@rulebricks/cli 2.1.7 → 2.3.1

package/dist/types/index.js

@@ -6,22 +6,10 @@ export const SUPPORTED_DNS_PROVIDERS = [
     "google",
     "azure",
 ];
-// Sink category mappings
-export const LOGGING_SINK_CATEGORIES = {
-    s3: "cloud-storage",
-    "azure-blob": "cloud-storage",
-    gcs: "cloud-storage",
-    datadog: "logging-platform",
-    splunk: "logging-platform",
-    elasticsearch: "logging-platform",
-    loki: "logging-platform",
-    newrelic: "logging-platform",
-    axiom: "logging-platform",
-};
 // Region mappings
 export const CLOUD_REGIONS = {
     aws: [
-        // US regions (c8g Graviton4 available)
+        // US regions
         "us-east-1",
         "us-east-2",
         "us-west-1",
@@ -29,7 +17,7 @@ export const CLOUD_REGIONS = {
         // Canada
         "ca-central-1",
         "ca-west-1",
-        // Europe (c8g available)
+        // Europe
         "eu-west-1",
         "eu-west-2",
         "eu-west-3",
@@ -38,7 +26,7 @@ export const CLOUD_REGIONS = {
         "eu-north-1",
         "eu-south-1",
         "eu-south-2",
-        // Asia Pacific (c8g available)
+        // Asia Pacific
         "ap-northeast-1",
         "ap-northeast-2",
         "ap-northeast-3",
@@ -60,31 +48,30 @@ export const CLOUD_REGIONS = {
         "il-central-1",
     ],
     gcp: [
-        // Tier 1: Full C4A (Google Axion ARM64) availability - 3+ zones confirmed
         // US regions
-        "us-central1", // C4A in zones a, b, c, f (best availability)
-        "us-east1", // C4A in zones b, c, d
-        "us-east4", // C4A in zones a, b, c
-        "us-west1", // C4A in zones a, b, c
-        "us-west4", // C4A in zones a, b, c
+        "us-central1",
+        "us-east1",
+        "us-east4",
+        "us-west1",
+        "us-west4",
         // North America
-        "northamerica-south1", // C4A in zones a, b, c (Mexico)
+        "northamerica-south1",
         // Europe
-        "europe-west1", // C4A in zones b, c, d
-        "europe-west2", // C4A in zones a, b, c
-        "europe-west3", // C4A in zones a, b, c
-        "europe-west4", // C4A in zones a, b, c
-        "europe-north1", // C4A in zones a, b
+        "europe-west1",
+        "europe-west2",
+        "europe-west3",
+        "europe-west4",
+        "europe-north1",
         // Asia Pacific
-        "asia-east1", // C4A in zones a, b, c
-        "asia-northeast1", // C4A in zones b, c
-        "asia-south1", // C4A in zones a, b, c
-        "asia-southeast1", // C4A in zones a, b, c
+        "asia-east1",
+        "asia-northeast1",
+        "asia-south1",
+        "asia-southeast1",
         // Australia
-        "australia-southeast2", // C4A in zones a, b, c
+        "australia-southeast2",
     ],
     azure: [
-        // US regions (Dpsv5 ARM64 available)
+        // US regions
         "eastus",
         "eastus2",
         "westus",
@@ -99,7 +86,7 @@ export const CLOUD_REGIONS = {
         "canadaeast",
         // South America
         "brazilsouth",
-        // Europe (Dpsv5 available)
+        // Europe
         "northeurope",
         "westeurope",
         "uksouth",
@@ -137,156 +124,6 @@ export const CLOUD_REGIONS = {
         "israelcentral",
     ],
 };
-// Performance tier configurations
-export const TIER_CONFIGS = {
-    small: {
-        description: "Development & Testing",
-        throughput: "<1,000 rules/sec",
-        nodes: { min: 4, max: 4 },
-        resources: "2 vCPU, 4GB RAM each",
-        // HPS
-        hpsReplicas: 2,
-        hpsWorkerReplicas: { min: 4, max: 8 },
-        hpsResources: {
-            requests: { cpu: "500m", memory: "1Gi" },
-            limits: { cpu: "1500m", memory: "1536Mi" },
-        },
-        hpsWorkerResources: {
-            requests: { cpu: "100m", memory: "128Mi" },
-            limits: { cpu: "500m", memory: "512Mi" },
-        },
-        // Kafka
-        kafkaStorage: "10Gi",
-        kafkaReplication: 1,
-        kafkaResources: {
-            requests: { cpu: "500m", memory: "2Gi" },
-            limits: { cpu: "2000m", memory: "3Gi" },
-        },
-        kafkaHeapOpts: "-Xmx1g -Xms1g -XX:+UseZGC -XX:+AlwaysPreTouch",
-        // Redis
-        redisResources: {
-            requests: { cpu: "200m", memory: "256Mi" },
-            limits: { cpu: "500m", memory: "2Gi" },
-        },
-        redisPersistenceSize: "4Gi",
-        // Vector
-        vectorReplicas: 2,
-        vectorResources: {
-            requests: { cpu: "50m", memory: "128Mi" },
-            limits: { cpu: "200m", memory: "256Mi" },
-        },
-        // Database
-        dbResources: {
-            requests: { cpu: "500m", memory: "1Gi" },
-            limits: { cpu: "1000m", memory: "2Gi" },
-        },
-        dbPersistenceSize: "10Gi",
-        // App
-        appReplicas: 2,
-        appResources: {
-            requests: { cpu: "500m", memory: "512Mi" },
-            limits: { cpu: "2000m", memory: "2Gi" },
-        },
-    },
-    medium: {
-        description: "Production",
-        throughput: "1,000-10,000 rules/sec",
-        nodes: { min: 4, max: 8 },
-        resources: "2-4 vCPU, 4-8GB RAM each",
-        // HPS
-        hpsReplicas: 3,
-        hpsWorkerReplicas: { min: 10, max: 24 },
-        hpsResources: {
-            requests: { cpu: "1000m", memory: "1Gi" },
-            limits: { cpu: "4000m", memory: "4Gi" },
-        },
-        hpsWorkerResources: {
-            requests: { cpu: "500m", memory: "512Mi" },
-            limits: { cpu: "2000m", memory: "2Gi" },
-        },
-        // Kafka
-        kafkaStorage: "50Gi",
-        kafkaReplication: 2,
-        kafkaResources: {
-            requests: { cpu: "1000m", memory: "3Gi" },
-            limits: { cpu: "2000m", memory: "4Gi" },
-        },
-        kafkaHeapOpts: "-Xmx2g -Xms2g -XX:+UseZGC -XX:+AlwaysPreTouch",
-        // Redis
-        redisResources: {
-            requests: { cpu: "200m", memory: "512Mi" },
-            limits: { cpu: "1000m", memory: "4Gi" },
-        },
-        redisPersistenceSize: "8Gi",
-        // Vector
-        vectorReplicas: 2,
-        vectorResources: {
-            requests: { cpu: "100m", memory: "256Mi" },
-            limits: { cpu: "500m", memory: "512Mi" },
-        },
-        // Database
-        dbResources: {
-            requests: { cpu: "1000m", memory: "2Gi" },
-            limits: { cpu: "2000m", memory: "4Gi" },
-        },
-        dbPersistenceSize: "50Gi",
-        // App
-        appReplicas: 2,
-        appResources: {
-            requests: { cpu: "500m", memory: "512Mi" },
-            limits: { cpu: "2000m", memory: "2Gi" },
-        },
-    },
-    large: {
-        description: "High Performance",
-        throughput: ">10,000 rules/sec",
-        nodes: { min: 5, max: 16 },
-        resources: "2-4 vCPU, 4-8GB RAM each",
-        // HPS
-        hpsReplicas: 4,
-        hpsWorkerReplicas: { min: 10, max: 48 },
-        hpsResources: {
-            requests: { cpu: "2000m", memory: "2Gi" },
-            limits: { cpu: "4000m", memory: "4Gi" },
-        },
-        hpsWorkerResources: {
-            requests: { cpu: "1000m", memory: "1Gi" },
-            limits: { cpu: "2000m", memory: "2Gi" },
-        },
-        // Kafka
-        kafkaStorage: "100Gi",
-        kafkaReplication: 3,
-        kafkaResources: {
-            requests: { cpu: "2000m", memory: "4Gi" },
-            limits: { cpu: "4000m", memory: "6Gi" },
-        },
-        kafkaHeapOpts: "-Xmx3g -Xms3g -XX:+UseZGC -XX:+AlwaysPreTouch",
-        // Redis
-        redisResources: {
-            requests: { cpu: "500m", memory: "1Gi" },
-            limits: { cpu: "2000m", memory: "8Gi" },
-        },
-        redisPersistenceSize: "16Gi",
-        // Vector
-        vectorReplicas: 3,
-        vectorResources: {
-            requests: { cpu: "200m", memory: "512Mi" },
-            limits: { cpu: "1000m", memory: "1Gi" },
-        },
-        // Database
-        dbResources: {
-            requests: { cpu: "2000m", memory: "4Gi" },
-            limits: { cpu: "4000m", memory: "8Gi" },
-        },
-        dbPersistenceSize: "100Gi",
-        // App
-        appReplicas: 3,
-        appResources: {
-            requests: { cpu: "1000m", memory: "1Gi" },
-            limits: { cpu: "2000m", memory: "2Gi" },
-        },
-    },
-};
 // Default SMTP providers
 export const SMTP_PROVIDERS = {
     "aws-ses": {
@@ -315,6 +152,13 @@ export const DNS_PROVIDER_NAMES = {
     azure: "Azure DNS",
     other: "Other / Not sure",
 };
+// Cloud provider display names with proper casing for UI labels. Acronyms stay
+// uppercase; Azure is title-cased (so it doesn't render as "AZURE").
+export const CLOUD_PROVIDER_NAMES = {
+    aws: "AWS",
+    gcp: "GCP",
+    azure: "Azure",
+};
 // Logging sink display info
 export const LOGGING_SINK_INFO = {
     console: {
@@ -325,19 +169,6 @@ export const LOGGING_SINK_INFO = {
         name: "External (not configured)",
         description: "External logging enabled but destination not selected",
     },
-    // Cloud Storage
-    s3: {
-        name: "AWS S3",
-        description: "Store logs in an S3 bucket",
-    },
-    "azure-blob": {
-        name: "Azure Blob Storage",
-        description: "Store logs in Azure Blob container",
-    },
-    gcs: {
-        name: "Google Cloud Storage",
-        description: "Store logs in a GCS bucket",
-    },
     // Logging Platforms
     datadog: {
         name: "Datadog",
@@ -364,30 +195,81 @@ export const LOGGING_SINK_INFO = {
         description: "Send logs to Axiom dataset",
     },
 };
-// Logging destination labels for UI display (shown in the Rulebricks app)
-export const LOGGING_DESTINATION_LABELS = {
-    console: "Console (stdout)",
-    pending: "External (configuring...)",
-    s3: "AWS S3",
-    "azure-blob": "Azure Blob Storage",
-    gcs: "Google Cloud Storage",
-    datadog: "Datadog",
-    splunk: "Splunk",
-    elasticsearch: "Elasticsearch",
-    loki: "Grafana Loki",
-    newrelic: "New Relic",
-    axiom: "Axiom",
-};
-// Helper to get logging destination label for Helm values
-export function getLoggingDestinationLabel(sink) {
-    return LOGGING_DESTINATION_LABELS[sink] || "Console (stdout)";
-}
 const SecretKeyRefSchema = z.object({
     name: z.string().min(1),
     key: z.string().min(1),
 });
-const RemoteWriteConfigSchema = z.object({
-    destination: z.enum(["aws-amp", "azure-monitor", "grafana-cloud", "generic"]),
+/**
+ * Validates a Prometheus remote_write config the same way buildHelmValues and
+ * the Helm chart do, returning human-readable errors. Centralized so the wizard
+ * gate, the Zod schema (load time), and Helm value generation all enforce the
+ * exact same per-destination/auth requirements. This is what prevents the CLI
+ * from ever persisting a monitoring config that throws at deploy time (e.g.
+ * "Azure Monitor remote_write managed identity requires client ID").
+ */
+export function validateRemoteWriteConfig(rw) {
+    const errors = [];
+    switch (rw.destination) {
+        case "aws-amp":
+            if (!rw.awsRegion) {
+                errors.push("AWS Managed Prometheus remote write requires a region.");
+            }
+            break;
+        case "azure-monitor": {
+            // The remote_write URL must be the full DCE metrics-ingestion path, not the
+            // bare DCE host. Azure Monitor expects:
+            //   https://<dce>.<region>.metrics.ingest.monitor.azure.com/dataCollectionRules/<dcrImmutableId>/streams/Microsoft-PrometheusMetrics/api/v1/write?api-version=2023-04-24
+            // A bare host silently 404s, so catch the common copy-paste mistake here.
+            if (rw.url &&
+                !(rw.url.includes("/dataCollectionRules/") &&
+                    rw.url.includes("/streams/") &&
+                    rw.url.includes("/api/v1/write"))) {
+                errors.push("Azure Monitor remote write URL must be the full DCE metrics-ingestion path " +
+                    "(https://<dce>.<region>.metrics.ingest.monitor.azure.com/dataCollectionRules/<dcrImmutableId>/streams/Microsoft-PrometheusMetrics/api/v1/write?api-version=2023-04-24), " +
+                    "not just the data collection endpoint host.");
+            }
+            // An unset authType is treated as managed identity (the chart default).
+            const authType = rw.authType ?? "managed-identity";
+            if (authType === "oauth") {
+                if (!rw.clientId || !rw.tenantId || !rw.clientSecretRef) {
+                    errors.push("Azure Monitor remote write (OAuth) requires a client ID, tenant ID, and client secret reference.");
+                }
+            }
+            else if (authType === "workload-identity") {
+                if (!rw.clientId || !rw.tenantId) {
+                    errors.push("Azure Monitor remote write (workload identity) requires a client ID and tenant ID.");
+                }
+            }
+            else if (!rw.clientId) {
+                errors.push("Azure Monitor remote write (managed identity) requires a client ID.");
+            }
+            break;
+        }
+        case "grafana-cloud":
+            if (!rw.usernameSecretRef || !rw.passwordSecretRef) {
+                errors.push("Grafana Cloud remote write requires username and password secret references.");
+            }
+            break;
+        case "generic":
+            if (rw.authType === "basic" &&
+                (!rw.usernameSecretRef || !rw.passwordSecretRef)) {
+                errors.push("Basic-auth remote write requires username and password secret references.");
+            }
+            if (rw.authType === "bearer" && !rw.bearerTokenSecretRef) {
+                errors.push("Bearer-token remote write requires a token secret reference.");
+            }
+            break;
+    }
+    return errors;
+}
+const RemoteWriteConfigSchema = z
+    .object({
+    destination: z.enum([
+        "aws-amp",
+        "azure-monitor",
+        "grafana-cloud",
+        "generic",
+    ]),
     url: z.string().url(),
     authType: z
         .enum([
@@ -410,6 +292,11 @@ const RemoteWriteConfigSchema = z.object({
     usernameSecretRef: SecretKeyRefSchema.optional(),
     passwordSecretRef: SecretKeyRefSchema.optional(),
     bearerTokenSecretRef: SecretKeyRefSchema.optional(),
+})
+    .superRefine((rw, ctx) => {
+    for (const message of validateRemoteWriteConfig(rw)) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message });
+    }
 });
 const MonitoringDestinationSchema = z.enum([
     "local-grafana",
@@ -418,6 +305,210 @@ const MonitoringDestinationSchema = z.enum([
     "grafana-cloud",
     "generic",
 ]);
+const TracingConfigSchema = z
+    .object({
+    enabled: z.boolean(),
+    // Absent means "elastic" for backward compatibility with existing configs.
+    destination: z.enum(["elastic", "otlp", "azure-monitor"]).optional(),
+    samplingRatio: z.number().min(0).max(1).optional(),
+    elastic: z
+        .object({
+        endpoint: z.string().url().optional(),
+        authMode: z.enum(["secret-token", "api-key", "none"]).optional(),
+        secretToken: z.string().optional(),
+        apiKey: z.string().optional(),
+    })
+        .optional(),
+    // Generic OTLP/HTTP backend (Grafana Tempo, Honeycomb, Jaeger, vendor
+    // gateways, AWS/Azure OTLP ingestion, etc.).
+    otlp: z
+        .object({
+        endpoint: z.string().url().optional(),
+        authMode: z.enum(["none", "bearer", "api-key", "header"]).optional(),
+        headerName: z.string().optional(),
+        token: z.string().optional(),
+        apiKey: z.string().optional(),
+        headerValue: z.string().optional(),
+        headers: z.record(z.string()).optional(),
+        tlsInsecureSkipVerify: z.boolean().optional(),
+    })
+        .optional(),
+    // Azure Monitor / Application Insights.
+    azureMonitor: z
+        .object({
+        connectionString: z.string().optional(),
+    })
+        .optional(),
+})
+    .superRefine((t, ctx) => {
+    if (!t.enabled)
+        return;
+    const destination = t.destination ?? "elastic";
+    if (destination === "elastic") {
+        if (!t.elastic?.endpoint) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "features.tracing.elastic.endpoint is required when tracing destination is 'elastic'",
+                path: ["elastic", "endpoint"],
+            });
+        }
+        const mode = t.elastic?.authMode ?? "secret-token";
+        if (mode === "secret-token" && !t.elastic?.secretToken) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "features.tracing.elastic.secretToken is required for authMode 'secret-token'",
+                path: ["elastic", "secretToken"],
+            });
+        }
+        if (mode === "api-key" && !t.elastic?.apiKey) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "features.tracing.elastic.apiKey is required for authMode 'api-key'",
+                path: ["elastic", "apiKey"],
+            });
+        }
+    }
+    else if (destination === "otlp") {
+        if (!t.otlp?.endpoint) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "features.tracing.otlp.endpoint is required when tracing destination is 'otlp'",
+                path: ["otlp", "endpoint"],
+            });
+        }
+        const mode = t.otlp?.authMode ?? "none";
+        if (mode === "bearer" && !t.otlp?.token) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "features.tracing.otlp.token is required for authMode 'bearer'",
+                path: ["otlp", "token"],
+            });
+        }
+        if (mode === "api-key" && !t.otlp?.apiKey) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "features.tracing.otlp.apiKey is required for authMode 'api-key'",
+                path: ["otlp", "apiKey"],
+            });
+        }
+        if (mode === "header" && !t.otlp?.headerValue) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "features.tracing.otlp.headerValue is required for authMode 'header'",
+                path: ["otlp", "headerValue"],
+            });
+        }
+    }
+    else if (destination === "azure-monitor") {
+        if (!t.azureMonitor?.connectionString) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "features.tracing.azureMonitor.connectionString is required when tracing destination is 'azure-monitor'",
+                path: ["azureMonitor", "connectionString"],
+            });
+        }
+    }
+});
+// Application/container log shipping to a customer-managed Elasticsearch (BYO)
+// via the Vector agent DaemonSet. Distinct from decision-log sinks.
+const AppLogsConfigSchema = z
+    .object({
+    enabled: z.boolean(),
+    destination: z.enum(["elasticsearch", "loki", "generic"]).optional(),
+    elasticsearch: z
+        .object({
+        endpoint: z.string().url().optional(),
+        index: z.string().optional(),
+        authMode: z.enum(["basic", "api-key", "none"]).optional(),
+        username: z.string().optional(),
+        password: z.string().optional(),
+        apiKey: z.string().optional(),
+        verifyCertificate: z.boolean().optional(),
+    })
+        .optional(),
+    loki: z
+        .object({
+        endpoint: z.string().url().optional(),
+        labels: z.record(z.string()).optional(),
+    })
+        .optional(),
+    generic: z
+        .object({
+        endpoint: z.string().url().optional(),
+        authHeader: z.string().optional(),
+    })
+        .optional(),
+})
+    .superRefine((a, ctx) => {
+    if (!a.enabled)
+        return;
+    const destination = a.destination ?? "elasticsearch";
+    if (destination === "loki") {
+        if (!a.loki?.endpoint) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "features.logging.appLogs.loki.endpoint is required when appLogs destination is 'loki'",
+                path: ["loki", "endpoint"],
+            });
+        }
+        return;
+    }
+    if (destination === "generic") {
+        if (!a.generic?.endpoint) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "features.logging.appLogs.generic.endpoint is required when appLogs destination is 'generic'",
+                path: ["generic", "endpoint"],
+            });
+        }
+        return;
+    }
+    if (!a.elasticsearch?.endpoint) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "features.logging.appLogs.elasticsearch.endpoint is required when appLogs is enabled",
+            path: ["elasticsearch", "endpoint"],
+        });
+    }
+    const mode = a.elasticsearch?.authMode ?? "basic";
+    if (mode === "basic" &&
+        (!a.elasticsearch?.username || !a.elasticsearch?.password)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "features.logging.appLogs.elasticsearch username and password are required for authMode 'basic'",
+            path: ["elasticsearch", "username"],
+        });
+    }
+    if (mode === "api-key" && !a.elasticsearch?.apiKey) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "features.logging.appLogs.elasticsearch.apiKey is required for authMode 'api-key'",
+            path: ["elasticsearch", "apiKey"],
+        });
+    }
+});
+const CacheObservabilityConfigSchema = z.object({
+    valkeyAdmin: z
+        .object({
+        enabled: z.boolean(),
+        exposure: z.enum(["internal", "ingress"]).optional(),
+        hostname: z.string().optional(),
+        basicAuthUsers: z.array(z.string()).optional(),
+        basicAuthExistingSecret: z.string().optional(),
+        allowedIPs: z.array(z.string()).optional(),
+    })
+        .optional(),
+    redisExporter: z
+        .object({
+        enabled: z.boolean(),
+    })
+        .optional(),
+    kafkaExporter: z
+        .object({
+        enabled: z.boolean(),
+    })
+        .optional(),
+});
 // Deployment configuration schema
 export const DeploymentConfigSchema = z.object({
     name: z
@@ -427,12 +518,24 @@ export const DeploymentConfigSchema = z.object({
         .regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/),
     // Infrastructure
     infrastructure: z.object({
-        mode: z.enum(["existing", "provision"]),
+        mode: z.literal("existing"),
         provider: z.enum(["aws", "gcp", "azure"]).optional(),
         region: z.string().optional(),
         clusterName: z.string().optional(),
         gcpProjectId: z.string().optional(),
         azureResourceGroup: z.string().optional(),
+        nodeArchitecture: z
+            .enum(["amd64", "arm64", "mixed", "unknown"])
+            .optional(),
+        arm64TolerationRequired: z.boolean().optional(),
+        storageClass: z.string().optional(),
+        storageProvisioner: z.string().optional(),
+        schedulableNodeCount: z.number().optional(),
+        totalCpuCores: z.number().optional(),
+        totalMemoryGi: z.number().optional(),
+        eligibleCpuCores: z.number().optional(),
+        eligibleMemoryGi: z.number().optional(),
+        totalPersistentStorageGi: z.number().optional(),
     }),
     // Domain & TLS
     domain: z.string().min(1),
@@ -444,8 +547,6 @@ export const DeploymentConfigSchema = z.object({
         provider: z.enum(["route53", "cloudflare", "google", "azure", "other"]),
         // Should we auto-manage DNS records? (only applicable for supported providers)
         autoManage: z.boolean(),
-        // For existing clusters: does external-dns already exist cluster-wide?
-        existingExternalDns: z.boolean().optional(),
     }),
     // SMTP Configuration
     smtp: z.object({
@@ -471,8 +572,153 @@ export const DeploymentConfigSchema = z.object({
         supabaseDashboardUser: z.string().optional(),
         supabaseDashboardPass: z.string().optional(),
     }),
-    // Performance
-    tier: z.enum(["small", "medium", "large"]),
+    // Shared object storage: one provider, one identity, one bucket/container.
+    // Decision logs and DB backups are just key prefixes within it.
+    storage: z
+        .object({
+        provider: z.enum(["s3", "azure-blob", "gcs"]),
+        cloudAuthMode: z.enum(["workload-identity", "secret"]).optional(),
+        // Single bucket (S3/GCS) or storage account (azure-blob) + its region.
+        bucket: z.string().min(1),
+        region: z.string().min(1),
+        awsIamRoleArn: z.string().optional(),
+        azureBlobClientId: z.string().optional(),
+        azureBlobTenantId: z.string().optional(),
+        azureBlobConnectionStringSecretRef: SecretKeyRefSchema.optional(),
+        // Single blob container (azure-blob only) holding all prefixes.
+        azureBlobContainer: z.string().optional(),
+        gcpServiceAccountEmail: z.string().optional(),
+        // Per-purpose key prefixes within the single bucket/container.
+        paths: z
+            .object({
+            decisionLogs: z.string().optional(),
+            dbBackups: z.string().optional(),
+        })
+            .optional(),
+    })
+        .optional(),
+    // External/managed Redis and Kafka (for large deployments that prefer managed
+    // services over the in-cluster defaults). Omitted/embedded means the chart
+    // deploys these in-cluster as usual.
+    externalServices: z
+        .object({
+        redis: z
+            .object({
+            mode: z.enum(["embedded", "external"]),
+            external: z
+                .object({
+                host: z.string().optional(),
+                port: z.number().int().min(1).max(65535).optional(),
+                password: z.string().optional(),
+                existingSecret: z.string().optional(),
+                existingSecretKey: z.string().optional(),
+                tls: z.boolean().optional(),
+                httpApi: z
+                    .object({
+                    enabled: z.boolean(),
+                    url: z.string().optional(),
+                    token: z.string().optional(),
+                })
+                    .optional(),
+            })
+                .optional(),
+        })
+            .optional(),
+        kafka: z
+            .object({
+            mode: z.enum(["embedded", "external"]),
+            external: z
+                .object({
+                // Preset drives per-cloud auth defaults and whether the Vector
+                // bridge sidecar is required.
+                preset: z
+                    .enum([
+                    "aws-msk-iam",
+                    "azure-event-hubs",
+                    "gcp-managed",
+                    "custom",
+                ])
+                    .optional(),
+                brokers: z.string().optional(),
+                topic: z.string().optional(),
+                // Prefix namespacing all Kafka topics (e.g. "com.rulebricks.").
+                topicPrefix: z.string().optional(),
+                // Whether the chart creates the required topics on the managed
+                // broker (via the kafka-topic-provision Job, MSK IAM only). Set
+                // false for a locked-down broker where topics are managed out of
+                // band and the workload role has no CreateTopic. Default true.
+                provisionTopics: z.boolean().optional(),
+                ssl: z.boolean().optional(),
+                sasl: z
+                    .object({
+                    // "" means no SASL (plaintext/SSL-only).
+                    mechanism: z.enum([
+                        "",
+                        "aws-iam",
+                        "oauthbearer",
+                        "scram-sha-256",
+                        "scram-sha-512",
+                        "plain",
+                    ]),
+                    region: z.string().optional(),
+                    username: z.string().optional(),
+                    password: z.string().optional(),
+                    existingSecret: z.string().optional(),
+                })
+                    .optional(),
+                // Cloud workload identity for token mechanisms (MSK IAM / GCP
+                // OAUTHBEARER). Applied to the HPS and Vector service accounts.
+                identity: z
+                    .object({
+                    awsRoleArn: z.string().optional(),
+                    gcpServiceAccountEmail: z.string().optional(),
+                    azureClientId: z.string().optional(),
+                })
+                    .optional(),
+            })
+                .optional(),
+        })
+            .optional(),
+        // Managed external PostgreSQL (AWS RDS/Aurora or Azure Flexible Server).
+        // Self-hosted Supabase runs against this instead of the bundled in-cluster
+        // database. Maps to the chart's supabase.externalDatabase.* values.
+        postgres: z
+            .object({
+            mode: z.enum(["embedded", "external"]),
+            external: z
+                .object({
+                // Managed provider this database lives on (gates CLI prompts; only
+                // aws/azure are supported for the structured/managed flow).
+                provider: z.enum(["aws", "azure"]).optional(),
+                host: z.string().optional(),
+                port: z.number().int().min(1).max(65535).optional(),
+                database: z.string().optional(),
+                // One-time master/owner credentials the chart's pre-install hook
+                // uses to initialize the database (roles, schemas, auth helpers,
+                // publication). Inline creds are materialized into a hook-scoped
+                // secret; secretRef points at a pre-created secret instead.
+                bootstrap: z
+                    .object({
+                    enabled: z.boolean().optional(),
+                    masterUsername: z.string().optional(),
+                    masterPassword: z.string().optional(),
+                    secretRef: z.string().optional(),
+                    appRole: z.string().optional(),
+                })
+                    .optional(),
+            })
+                .optional(),
+        })
+            .optional(),
+    })
+        .optional(),
+    backup: z
+        .object({
+        enabled: z.boolean(),
+        schedule: z.string().min(1),
+        retentionDays: z.number().int().min(1),
+    })
+        .optional(),
     // Optional features
     features: z.object({
         ai: z.object({
@@ -495,15 +741,27 @@ export const DeploymentConfigSchema = z.object({
             remoteWriteUrl: z.string().url().optional(),
             remoteWrite: RemoteWriteConfigSchema.optional(),
         }),
+        observability: z
+            .object({
+            clickstack: z.object({
+                enabled: z.boolean(),
+                telemetryRetentionDays: z.number().int().min(1).optional(),
+                decisionLogRetentionDays: z.number().int().min(1).optional(),
+                clickHouseStorageSize: z.string().optional(),
+            }),
+        })
+            .optional(),
+        // Distributed tracing (optional; self-hosted only). Absent on existing
+        // config files, which keeps them valid.
+        tracing: TracingConfigSchema.optional(),
+        cache: CacheObservabilityConfigSchema.optional(),
         logging: z.object({
-            // Logging always happens to console by default
-            // This configures additional external sinks
+            // Console logging is always on. This selects an additional external
+            // logging platform. Cloud object storage for decision logs is configured
+            // separately under `storage`.
             sink: z.enum([
                 "console",
                 "pending",
-                "s3",
-                "azure-blob",
-                "gcs",
                 "datadog",
                 "splunk",
                 "elasticsearch",
@@ -511,18 +769,13 @@ export const DeploymentConfigSchema = z.object({
                 "newrelic",
                 "axiom",
             ]),
-            // Sink-specific configuration
-            // For cloud storage: bucket name and region
-            // For platforms: repurposed for credentials (API key) and extra config
+            // For platforms, bucket/region are repurposed to carry the credential
+            // (API key/token) and endpoint/site.
             bucket: z.string().optional(),
             region: z.string().optional(),
-            cloudAuthMode: z.enum(["workload-identity", "secret"]).optional(),
-            awsIamRoleArn: z.string().optional(),
-            azureBlobContainer: z.string().optional(),
-            azureBlobClientId: z.string().optional(),
-            azureBlobTenantId: z.string().optional(),
-            azureBlobConnectionStringSecretRef: SecretKeyRefSchema.optional(),
-            gcpServiceAccountEmail: z.string().optional(),
+            // Application/container log shipping to Elasticsearch via the Vector
+            // agent DaemonSet (distinct from the decision-log `sink` above).
+            appLogs: AppLogsConfigSchema.optional(),
         }),
         customEmails: z
             .object({
@@ -548,65 +801,17 @@ export const DeploymentConfigSchema = z.object({
     }),
     // Credentials
     licenseKey: z.string().min(1),
-    // Version - app and HPS image versions
-    appVersion: z.string().optional(),
-    hpsVersion: z.string().optional(),
+    // Product version used for app, HPS, and HPS worker images
+    version: z.string().min(1),
+    // Optional single registry-host override for every image. Empty/unset means
+    // the chart default docker.io/rulebricks/*. When set (e.g. "myacr.azurecr.io"
+    // for an air-gapped mirror), the CLI rewrites the registry host into
+    // global.imageRegistry and into each Tier-2 chart's native image keys, keeping
+    // the rulebricks/<name> path. See the helm chart's global.imageRegistry knob.
+    imageRegistry: z.string().optional(),
     // Legacy chart version (deprecated, kept for backwards compatibility)
     chartVersion: z.string().optional(),
 });
-export const WIZARD_STEPS = [
-    { id: "mode", title: "Deployment Mode", description: "Choose how to deploy" },
-    {
-        id: "cloud",
-        title: "Cloud Provider",
-        description: "Select your cloud provider",
-    },
-    {
-        id: "domain",
-        title: "Domain & DNS",
-        description: "Configure your domain and DNS",
-    },
-    {
-        id: "smtp",
-        title: "Email (SMTP)",
-        description: "Configure email delivery",
-    },
-    {
-        id: "database",
-        title: "Database",
-        description: "Choose your database setup",
-    },
-    {
-        id: "database-creds",
-        title: "Database Credentials",
-        description: "Configure database access",
-    },
-    {
-        id: "tier",
-        title: "Performance Tier",
-        description: "Select your deployment size",
-    },
-    {
-        id: "features",
-        title: "Optional Features",
-        description: "Enable additional features",
-    },
-    {
-        id: "feature-config",
-        title: "Feature Settings",
-        description: "Configure enabled features",
-    },
-    {
-        id: "credentials",
-        title: "License & Version",
-        description: "Enter license and select version",
-    },
-    {
-        id: "review",
-        title: "Review & Save",
-        description: "Review your configuration",
-    },
-];
 // Helper to check if DNS provider supports external-dns
 export function isSupportedDnsProvider(provider) {
     return SUPPORTED_DNS_PROVIDERS.includes(provider);
@@ -635,9 +840,27 @@ export const ProfileConfigSchema = z.object({
     openaiApiKey: z.string().optional(),
     licenseKey: z.string().optional(),
     // Preferences
-    tier: z.enum(["small", "medium", "large"]).optional(),
     databaseType: z.enum(["self-hosted", "supabase-cloud"]).optional(),
-    infrastructureMode: z.enum(["existing", "provision"]).optional(),
+    storage: z
+        .object({
+        provider: z.enum(["s3", "azure-blob", "gcs"]),
+        cloudAuthMode: z.enum(["workload-identity", "secret"]).optional(),
+        bucket: z.string().optional(),
+        region: z.string().optional(),
+        awsIamRoleArn: z.string().optional(),
+        azureBlobClientId: z.string().optional(),
+        azureBlobTenantId: z.string().optional(),
+        azureBlobConnectionStringSecretRef: SecretKeyRefSchema.optional(),
+        azureBlobContainer: z.string().optional(),
+        gcpServiceAccountEmail: z.string().optional(),
+        paths: z
+            .object({
+            decisionLogs: z.string().optional(),
+            dbBackups: z.string().optional(),
+        })
+            .optional(),
+    })
+        .optional(),
     // SSO (optional)
     ssoProvider: z
         .enum(["azure", "google", "okta", "keycloak", "ory", "other"])