tsdevstack
Medium

v0.2.0

Released: April 4, 2026

Object Storage

Add cloud storage buckets to your project with a single command. Supports S3 (AWS), Cloud Storage (GCP), and Blob Storage (Azure).

  • npx tsdevstack add-bucket-storage --name avatars to add a bucket
  • npx tsdevstack remove-bucket-storage --name avatars to remove
  • Presigned URLs for secure uploads/downloads (no public bucket access)
  • Shared bucket access — all backend services can use all buckets via StorageModule
  • Automatic secret injection (STORAGE_BUCKET_AVATARS environment variable)
  • MinIO for local development (S3-compatible, console at localhost:9001)
  • getNativeClient() escape hatch for provider-specific features
  • Data safety defaults: versioning (AWS/GCP) and soft delete (Azure) enabled out of the box

See Object Storage for setup and usage.

Async Messaging

Publish/subscribe messaging between services using Redis Streams. No additional cloud resources — runs on the same Redis instance used for caching and BullMQ.

  • npx tsdevstack add-messaging-topic to add a topic with publishers and subscribers
  • npx tsdevstack remove-messaging-topic to remove
  • @OnMessage('user-registered') decorator for handlers
  • Consumer groups with automatic offset tracking
  • Dead letter handling and retry logic (configurable max retries, default 3)
  • update-messaging-topic uses replace semantics — pass the full publisher/subscriber list, not additions

See Async Messaging for setup and usage.

AWS: App Runner replaced with ECS Fargate

Breaking change for existing AWS deployments. Next.js frontends now run on ECS Fargate behind the shared ALB instead of AWS App Runner.

Why: AWS announced App Runner will stop accepting new customers on April 30, 2026.

What changed:

  • Next.js services run as ECS Fargate tasks in private VPC subnets
  • ALB host-based routing on port 443 differentiates frontend and API traffic
  • Shared CloudFront WAF (removed the separate App Runner Regional WAF)
  • Single-phase deployment (no more two-phase CloudFront creation)
  • Lower cost (~$8-12/month vs ~$7-15/month for App Runner)

Migration for existing users:

Update tsdevstack, then redeploy:

npx tsdevstack infra:deploy --env <env>

Terraform will remove App Runner resources and create ECS services. Brief downtime on the Next.js frontend during the switch. No changes needed to infrastructure.json or application code.

Requirements:

  • Next.js apps must expose a /health route returning HTTP 200 (included in the framework template by default)

See AWS Architecture for the updated architecture.

WAF & observability improvements

  • Access logging added across all providers: ALB + CloudFront logs on AWS, backend service log_config on GCP, Front Door diagnostic settings on Azure
  • GCP file upload fix — Cloud Armor protocolattack-v33-stable false-positives on multipart/form-data boundaries fixed (rules 921120/921150 opted out)
  • AWS file upload fix — SizeRestrictions_BODY overridden to count mode; custom body-inspecting rules updated with oversize_handling = "CONTINUE". Upload size limits are enforced by Kong via maxUploadSize in infrastructure.json
  • Configurable rate limiting — set security.waf.rateLimit in infrastructure.json to override the default (1000 requests/60s). Applied consistently across all providers
  • Azure custom WAF rules — azureCustomRules in infrastructure.json for provider-specific match conditions
  • WAF JSON schema is now provider-aware: GCP shows CEL rules, AWS shows byte match/geo/rate rules, Azure shows match conditions

See WAF Customization for configuration options.

Worker scaling parity

All three providers now read minInstances, maxInstances, cpu, and memory from infrastructure.json for workers. Previously GCP and AWS used hardcoded defaults. Database connection pool sizing now uses actual configured max instances instead of a hardcoded value of 3.

Template versioning

Template repos are now git-tagged with the CLI version on each release. add-service clones the tag matching your installed CLI version instead of always pulling latest main. Falls back to main with a warning if the tag doesn't exist.

AWS: Worker entrypoint fix

Fixed detached workers running the API server instead of the worker entrypoint. The ECS task definition now correctly sets command = ["dumb-init", "node", "dist/worker.js"] for worker services.