
+
+  backup_retention_period = var.environment == "prod" ? 30 : 7
+  multi_az                = var.environment == "prod"
+  deletion_protection     = var.environment == "prod"
+  skip_final_snapshot     = var.environment != "prod"
+
+  performance_insights_enabled = true
+}}
+
+# ── ECS Fargate ─────────────────────────────────────────────
+resource "aws_security_group" "app" {{
+  name_prefix = "${{var.app_name}}-app-"
+  vpc_id      = module.vpc.vpc_id
+
+  ingress {{
+    from_port       = 3000
+    to_port         = 3000
+    protocol        = "tcp"
+    security_groups = [aws_security_group.alb.id]
+  }}
+
+  egress {{
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }}
+}}
+
+resource "aws_ecs_cluster" "main" {{
+  name = "${{var.app_name}}-${{var.environment}}"
+
+  setting {{
+    name  = "containerInsights"
+    value = "enabled"
+  }}
+}}
+
+resource "aws_ecs_task_definition" "app" {{
+  family                   = "${{var.app_name}}-${{var.environment}}"
+  requires_compatibilities = ["FARGATE"]
+  network_mode             = "awsvpc"
+  cpu                      = var.app_cpu
+  memory                   = var.app_memory
+  execution_role_arn       = aws_iam_role.ecs_execution.arn
+  task_role_arn            = aws_iam_role.ecs_task.arn
+
+  container_definitions = jsonencode([
+    {{
+      name  = "app"
+      image = "${{var.ecr_repository_url}}:${{var.image_tag}}"
+      portMappings = [{{ containerPort = 3000, protocol = "tcp" }}]
+      environment = [
+        {{ name = "NODE_ENV", value = var.environment }},
+        {{ name = "NEXT_PUBLIC_SUPABASE_URL", value = var.supabase_url }},
+        {{ name = "NEXT_PUBLIC_SUPABASE_ANON_KEY", value = var.supabase_anon_key }},
+      ]
+      logConfiguration = {{
+        logDriver = "awslogs"
+        options = {{
+          "awslogs-group"         = "/ecs/${{var.app_name}}-${{var.environment}}"
+          "awslogs-region"        = var.region
+          "awslogs-stream-prefix" = "app"
+        }}
+      }}
+      healthCheck = {{
+        command     = ["CMD-SHELL", "curl -f http://localhost:3000/ || exit 1"]
+        interval    = 30
+        timeout     = 5
+        retries     = 3
+        startPeriod = 60
+      }}
+    }}
+  ])
+}}
+
+resource "aws_ecs_service" "app" {{
+  name            = "${{var.app_name}}-${{var.environment}}"
+  cluster         = aws_ecs_cluster.main.id
+  task_definition = aws_ecs_task_definition.app.arn
+  desired_count   = var.replicas
+  launch_type     = "FARGATE"
+
+  network_configuration {{
+    subnets         = module.vpc.private_subnets
+    security_groups = [aws_security_group.app.id]
+  }}
+
+  load_balancer {{
+    target_group_arn = aws_lb_target_group.app.arn
+    container_name   = "app"
+    container_port   = 3000
+  }}
+
+  deployment_circuit_breaker {{
+    enable   = true
+    rollback = true
+  }}
+}}
+
+# ── ALB ─────────────────────────────────────────────────────
+resource "aws_security_group" "alb" {{
+  name_prefix = "${{var.app_name}}-alb-"
+  vpc_id      = module.vpc.vpc_id
+
+  ingress {{
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }}
+
+  ingress {{
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }}
+
+  egress {{
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }}
+}}
+
+resource "aws_lb" "main" {{
+  name               = "${{var.app_name}}-${{var.environment}}"
+  internal           = false
+  load_balancer_type = "application"
+  security_groups    = [aws_security_group.alb.id]
+  subnets            = module.vpc.public_subnets
+
+  enable_deletion_protection = var.environment == "prod"
+}}
+
+resource "aws_lb_target_group" "app" {{
+  name        = "${{var.app_name}}-${{var.environment}}"
+  port        = 3000
+  protocol    = "HTTP"
+  vpc_id      = module.vpc.vpc_id
+  target_type = "ip"
+
+  health_check {{
+    path                = "/"
+    healthy_threshold   = 2
+    unhealthy_threshold = 3
+    timeout             = 5
+    interval            = 30
+  }}
+}}
+
+resource "aws_lb_listener" "https" {{
+  load_balancer_arn = aws_lb.main.arn
+  port              = "443"
+  protocol          = "HTTPS"
+  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
+  certificate_arn   = var.acm_certificate_arn
+
+  default_action {{
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.app.arn
+  }}
+}}
+
+resource "aws_lb_listener" "http_redirect" {{
+  load_balancer_arn = aws_lb.main.arn
+  port              = "80"
+  protocol          = "HTTP"
+
+  default_action {{
+    type = "redirect"
+    redirect {{
+      port        = "443"
+      protocol    = "HTTPS"
+      status_code = "HTTP_301"
+    }}
+  }}
+}}
+
+# ── IAM Roles ───────────────────────────────────────────────
+resource "aws_iam_role" "ecs_execution" {{
+  name = "${{var.app_name}}-${{var.environment}}-ecs-exec"
+  assume_role_policy = jsonencode({{
+    Version = "2012-10-17"
+    Statement = [{{
+      Action = "sts:AssumeRole"
+      Effect = "Allow"
+      Principal = {{ Service = "ecs-tasks.amazonaws.com" }}
+    }}]
+  }})
+}}
+
+resource "aws_iam_role_policy_attachment" "ecs_execution" {{
+  role       = aws_iam_role.ecs_execution.name
+  policy_arn = "arn:{partition}:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+}}
+
+resource "aws_iam_role" "ecs_task" {{
+  name = "${{var.app_name}}-${{var.environment}}-ecs-task"
+  assume_role_policy = jsonencode({{
+    Version = "2012-10-17"
+    Statement = [{{
+      Action = "sts:AssumeRole"
+      Effect = "Allow"
+      Principal = {{ Service = "ecs-tasks.amazonaws.com" }}
+    }}]
+  }})
+}}
+
+# ── S3 for static assets ───────────────────────────────────
+resource "aws_s3_bucket" "assets" {{
+  bucket = "${{var.app_name}}-${{var.environment}}-assets"
+}}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "assets" {{
+  bucket = aws_s3_bucket.assets.id
+  rule {{
+    apply_server_side_encryption_by_default {{
+      sse_algorithm = "aws:kms"
+    }}
+  }}
+}}
+
+resource "aws_s3_bucket_public_access_block" "assets" {{
+  bucket                  = aws_s3_bucket.assets.id
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}}
+
+# ── CloudWatch Logs ─────────────────────────────────────────
+resource "aws_cloudwatch_log_group" "app" {{
+  name              = "/ecs/${{var.app_name}}-${{var.environment}}"
+  retention_in_days = var.environment == "prod" ? 365 : 30
+}}
+'''
+
+    variables_tf = f'''# CUI // SP-CTI
+# Variables for {config["app_display_name"]} AWS deployment
+
+variable "app_name" {{
+  type    = string
+  default = "{name}"
+}}
+
+variable "environment" {{
+  type    = string
+  default = "{env}"
+}}
+
+variable "region" {{
+  type    = string
+  default = "{region}"
+}}
+
+variable "vpc_cidr" {{
+  type    = string
+  default = "10.0.0.0/16"
+}}
+
+variable "private_subnets" {{
+  type    = list(string)
+  default = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
+}}
+
+variable "public_subnets" {{
+  type    = list(string)
+  default = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
+}}
+
+variable "db_instance_class" {{
+  type    = string
+  default = "db.t4g.medium"
+}}
+
+variable "db_storage_gb" {{
+  type    = number
+  default = 20
+}}
+
+variable "db_max_storage_gb" {{
+  type    = number
+  default = 100
+}}
+
+variable "db_password" {{
+  type      = string
+  sensitive = true
+}}
+
+variable "app_cpu" {{
+  type    = number
+  default = 512
+}}
+
+variable "app_memory" {{
+  type    = number
+  default = 1024
+}}
+
+variable "replicas" {{
+  type    = number
+  default = {replicas}
+}}
+
+variable "ecr_repository_url" {{
+  type = string
+}}
+
+variable "image_tag" {{
+  type    = string
+  default = "latest"
+}}
+
+variable "supabase_url" {{
+  type = string
+}}
+
+variable "supabase_anon_key" {{
+  type      = string
+  sensitive = true
+}}
+
+variable "acm_certificate_arn" {{
+  type    = string
+  default = ""
+}}
+'''
+
+    outputs_tf = f'''# CUI // SP-CTI
+# Outputs for {config["app_display_name"]} AWS deployment
+
+output "app_url" {{
+  value = "https://${{aws_lb.main.dns_name}}"
+}}
+
+output "rds_endpoint" {{
+  value     = aws_db_instance.main.endpoint
+  sensitive = true
+}}
+
+output "ecs_cluster_name" {{
+  value = aws_ecs_cluster.main.name
+}}
+
+output "alb_dns_name" {{
+  value = aws_lb.main.dns_name
+}}
+
+output "s3_bucket" {{
+  value = aws_s3_bucket.assets.bucket
+}}
+'''
+
+    return {
+        "terraform/main.tf": main_tf,
+        "terraform/variables.tf": variables_tf,
+        "terraform/outputs.tf": outputs_tf,
+    }
+
+
+# ---------------------------------------------------------------------------
+# Azure Terraform
+# ---------------------------------------------------------------------------
+
+def _generate_azure_terraform(config: Dict[str, Any]) -> Dict[str, str]:
+    name = config["app_name"]
+    region = config["region"]
+    env = config["environment"]
+    replicas = config["replicas"]
+
+    main_tf = f'''# CUI // SP-CTI
+# Terraform — Azure deployment for {config["app_display_name"]}
+# Provider: Azure ({region})
+# Environment: {env}
+# Generated by Forge Studio
+
+terraform {{
+  required_version = ">= 1.5"
+  required_providers {{
+    azurerm = {{
+      source  = "hashicorp/azurerm"
+      version = "~> 3.0"
+    }}
+  }}
+  backend "azurerm" {{
+    resource_group_name  = "{name}-tfstate"
+    storage_account_name = "{name.replace('-', '')}tfstate"
+    container_name       = "tfstate"
+    key                  = "{env}/terraform.tfstate"
+  }}
+}}
+
+provider "azurerm" {{
+  features {{}}
+}}
+
+# ── Resource Group ──────────────────────────────────────────
+resource "azurerm_resource_group" "main" {{
+  name     = "${{var.app_name}}-${{var.environment}}-rg"
+  location = var.region
+
+  tags = {{
+    Project     = var.app_name
+    Environment = var.environment
+    ManagedBy   = "terraform"
+    Generator   = "forge-studio"
+  }}
+}}
+
+# ── Azure Database for PostgreSQL Flexible Server ───────────
+resource "azurerm_postgresql_flexible_server" "main" {{
+  name                   = "${{var.app_name}}-${{var.environment}}-pg"
+  resource_group_name    = azurerm_resource_group.main.name
+  location               = azurerm_resource_group.main.location
+  version                = "15"
+  administrator_login    = "supabase_admin"
+  administrator_password = var.db_password
+  storage_mb             = var.db_storage_mb
+  sku_name               = var.db_sku
+  zone                   = "1"
+
+  backup_retention_days = var.environment == "prod" ? 30 : 7
+}}
+
+resource "azurerm_postgresql_flexible_server_database" "app" {{
+  name      = "app"
+  server_id = azurerm_postgresql_flexible_server.main.id
+  charset   = "UTF8"
+  collation = "en_US.utf8"
+}}
+
+resource "azurerm_postgresql_flexible_server_firewall_rule" "azure_services" {{
+  name      = "AllowAzureServices"
+  server_id = azurerm_postgresql_flexible_server.main.id
+  start_ip_address = "0.0.0.0"
+  end_ip_address   = "0.0.0.0"
+}}
+
+# ── Container Apps Environment ──────────────────────────────
+resource "azurerm_log_analytics_workspace" "main" {{
+  name                = "${{var.app_name}}-${{var.environment}}-logs"
+  resource_group_name = azurerm_resource_group.main.name
+  location            = azurerm_resource_group.main.location
+  sku                 = "PerGB2018"
+  retention_in_days   = var.environment == "prod" ? 365 : 30
+}}
+
+resource "azurerm_container_app_environment" "main" {{
+  name                       = "${{var.app_name}}-${{var.environment}}-env"
+  resource_group_name        = azurerm_resource_group.main.name
+  location                   = azurerm_resource_group.main.location
+  log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id
+}}
+
+# ── Container App ───────────────────────────────────────────
+resource "azurerm_container_app" "app" {{
+  name                         = "${{var.app_name}}-${{var.environment}}"
+  container_app_environment_id = azurerm_container_app_environment.main.id
+  resource_group_name          = azurerm_resource_group.main.name
+  revision_mode                = "Single"
+
+  template {{
+    min_replicas = var.environment == "prod" ? {replicas} : 1
+    max_replicas = var.environment == "prod" ? {replicas * 2} : 2
+
+    container {{
+      name   = "app"
+      image  = "${{var.container_registry}}/${{var.app_name}}:${{var.image_tag}}"
+      cpu    = var.app_cpu
+      memory = var.app_memory
+
+      env {{
+        name  = "NODE_ENV"
+        value = var.environment
+      }}
+      env {{
+        name  = "NEXT_PUBLIC_SUPABASE_URL"
+        value = var.supabase_url
+      }}
+      env {{
+        name        = "NEXT_PUBLIC_SUPABASE_ANON_KEY"
+        secret_name = "supabase-anon-key"
+      }}
+
+      liveness_probe {{
+        transport = "HTTP"
+        port      = 3000
+        path      = "/"
+      }}
+    }}
+  }}
+
+  ingress {{
+    external_enabled = true
+    target_port      = 3000
+    transport        = "auto"
+    traffic_weight {{
+      percentage      = 100
+      latest_revision = true
+    }}
+  }}
+
+  secret {{
+    name  = "supabase-anon-key"
+    value = var.supabase_anon_key
+  }}
+}}
+
+# ── Storage Account ─────────────────────────────────────────
+resource "azurerm_storage_account" "assets" {{
+  name                     = "${{replace(var.app_name, "-", "")}}${{var.environment}}"
+  resource_group_name      = azurerm_resource_group.main.name
+  location                 = azurerm_resource_group.main.location
+  account_tier             = "Standard"
+  account_replication_type = var.environment == "prod" ? "GRS" : "LRS"
+  min_tls_version          = "TLS1_2"
+
+  blob_properties {{
+    delete_retention_policy {{
+      days = 30
+    }}
+  }}
+}}
+'''
+
+    variables_tf = f'''# CUI // SP-CTI
+variable "app_name" {{
+  type    = string
+  default = "{name}"
+}}
+variable "environment" {{
+  type    = string
+  default = "{env}"
+}}
+variable "region" {{
+  type    = string
+  default = "{region}"
+}}
+variable "db_password" {{
+  type      = string
+  sensitive = true
+}}
+variable "db_storage_mb" {{
+  type    = number
+  default = 32768
+}}
+variable "db_sku" {{
+  type    = string
+  default = "B_Standard_B1ms"
+}}
+variable "app_cpu" {{
+  type    = number
+  default = 0.5
+}}
+variable "app_memory" {{
+  type    = string
+  default = "1Gi"
+}}
+variable "container_registry" {{
+  type = string
+}}
+variable "image_tag" {{
+  type    = string
+  default = "latest"
+}}
+variable "supabase_url" {{
+  type = string
+}}
+variable "supabase_anon_key" {{
+  type      = string
+  sensitive = true
+}}
+'''
+
+    outputs_tf = f'''# CUI // SP-CTI
+output "app_url" {{
+  value = "https://${{azurerm_container_app.app.latest_revision_fqdn}}"
+}}
+output "db_fqdn" {{
+  value     = azurerm_postgresql_flexible_server.main.fqdn
+  sensitive = true
+}}
+output "storage_account" {{
+  value = azurerm_storage_account.assets.name
+}}
+'''
+
+    return {
+        "terraform/main.tf": main_tf,
+        "terraform/variables.tf": variables_tf,
+        "terraform/outputs.tf": outputs_tf,
+    }
+
+
+# ---------------------------------------------------------------------------
+# GCP Terraform
+# ---------------------------------------------------------------------------
+
+def _generate_gcp_terraform(config: Dict[str, Any]) -> Dict[str, str]:
+    name = config["app_name"]
+    region = config["region"]
+    env = config["environment"]
+    replicas = config["replicas"]
+
+    main_tf = f'''# CUI // SP-CTI
+# Terraform — GCP deployment for {config["app_display_name"]}
+# Provider: Google Cloud ({region})
+# Environment: {env}
+# Generated by Forge Studio
+
+terraform {{
+  required_version = ">= 1.5"
+  required_providers {{
+    google = {{
+      source  = "hashicorp/google"
+      version = "~> 5.0"
+    }}
+  }}
+  backend "gcs" {{
+    bucket = "{name}-terraform-state"
+    prefix = "{env}"
+  }}
+}}
+
+provider "google" {{
+  project = var.project_id
+  region  = var.region
+}}
+
+# ── Cloud SQL PostgreSQL ────────────────────────────────────
+resource "google_sql_database_instance" "main" {{
+  name             = "${{var.app_name}}-${{var.environment}}"
+  database_version = "POSTGRES_15"
+  region           = var.region
+
+  settings {{
+    tier              = var.db_tier
+    availability_type = var.environment == "prod" ? "REGIONAL" : "ZONAL"
+    disk_size         = var.db_disk_gb
+    disk_autoresize   = true
+
+    backup_configuration {{
+      enabled                        = true
+      point_in_time_recovery_enabled = var.environment == "prod"
+      backup_retention_settings {{
+        retained_backups = var.environment == "prod" ? 30 : 7
+      }}
+    }}
+
+    ip_configuration {{
+      ipv4_enabled    = false
+      private_network = google_compute_network.main.id
+    }}
+  }}
+
+  deletion_protection = var.environment == "prod"
+}}
+
+resource "google_sql_database" "app" {{
+  name     = "app"
+  instance = google_sql_database_instance.main.name
+}}
+
+resource "google_sql_user" "admin" {{
+  name     = "supabase_admin"
+  instance = google_sql_database_instance.main.name
+  password = var.db_password
+}}
+
+# ── VPC ─────────────────────────────────────────────────────
+resource "google_compute_network" "main" {{
+  name                    = "${{var.app_name}}-${{var.environment}}"
+  auto_create_subnetworks = false
+}}
+
+resource "google_compute_subnetwork" "main" {{
+  name          = "${{var.app_name}}-${{var.environment}}-subnet"
+  ip_cidr_range = "10.0.0.0/24"
+  region        = var.region
+  network       = google_compute_network.main.id
+}}
+
+resource "google_compute_global_address" "private_ip" {{
+  name          = "${{var.app_name}}-${{var.environment}}-private-ip"
+  purpose       = "VPC_PEERING"
+  address_type  = "INTERNAL"
+  prefix_length = 16
+  network       = google_compute_network.main.id
+}}
+
+resource "google_service_networking_connection" "main" {{
+  network                 = google_compute_network.main.id
+  service                 = "servicenetworking.googleapis.com"
+  reserved_peering_ranges = [google_compute_global_address.private_ip.name]
+}}
+
+# ── Cloud Run ───────────────────────────────────────────────
+resource "google_cloud_run_v2_service" "app" {{
+  name     = "${{var.app_name}}-${{var.environment}}"
+  location = var.region
+
+  template {{
+    scaling {{
+      min_instance_count = var.environment == "prod" ? {replicas} : 0
+      max_instance_count = var.environment == "prod" ? {replicas * 3} : 3
+    }}
+
+    containers {{
+      image = "${{var.artifact_registry}}/${{var.app_name}}:${{var.image_tag}}"
+      ports {{
+        container_port = 3000
+      }}
+      env {{
+        name  = "NODE_ENV"
+        value = var.environment
+      }}
+      env {{
+        name  = "NEXT_PUBLIC_SUPABASE_URL"
+        value = var.supabase_url
+      }}
+      env {{
+        name = "NEXT_PUBLIC_SUPABASE_ANON_KEY"
+        value_source {{
+          secret_key_ref {{
+            secret  = google_secret_manager_secret.supabase_anon_key.secret_id
+            version = "latest"
+          }}
+        }}
+      }}
+      resources {{
+        limits = {{
+          cpu    = var.app_cpu
+          memory = var.app_memory
+        }}
+      }}
+      startup_probe {{
+        http_get {{
+          path = "/"
+          port = 3000
+        }}
+        initial_delay_seconds = 10
+        period_seconds        = 3
+      }}
+    }}
+
+    vpc_access {{
+      connector = google_vpc_access_connector.main.id
+      egress    = "PRIVATE_RANGES_ONLY"
+    }}
+  }}
+}}
+
+resource "google_vpc_access_connector" "main" {{
+  name          = "${{var.app_name}}-${{var.environment}}"
+  region        = var.region
+  ip_cidr_range = "10.8.0.0/28"
+  network       = google_compute_network.main.name
+}}
+
+resource "google_cloud_run_v2_service_iam_member" "public" {{
+  name     = google_cloud_run_v2_service.app.name
+  location = var.region
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+}}
+
+# ── Secret Manager ──────────────────────────────────────────
+resource "google_secret_manager_secret" "supabase_anon_key" {{
+  secret_id = "${{var.app_name}}-${{var.environment}}-supabase-anon-key"
+  replication {{
+    auto {{}}
+  }}
+}}
+
+# ── Cloud Storage ───────────────────────────────────────────
+resource "google_storage_bucket" "assets" {{
+  name          = "${{var.app_name}}-${{var.environment}}-assets"
+  location      = var.region
+  force_destroy = var.environment != "prod"
+
+  uniform_bucket_level_access = true
+
+  versioning {{
+    enabled = var.environment == "prod"
+  }}
+
+  lifecycle_rule {{
+    condition {{
+      age = 90
+    }}
+    action {{
+      type = "Delete"
+    }}
+  }}
+}}
+'''
+
+    variables_tf = f'''# CUI // SP-CTI
+variable "app_name" {{
+  type    = string
+  default = "{name}"
+}}
+variable "project_id" {{
+  type = string
+}}
+variable "environment" {{
+  type    = string
+  default = "{env}"
+}}
+variable "region" {{
+  type    = string
+  default = "{region}"
+}}
+variable "db_password" {{
+  type      = string
+  sensitive = true
+}}
+variable "db_tier" {{
+  type    = string
+  default = "db-f1-micro"
+}}
+variable "db_disk_gb" {{
+  type    = number
+  default = 10
+}}
+variable "app_cpu" {{
+  type    = string
+  default = "1"
+}}
+variable "app_memory" {{
+  type    = string
+  default = "512Mi"
+}}
+variable "artifact_registry" {{
+  type = string
+}}
+variable "image_tag" {{
+  type    = string
+  default = "latest"
+}}
+variable "supabase_url" {{
+  type = string
+}}
+variable "supabase_anon_key" {{
+  type      = string
+  sensitive = true
+}}
+'''
+
+    outputs_tf = f'''# CUI // SP-CTI
+output "app_url" {{
+  value = google_cloud_run_v2_service.app.uri
+}}
+output "db_connection_name" {{
+  value     = google_sql_database_instance.main.connection_name
+  sensitive = true
+}}
+output "storage_bucket" {{
+  value = google_storage_bucket.assets.name
+}}
+'''
+
+    return {
+        "terraform/main.tf": main_tf,
+        "terraform/variables.tf": variables_tf,
+        "terraform/outputs.tf": outputs_tf,
+    }
+
+
+# ---------------------------------------------------------------------------
+# On-Prem (Docker Compose — wraps existing generator)
+# ---------------------------------------------------------------------------
+
+def _generate_onprem_files(config: Dict[str, Any]) -> Dict[str, str]:
+    from tools.forge_studio.eject.docker_compose_generator import (
+        generate_docker_compose, generate_dockerfile, generate_env_file,
+    )
+    return {
+        "docker-compose.yml": generate_docker_compose(config["app_name"]),
+        "Dockerfile": generate_dockerfile(),
+        ".env.template": generate_env_file(),
+    }
+
+
+# ---------------------------------------------------------------------------
+# Environment-specific tfvars
+# ---------------------------------------------------------------------------
+
+def _generate_tfvars(config: Dict[str, Any]) -> str:
+    name = config["app_name"]
+    env = config["environment"]
+    region = config["region"]
+    provider = config["provider"]
+    replicas = config["replicas"]
+
+    if provider == "onprem":
+        return f'# CUI // SP-CTI\n# On-prem deployment — no tfvars needed\n# Environment: {env}\n'
+
+    # Size presets per environment
+    sizes = {
+        "dev":     {"cpu": 256,  "memory": 512,  "db": "small",  "replicas": 1},
+        "staging": {"cpu": 512,  "memory": 1024, "db": "medium", "replicas": 1},
+        "prod":    {"cpu": 1024, "memory": 2048, "db": "large",  "replicas": replicas},
+    }
+    s = sizes.get(env, sizes["prod"])
+
+    if provider == "aws":
+        db_classes = {"small": "db.t4g.micro", "medium": "db.t4g.medium", "large": "db.r6g.large"}
+        return f'''# CUI // SP-CTI
+# AWS {env} environment variables
+app_name    = "{name}"
+environment = "{env}"
+region      = "{region}"
+replicas    = {s["replicas"]}
+app_cpu     = {s["cpu"]}
+app_memory  = {s["memory"]}
+db_instance_class = "{db_classes[s['db']]}"
+db_storage_gb     = {20 if env == "dev" else 50 if env == "staging" else 100}
+db_max_storage_gb = {50 if env == "dev" else 100 if env == "staging" else 500}
+'''
+    elif provider == "azure":
+        db_skus = {"small": "B_Standard_B1ms", "medium": "GP_Standard_D2ds_v4", "large": "GP_Standard_D4ds_v4"}
+        return f'''# CUI // SP-CTI
+# Azure {env} environment variables
+app_name    = "{name}"
+environment = "{env}"
+region      = "{region}"
+app_cpu     = {0.25 if env == "dev" else 0.5 if env == "staging" else 1.0}
+app_memory  = "{"0.5Gi" if env == "dev" else "1Gi" if env == "staging" else "2Gi"}"
+db_sku      = "{db_skus[s['db']]}"
+db_storage_mb = {32768 if env == "dev" else 65536 if env == "staging" else 131072}
+'''
+    elif provider == "gcp":
+        db_tiers = {"small": "db-f1-micro", "medium": "db-custom-2-4096", "large": "db-custom-4-8192"}
+        return f'''# CUI // SP-CTI
+# GCP {env} environment variables
+app_name    = "{name}"
+environment = "{env}"
+region      = "{region}"
+app_cpu     = "{"1" if env == "dev" else "2" if env == "staging" else "4"}"
+app_memory  = "{"512Mi" if env == "dev" else "1Gi" if env == "staging" else "2Gi"}"
+db_tier     = "{db_tiers[s['db']]}"
+db_disk_gb  = {10 if env == "dev" else 25 if env == "staging" else 50}
+'''
+    return ""
+
+
+# ---------------------------------------------------------------------------
+# Kubernetes manifests
+# ---------------------------------------------------------------------------
+
+def _generate_k8s_manifests(config: Dict[str, Any]) -> Dict[str, str]:
+    name = config["app_name"]
+    env = config["environment"]
+    replicas = config["replicas"]
+
+    deployment = f'''# CUI // SP-CTI
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {name}
+  namespace: {name}-{env}
+  labels:
+    app: {name}
+    environment: {env}
+    generator: forge-studio
+spec:
+  replicas: {replicas}
+  selector:
+    matchLabels:
+      app: {name}
+  template:
+    metadata:
+      labels:
+        app: {name}
+        environment: {env}
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        fsGroup: 1001
+      containers:
+        - name: app
+          image: IMAGE_PLACEHOLDER:latest
+          ports:
+            - containerPort: 3000
+              protocol: TCP
+          env:
+            - name: NODE_ENV
+              value: "{env}"
+            - name: NEXT_PUBLIC_SUPABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {name}-secrets
+                  key: supabase-url
+            - name: NEXT_PUBLIC_SUPABASE_ANON_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {name}-secrets
+                  key: supabase-anon-key
+          resources:
+            requests:
+              cpu: "250m"
+              memory: "256Mi"
+            limits:
+              cpu: "1000m"
+              memory: "1Gi"
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+'''
+
+    service = f'''# CUI // SP-CTI
+apiVersion: v1
+kind: Service
+metadata:
+  name: {name}
+  namespace: {name}-{env}
+spec:
+  selector:
+    app: {name}
+  ports:
+    - port: 80
+      targetPort: 3000
+      protocol: TCP
+  type: ClusterIP
+'''
+
+    ingress = f'''# CUI // SP-CTI
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {name}
+  namespace: {name}-{env}
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - {config["domain"]}
+      secretName: {name}-tls
+  rules:
+    - host: {config["domain"]}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {name}
+                port:
+                  number: 80
+'''
+
+    namespace = f'''# CUI // SP-CTI
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {name}-{env}
+  labels:
+    app: {name}
+    environment: {env}
+'''
+
+    network_policy = f'''# CUI // SP-CTI
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {name}-default-deny
+  namespace: {name}-{env}
+spec:
+  podSelector:
+    matchLabels:
+      app: {name}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
+      ports:
+        - port: 3000
+  egress:
+    - to:
+        - namespaceSelector: {{}}
+      ports:
+        - port: 5432
+        - port: 443
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - port: 443
+'''
+
+    return {
+        "k8s/namespace.yaml": namespace,
+        "k8s/deployment.yaml": deployment,
+        "k8s/service.yaml": service,
+        "k8s/ingress.yaml": ingress,
+        "k8s/network-policy.yaml": network_policy,
+    }
+
+
+# ---------------------------------------------------------------------------
+# CI/CD pipeline generation
+# ---------------------------------------------------------------------------
+
+def _generate_cicd_pipeline(config: Dict[str, Any]) -> Dict[str, str]:
+    name = config["app_name"]
+    env = config["environment"]
+    provider = config["provider"]
+
+    # GitHub Actions (universal)
+    gha = f'''# CUI // SP-CTI
+name: Deploy {config["app_display_name"]} ({env})
+
+on:
+  push:
+    branches: [{'"main"' if env == "prod" else f'"deploy/{env}"'}]
+  workflow_dispatch:
+
+env:
+  APP_NAME: {name}
+  ENVIRONMENT: {env}
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run test
+      - run: npm run build
+
+  security-scan:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: "fs"
+          severity: "CRITICAL,HIGH"
+          exit-code: "1"
+
+  build-push:
+    runs-on: ubuntu-latest
+    needs: [test, security-scan]
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+'''
+
+    if provider == "aws":
+        gha += f'''
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{{{ secrets.AWS_ROLE_ARN }}}}
+          aws-region: {config["region"]}
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build and push Docker image
+        env:
+          ECR_REGISTRY: ${{{{ steps.login-ecr.outputs.registry }}}}
+          IMAGE_TAG: ${{{{ github.sha }}}}
+        run: |
+          docker build -t $ECR_REGISTRY/{name}:$IMAGE_TAG .
+          docker push $ECR_REGISTRY/{name}:$IMAGE_TAG
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build-push
+    environment: {env}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: hashicorp/setup-terraform@v3
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{{{ secrets.AWS_ROLE_ARN }}}}
+          aws-region: {config["region"]}
+      - name: Terraform Apply
+        working-directory: terraform
+        run: |
+          terraform init
+          terraform plan -var-file=../envs/{env}.tfvars -var="image_tag=${{{{ github.sha }}}}" -out=tfplan
+          terraform apply tfplan
+'''
+    elif provider == "azure":
+        gha += f'''
+      - name: Login to Azure
+        uses: azure/login@v2
+        with:
+          client-id: ${{{{ secrets.AZURE_CLIENT_ID }}}}
+          tenant-id: ${{{{ secrets.AZURE_TENANT_ID }}}}
+          subscription-id: ${{{{ secrets.AZURE_SUBSCRIPTION_ID }}}}
+
+      - name: Login to ACR
+        uses: azure/docker-login@v2
+        with:
+          login-server: ${{{{ secrets.ACR_LOGIN_SERVER }}}}
+
+      - name: Build and push Docker image
+        run: |
+          docker build -t ${{{{ secrets.ACR_LOGIN_SERVER }}}}/{name}:${{{{ github.sha }}}} .
+          docker push ${{{{ secrets.ACR_LOGIN_SERVER }}}}/{name}:${{{{ github.sha }}}}
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build-push
+    environment: {env}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: hashicorp/setup-terraform@v3
+      - name: Login to Azure
+        uses: azure/login@v2
+        with:
+          client-id: ${{{{ secrets.AZURE_CLIENT_ID }}}}
+          tenant-id: ${{{{ secrets.AZURE_TENANT_ID }}}}
+          subscription-id: ${{{{ secrets.AZURE_SUBSCRIPTION_ID }}}}
+      - name: Terraform Apply
+        working-directory: terraform
+        run: |
+          terraform init
+          terraform plan -var-file=../envs/{env}.tfvars -var="image_tag=${{{{ github.sha }}}}" -out=tfplan
+          terraform apply tfplan
+'''
+    elif provider == "gcp":
+        gha += f'''
+      - name: Authenticate to GCP
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{{{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}}}
+          service_account: ${{{{ secrets.GCP_SERVICE_ACCOUNT }}}}
+
+      - name: Configure Docker for Artifact Registry
+        run: gcloud auth configure-docker {config["region"]}-docker.pkg.dev
+
+      - name: Build and push Docker image
+        run: |
+          docker build -t {config["region"]}-docker.pkg.dev/${{{{ secrets.GCP_PROJECT_ID }}}}/{name}/{name}:${{{{ github.sha }}}} .
+          docker push {config["region"]}-docker.pkg.dev/${{{{ secrets.GCP_PROJECT_ID }}}}/{name}/{name}:${{{{ github.sha }}}}
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build-push
+    environment: {env}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: hashicorp/setup-terraform@v3
+      - name: Authenticate to GCP
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{{{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}}}
+          service_account: ${{{{ secrets.GCP_SERVICE_ACCOUNT }}}}
+      - name: Terraform Apply
+        working-directory: terraform
+        run: |
+          terraform init
+          terraform plan -var-file=../envs/{env}.tfvars -var="image_tag=${{{{ github.sha }}}}" -out=tfplan
+          terraform apply tfplan
+'''
+    elif provider == "onprem":
+        gha += f'''
+      - name: Build Docker image
+        run: docker build -t {name}:${{{{ github.sha }}}} .
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build-push
+    environment: {env}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Deploy via Docker Compose
+        run: |
+          docker compose pull
+          docker compose up -d --build
+'''
+
+    return {
+        f".github/workflows/deploy-{env}.yml": gha,
+    }
+
+
+# ---------------------------------------------------------------------------
+# Deployment record (DB)
+# ---------------------------------------------------------------------------
+
+def _record_deployment(
+    deploy_id: str,
+    app_id: str,
+    config: Dict[str, Any],
+    files_created: List[str],
+    project_id: str,
+):
+    """Record deployment in DB."""
+    from tools.db.storage import get_connection
+
+    now = datetime.now(timezone.utc).isoformat()
+    with get_connection() as conn:
+        conn.execute(
+            "INSERT INTO forge_studio_deployments "
+            "(id, app_id, provider, region, environment, status, config_json, "
+            "files_json, classification, created_at) "
+            "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+            (
+                deploy_id, app_id, config["provider"], config["region"],
+                config["environment"], "generated",
+                json.dumps(config), json.dumps(files_created),
+                "CUI // SP-CTI", now,
+            ),
+        )
+
+
+DEPLOY_SCHEMA = """
+CREATE TABLE IF NOT EXISTS forge_studio_deployments (
+    id TEXT PRIMARY KEY,
+    app_id TEXT,
+    provider TEXT NOT NULL,
+    region TEXT,
+    environment TEXT NOT NULL DEFAULT 'dev',
+    status TEXT DEFAULT 'generated'
+        CHECK(status IN ('generated','deploying','deployed','failed','rolled_back')),
+    config_json TEXT,
+    files_json TEXT,
+    output_url TEXT,
+    classification TEXT DEFAULT 'CUI // SP-CTI',
+    created_at TEXT NOT NULL,
+    deployed_at TEXT
+);
+"""
+
+
+def ensure_deploy_tables():
+    """Create deployment tables if they don't exist."""
+    from tools.db.storage import get_connection
+
+    with get_connection() as conn:
+        for stmt in DEPLOY_SCHEMA.split(";"):
+            s = stmt.strip()
+            if s and not s.startswith("--"):
+                conn.execute(s)
+    logger.info("Forge Studio deployment tables ensured")
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+def _write_file(base: Path, filepath: str, content: str, tracker: List[str]):
+    full_path = base / filepath
+    full_path.parent.mkdir(parents=True, exist_ok=True)
+    full_path.write_text(content, encoding="utf-8")
+    tracker.append(filepath)
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+
+def main():
+    import argparse
+    import sys
+
+    parser = argparse.ArgumentParser(description="Forge Studio Multi-Cloud Deploy Engine")
+    parser.add_argument("--generate", action="store_true", help="Generate deployment artifacts")
+    parser.add_argument("--providers", action="store_true", help="List available providers")
+    parser.add_argument("--deployments", type=str, help="List deployments for app ID")
+    parser.add_argument("--app-id", type=str, default="", help="App ID")
+    parser.add_argument("--app-name", type=str, default="forge-app", help="App name")
+    parser.add_argument("--provider", type=str, default="aws", help="Cloud provider")
+    parser.add_argument("--region", type=str, default="", help="Cloud region")
+    parser.add_argument("--env", type=str, default="prod", help="Environment")
+    parser.add_argument("--output-dir", type=str, default="", help="Output directory")
+    parser.add_argument("--domain", type=str, default="", help="Custom domain")
+    parser.add_argument("--replicas", type=int, default=2, help="App replicas")
+    parser.add_argument("--k8s", action="store_true", help="Generate K8s manifests")
+    parser.add_argument("--no-cicd", action="store_true", help="Skip CI/CD generation")
+    parser.add_argument("--project-id", type=str, default="", help="Project ID")
+    parser.add_argument("--json", action="store_true", help="JSON output")
+    args = parser.parse_args()
+
+    ensure_deploy_tables()
+
+    if args.providers:
+        result = list_providers()
+    elif args.deployments:
+        result = get_deployments(args.deployments)
+    elif args.generate:
+        result = generate_deployment(
+            app_id=args.app_id,
+            app_name=args.app_name,
+            provider=args.provider,
+            region=args.region,
+            environment=args.env,
+            output_dir=args.output_dir,
+            project_id=args.project_id,
+            enable_k8s=args.k8s,
+            enable_cicd=not args.no_cicd,
+            domain=args.domain,
+            replicas=args.replicas,
+        )
+    else:
+        parser.print_help()
+        sys.exit(0)
+
+    print(json.dumps(result, indent=2, default=str))
+
+
+if __name__ == "__main__":
+    main()