@rulebricks/cli 2.1.7 → 2.3.2

package/dist/components/Wizard/steps/FeatureConfigStep.js

@@ -1,13 +1,19 @@
 import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { useState, useEffect } from "react";
-import { Box, Text, useInput } from "ink";
+import { Box, Text } from "ink";
 import SelectInput from "ink-select-input";
 import TextInput from "ink-text-input";
 import { useWizard } from "../WizardContext.js";
-import { BorderBox, useTheme } from "../../common/index.js";
+import { BorderBox, useGatedInput, useTheme } from "../../common/index.js";
 import { Spinner } from "../../common/Spinner.js";
-import { LOGGING_SINK_INFO, CLOUD_REGIONS, DEFAULT_EMAIL_SUBJECTS, } from "../../../types/index.js";
-import { listBucketsInRegion, listRegions } from "../../../lib/cloudCli.js";
+import { CLOUD_REGIONS, DEFAULT_EMAIL_SUBJECTS, } from "../../../types/index.js";
+import { listRegions, listAzureManagedIdentities, getAzureTenantId, listAzurePrometheusTargets, listAwsPrometheusWorkspaces, } from "../../../lib/cloudCli.js";
+import { findClusterSetupDefaultIndex } from "../../../lib/clusterSetupDefaults.js";
+import { generateHtpasswdLine } from "../../../lib/htpasswd.js";
+import { generateSecureSecret } from "../../../lib/validation.js";
+// Sentinel value used in select lists to drop into manual text entry.
+const MANUAL = "__manual__";
+const REFRESH = "__refresh__";
 const SSO_PROVIDERS = [
     { label: "Microsoft Azure AD", value: "azure" },
     { label: "Google Workspace", value: "google" },
@@ -16,18 +22,9 @@ const SSO_PROVIDERS = [
     { label: "Ory", value: "ory" },
     { label: "Other OIDC Provider", value: "other" },
 ];
-const LOGGING_CATEGORIES = [
-    { label: "Cloud Storage (S3, Azure Blob, GCS)", value: "cloud-storage" },
-    {
-        label: "Logging Platform (Datadog, Splunk, etc.)",
-        value: "logging-platform",
-    },
-];
-const CLOUD_STORAGE_SINKS = [
-    { label: "AWS S3", value: "s3" },
-    { label: "Azure Blob Storage", value: "azure-blob" },
-    { label: "Google Cloud Storage", value: "gcs" },
-];
+// External logging forwards decision logs to a centralized logging platform.
+// Cloud object storage (S3/Blob/GCS) for decision logs is configured in the
+// dedicated Object Storage step, so it is intentionally not offered here.
 const LOGGING_PLATFORM_SINKS = [
     { label: "Datadog", value: "datadog" },
     { label: "Splunk (HEC)", value: "splunk" },
@@ -44,62 +41,113 @@ const DATADOG_SITES = [
     { label: "EU1 (datadoghq.eu)", value: "datadoghq.eu" },
     { label: "AP1 (ap1.datadoghq.com)", value: "ap1.datadoghq.com" },
 ];
-function BucketSelector({ loggingSink, loggingRegion, availableBuckets, isRefreshing, onSelect, onRefresh, colors, }) {
-    useInput((input) => {
-        if (input.toLowerCase() === "r") {
-            onRefresh();
-        }
-    });
-    const bucketItems = availableBuckets.map((b) => ({ label: b, value: b }));
-    const hasBuckets = availableBuckets.length > 0;
-    return (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsxs(Text, { bold: true, children: [loggingSink === "s3" && "Select S3 Bucket", loggingSink === "azure-blob" && "Select Azure Storage Account", loggingSink === "gcs" && "Select GCS Bucket"] }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Select an existing bucket in ", loggingRegion] }), isRefreshing ? (_jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: "Refreshing bucket list..." }) })) : hasBuckets ? (_jsx(Box, { marginTop: 1, height: 10, flexDirection: "column", overflowY: "hidden", children: _jsx(SelectInput, { items: bucketItems, onSelect: onSelect, limit: 8, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) })) : (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { color: "yellow", children: ["No buckets found in ", loggingRegion, "."] }), _jsx(Text, { color: "gray", dimColor: true, children: "Create a bucket in your cloud console, then press R to refresh." })] })), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" ", "Sink: ", LOGGING_SINK_INFO[loggingSink]?.name] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Region: ", loggingRegion] })] })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "R to refresh list \u2022 \u2191/\u2193 to navigate \u2022 Enter to select" }) })] }));
-}
-const MONITORING_DESTINATIONS = [
-    { label: "Local Grafana (bundled)", value: "local-grafana" },
+const REMOTE_WRITE_DESTINATIONS = [
     { label: "AWS Managed Prometheus (AMP)", value: "aws-amp" },
     { label: "Azure Monitor managed Prometheus", value: "azure-monitor" },
     { label: "Grafana Cloud", value: "grafana-cloud" },
     { label: "Generic Prometheus remote_write", value: "generic" },
 ];
-const REMOTE_WRITE_DESTINATIONS = MONITORING_DESTINATIONS.filter((destination) => destination.value !== "local-grafana");
 const AZURE_REMOTE_WRITE_AUTH = [
     { label: "Workload identity", value: "workload-identity" },
     { label: "Managed identity", value: "managed-identity" },
     { label: "OAuth client secret", value: "oauth" },
 ];
-const AZURE_LOGGING_AUTH = [
-    { label: "Workload identity", value: "workload-identity" },
-    { label: "Connection string Secret (fallback)", value: "secret" },
-];
 const GENERIC_REMOTE_WRITE_AUTH = [
     { label: "No additional auth", value: "none" },
     { label: "Basic auth from Kubernetes Secret", value: "basic" },
     { label: "Bearer token from Kubernetes Secret", value: "bearer" },
 ];
-export function FeatureConfigStep({ onComplete, onBack, }) {
+export function FeatureConfigStep({ onComplete, onBack, entryDirection, }) {
     const { state, dispatch } = useWizard();
     const { colors } = useTheme();
-    // Determine what needs to be configured
-    const needsAI = state.aiEnabled && !state.openaiApiKey;
+    // Determine what needs to be configured. Metrics export (Prometheus
+    // remote_write) is opt-in via the Features step; in-cluster Prometheus is
+    // always installed and needs no configuration.
+    // Show the OpenAI key step whenever AI is enabled, even if a key is already
+    // in wizard state (e.g. pre-filled from the saved profile or an existing
+    // config on redeploy). The input is seeded with that value so the user can
+    // confirm or change it — previously a pre-filled key silently skipped this
+    // step entirely, which looked like the wizard never collected the key.
+    const needsAI = state.aiEnabled;
     const needsSSO = state.ssoEnabled;
-    const needsMonitoring = state.monitoringEnabled;
+    const needsMonitoring = !state.clickStackEnabled && state.metricsExportEnabled;
     const needsLogging = state.loggingSink !== "console";
+    const needsTracing = !state.clickStackEnabled && state.tracingEnabled;
+    const needsAppLogs = !state.clickStackEnabled && state.appLogsEnabled;
+    const needsValkeyAdmin = state.valkeyAdminEnabled;
     const needsCustomEmails = state.customEmailsEnabled;
-    // Configuration order: AI -> SSO -> Monitoring -> Logging -> Custom Emails
+    // Configuration order:
+    // AI -> SSO -> Monitoring -> Logging -> Tracing -> AppLogs -> Valkey Admin -> Custom Emails
     const getInitialStep = () => {
         if (needsAI)
             return "openai-key";
         if (needsSSO)
             return "sso-provider";
         if (needsMonitoring)
-            return "monitoring-remote-write-ask";
+            return "monitoring-remote-write-destination";
         if (needsLogging)
-            return "logging-category";
+            return "logging-sink";
+        if (needsTracing)
+            return "tracing-destination";
+        if (needsAppLogs)
+            return "applogs-endpoint";
+        if (needsValkeyAdmin)
+            return "valkey-admin-username";
         if (needsCustomEmails)
             return "email-subject-invite";
         return "done";
     };
-    const [subStep, setSubStep] = useState(getInitialStep);
+    // Terminal sub-step of the last enabled section. Used when navigating *back*
+    // into this step so the user resumes at the end instead of the very start.
+    const tracingFinalStep = () => {
+        const destination = state.tracingDestination || "elastic";
+        if (destination === "otlp") {
+            return state.tracingOtlpAuthMode && state.tracingOtlpAuthMode !== "none"
+                ? "tracing-otlp-cred"
+                : "tracing-otlp-auth";
+        }
+        if (destination === "azure-monitor")
+            return "tracing-azure-connection";
+        return "tracing-token";
+    };
+    const loggingFinalStep = () => {
+        switch (state.loggingSink) {
+            case "datadog":
+                return "logging-datadog-config";
+            case "splunk":
+                return "logging-splunk-config";
+            case "elasticsearch":
+                return "logging-elasticsearch-config";
+            case "loki":
+                return "logging-loki-config";
+            case "newrelic":
+                return "logging-newrelic-config";
+            case "axiom":
+                return "logging-axiom-config";
+            default:
+                return "logging-sink";
+        }
+    };
+    const getFinalStep = () => {
+        if (needsCustomEmails)
+            return "email-template-change";
+        if (needsValkeyAdmin)
+            return "valkey-admin-allowed-ips";
+        if (needsAppLogs)
+            return "applogs-index";
+        if (needsTracing)
+            return tracingFinalStep();
+        if (needsLogging)
+            return loggingFinalStep();
+        if (needsMonitoring)
+            return "monitoring-remote-write-destination";
+        if (needsSSO)
+            return "sso-client-secret";
+        if (needsAI)
+            return "openai-key";
+        return "done";
+    };
+    const [subStep, setSubStep] = useState(entryDirection === "back" ? getFinalStep : getInitialStep);
     const [openaiKey, setOpenaiKey] = useState(state.openaiApiKey || "");
     const [ssoProvider, setSsoProvider] = useState(state.ssoProvider);
     const [ssoUrl, setSsoUrl] = useState(state.ssoUrl || "");
@@ -109,7 +157,6 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
     const [remoteWriteDestination, setRemoteWriteDestination] = useState(state.prometheusRemoteWriteDestination);
     const [remoteWriteAuthType, setRemoteWriteAuthType] = useState(state.prometheusRemoteWriteAuthType);
     const [remoteWriteAwsRegion, setRemoteWriteAwsRegion] = useState(state.prometheusRemoteWriteAwsRegion || state.region || "us-east-1");
-    const [remoteWriteAwsRoleArn, setRemoteWriteAwsRoleArn] = useState(state.prometheusRemoteWriteAwsRoleArn || "");
     const [remoteWriteAzureCloud] = useState(state.prometheusRemoteWriteAzureCloud || "AzurePublic");
     const [remoteWriteClientId, setRemoteWriteClientId] = useState(state.prometheusRemoteWriteClientId || "");
     const [remoteWriteTenantId, setRemoteWriteTenantId] = useState(state.prometheusRemoteWriteTenantId || "");
@@ -118,16 +165,6 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
     const [remoteWritePasswordSecretRef, setRemoteWritePasswordSecretRef] = useState(state.prometheusRemoteWritePasswordSecretRef || "");
     const [remoteWriteBearerSecretRef, setRemoteWriteBearerSecretRef] = useState(state.prometheusRemoteWriteBearerTokenSecretRef || "");
     const [loggingSink, setLoggingSink] = useState(state.loggingSink);
-    const [loggingBucket, setLoggingBucket] = useState(state.loggingBucket || "");
-    const [loggingRegion, setLoggingRegion] = useState(state.loggingRegion || "");
-    const [loggingCloudAuthMode, setLoggingCloudAuthMode] = useState(state.loggingCloudAuthMode || "workload-identity");
-    const [s3RoleArn, setS3RoleArn] = useState(state.loggingAwsIamRoleArn || "");
-    const [azureBlobContainer, setAzureBlobContainer] = useState(state.loggingAzureBlobContainer || "rulebricks-logs");
-    const [azureBlobClientId, setAzureBlobClientId] = useState(state.loggingAzureBlobClientId || "");
-    const [azureBlobTenantId, setAzureBlobTenantId] = useState(state.loggingAzureBlobTenantId || "");
-    const [azureBlobConnectionStringSecretRef, setAzureBlobConnectionStringSecretRef,] = useState(state.loggingAzureBlobConnectionStringSecretRef || "");
-    const [gcpServiceAccountEmail, setGcpServiceAccountEmail] = useState(state.loggingGcpServiceAccountEmail || "");
-    const [loggingCategory, setLoggingCategory] = useState(null);
     const [error, setError] = useState(null);
     // Logging platform config
     const [datadogApiKey, setDatadogApiKey] = useState("");
@@ -143,10 +180,46 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
     const [newrelicAccountId, setNewrelicAccountId] = useState("");
     const [axiomApiToken, setAxiomApiToken] = useState("");
     const [axiomDataset, setAxiomDataset] = useState("rulebricks");
-    // Dynamic bucket/region lists
-    const [availableBuckets, setAvailableBuckets] = useState([]);
-    const [availableRegions, setAvailableRegions] = useState([]);
-    const [isRefreshing, setIsRefreshing] = useState(false);
+    // Distributed tracing. The wizard supports three destinations (Elastic APM,
+    // generic OTLP/HTTP, Azure Monitor). For Elastic it collects endpoint + secret
+    // token (api-key auth remains available via config file).
+    const [tracingDestination, setTracingDestination] = useState(state.tracingDestination || "elastic");
+    const [tracingEndpoint, setTracingEndpoint] = useState(state.tracingElasticEndpoint || "");
+    const [tracingToken, setTracingToken] = useState(state.tracingElasticSecretToken || "");
+    const [tracingOtlpEndpoint, setTracingOtlpEndpoint] = useState(state.tracingOtlpEndpoint || "");
+    const [tracingOtlpAuthMode, setTracingOtlpAuthMode] = useState(state.tracingOtlpAuthMode === "bearer" ||
+        state.tracingOtlpAuthMode === "api-key"
+        ? state.tracingOtlpAuthMode
+        : "none");
+    const [tracingOtlpToken, setTracingOtlpToken] = useState(state.tracingOtlpToken || "");
+    const [tracingAzureConnectionString, setTracingAzureConnectionString] = useState(state.tracingAzureConnectionString || "");
+    // Application log shipping (BYO Elasticsearch via Vector agent). Basic auth.
+    const [appLogsEndpoint, setAppLogsEndpoint] = useState(state.appLogsElasticEndpoint || "");
+    const [appLogsUser, setAppLogsUser] = useState(state.appLogsElasticUsername || "");
+    const [appLogsPass, setAppLogsPass] = useState(state.appLogsElasticPassword || "");
+    const [appLogsIndex, setAppLogsIndex] = useState(state.appLogsElasticIndex || "rulebricks-app-logs");
+    const [defaultValkeyAdminPassword] = useState(() => generateSecureSecret(16));
+    const [valkeyAdminUsername, setValkeyAdminUsername] = useState(() => {
+        const existingUser = state.valkeyAdminBasicAuthUsers[0];
+        return existingUser?.split(":")[0] || "admin";
+    });
+    const [valkeyAdminPassword, setValkeyAdminPassword] = useState("");
+    const [valkeyAdminAllowedIPs, setValkeyAdminAllowedIPs] = useState(state.valkeyAdminAllowedIPs.join(", "));
+    // Dynamic resource lists for remote-write identity selection.
+    const [rwRegions, setRwRegions] = useState([]);
+    const [rwIdentities, setRwIdentities] = useState([]);
+    const [rwTargets, setRwTargets] = useState([]);
+    // Only offer the managed-Prometheus option for the cluster's own cloud (no
+    // AWS Managed Prometheus on an Azure cluster, etc.); Grafana Cloud and generic
+    // remote_write stay available everywhere.
+    const remoteWriteDestinations = REMOTE_WRITE_DESTINATIONS.filter((d) => {
+        if (d.value === "aws-amp")
+            return state.provider === "aws";
+        if (d.value === "azure-monitor")
+            return state.provider === "azure";
+        return true;
+    });
+    const [rwTenantAutoDetected, setRwTenantAutoDetected] = useState(false);
     // Custom email templates
     const [emailSubjectInvite, setEmailSubjectInvite] = useState(state.emailSubjects?.invite || DEFAULT_EMAIL_SUBJECTS.invite);
     const [emailSubjectConfirm, setEmailSubjectConfirm] = useState(state.emailSubjects?.confirmation || DEFAULT_EMAIL_SUBJECTS.confirmation);
@@ -162,11 +235,14 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
             !needsSSO &&
             !needsMonitoring &&
             !needsLogging &&
+            !needsTracing &&
+            !needsAppLogs &&
+            !needsValkeyAdmin &&
             !needsCustomEmails) {
             onComplete();
         }
     }, []);
-    useInput((input, key) => {
+    useGatedInput((input, key) => {
         if (key.escape) {
             setError(null);
             handleBack();
@@ -195,7 +271,7 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
             case "sso-client-secret":
                 setSubStep("sso-client-id");
                 break;
-            case "monitoring-remote-write-ask":
+            case "monitoring-remote-write-destination":
                 if (needsSSO)
                     setSubStep("sso-client-secret");
                 else if (needsAI)
@@ -203,22 +279,37 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
                 else
                     onBack();
                 break;
-            case "monitoring-remote-write-destination":
-                setSubStep("monitoring-remote-write-ask");
-                break;
-            case "monitoring-remote-write-url":
-                setSubStep("monitoring-remote-write-destination");
-                break;
+            case "monitoring-azure-target-loading":
+            case "monitoring-azure-target":
+            case "monitoring-aws-region-loading":
             case "monitoring-aws-region":
-                setSubStep("monitoring-remote-write-url");
+                // Azure target discovery and AWS region both branch directly off the
+                // destination choice.
+                setSubStep("monitoring-remote-write-destination");
                 break;
-            case "monitoring-aws-role-arn":
+            case "monitoring-aws-workspace-loading":
+            case "monitoring-aws-workspace":
                 setSubStep("monitoring-aws-region");
                 break;
+            case "monitoring-remote-write-url":
+                // The manual-URL fallback is reached from the discovery picker.
+                if (remoteWriteDestination === "azure-monitor") {
+                    setSubStep("monitoring-azure-target");
+                }
+                else if (remoteWriteDestination === "aws-amp") {
+                    setSubStep("monitoring-aws-workspace");
+                }
+                else {
+                    setSubStep("monitoring-remote-write-destination");
+                }
+                break;
             case "monitoring-remote-write-azure-auth":
+                setSubStep("monitoring-azure-target");
+                break;
             case "monitoring-remote-write-generic-auth":
                 setSubStep("monitoring-remote-write-url");
                 break;
+            case "monitoring-azure-identity-loading":
             case "monitoring-remote-write-client-id":
                 if (remoteWriteDestination === "azure-monitor") {
                     setSubStep("monitoring-remote-write-azure-auth");
@@ -227,6 +318,9 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
                     setSubStep("monitoring-remote-write-url");
                 }
                 break;
+            case "monitoring-remote-write-client-id-manual":
+                setSubStep("monitoring-remote-write-client-id");
+                break;
             case "monitoring-remote-write-tenant-id":
                 setSubStep("monitoring-remote-write-client-id");
                 break;
@@ -246,9 +340,9 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
             case "monitoring-remote-write-bearer-secret-ref":
                 setSubStep("monitoring-remote-write-generic-auth");
                 break;
-            case "logging-category":
+            case "logging-sink":
                 if (needsMonitoring)
-                    setSubStep("monitoring-remote-write-ask");
+                    setSubStep("monitoring-remote-write-destination");
                 else if (needsSSO)
                     setSubStep("sso-client-secret");
                 else if (needsAI)
@@ -256,53 +350,102 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
                 else
                     onBack();
                 break;
-            case "logging-sink":
-                setSubStep("logging-category");
-                break;
-            case "logging-region":
-            case "logging-region-loading":
+            // Logging platform config steps
+            case "logging-datadog-config":
+            case "logging-splunk-config":
+            case "logging-elasticsearch-config":
+            case "logging-loki-config":
+            case "logging-newrelic-config":
+            case "logging-axiom-config":
                 setSubStep("logging-sink");
                 break;
-            case "logging-bucket":
-            case "logging-bucket-loading":
-                setSubStep("logging-region");
+            // Distributed tracing steps
+            case "tracing-destination":
+                if (needsLogging)
+                    setSubStep("logging-sink");
+                else if (needsMonitoring)
+                    setSubStep("monitoring-remote-write-destination");
+                else if (needsSSO)
+                    setSubStep("sso-client-secret");
+                else if (needsAI)
+                    setSubStep("openai-key");
+                else
+                    onBack();
                 break;
-            case "logging-s3-role-arn":
-                setSubStep("logging-bucket");
+            case "tracing-endpoint":
+            case "tracing-otlp-endpoint":
+            case "tracing-azure-connection":
+                setSubStep("tracing-destination");
                 break;
-            case "logging-azure-container":
-                setSubStep("logging-bucket");
+            case "tracing-token":
+                setSubStep("tracing-endpoint");
                 break;
-            case "logging-azure-auth":
-                setSubStep("logging-azure-container");
+            case "tracing-otlp-auth":
+                setSubStep("tracing-otlp-endpoint");
                 break;
-            case "logging-azure-client-id":
-                setSubStep("logging-azure-auth");
+            case "tracing-otlp-cred":
+                setSubStep("tracing-otlp-auth");
                 break;
-            case "logging-azure-tenant-id":
-                setSubStep("logging-azure-client-id");
+            // Application log shipping steps
+            case "applogs-endpoint":
+                if (needsTracing)
+                    setSubStep(tracingFinalStep());
+                else if (needsLogging)
+                    setSubStep(loggingFinalStep());
+                else if (needsMonitoring)
+                    setSubStep("monitoring-remote-write-destination");
+                else if (needsSSO)
+                    setSubStep("sso-client-secret");
+                else if (needsAI)
+                    setSubStep("openai-key");
+                else
+                    onBack();
                 break;
-            case "logging-azure-connection-string-secret":
-                setSubStep("logging-azure-auth");
+            case "applogs-user":
+                setSubStep("applogs-endpoint");
                 break;
-            case "logging-gcp-service-account":
-                setSubStep("logging-bucket");
+            case "applogs-pass":
+                setSubStep("applogs-user");
                 break;
-            // Logging platform config steps
-            case "logging-datadog-config":
-            case "logging-splunk-config":
-            case "logging-elasticsearch-config":
-            case "logging-loki-config":
-            case "logging-newrelic-config":
-            case "logging-axiom-config":
-                setSubStep("logging-sink");
+            case "applogs-index":
+                setSubStep("applogs-pass");
+                break;
+            // Valkey Admin steps
+            case "valkey-admin-username":
+                if (needsAppLogs)
+                    setSubStep("applogs-index");
+                else if (needsTracing)
+                    setSubStep(tracingFinalStep());
+                else if (needsLogging)
+                    setSubStep(loggingFinalStep());
+                else if (needsMonitoring)
+                    setSubStep("monitoring-remote-write-destination");
+                else if (needsSSO)
+                    setSubStep("sso-client-secret");
+                else if (needsAI)
+                    setSubStep("openai-key");
+                else
+                    onBack();
+                break;
+            case "valkey-admin-password":
+                setSubStep("valkey-admin-username");
+                break;
+            case "valkey-admin-allowed-ips":
+                setSubStep("valkey-admin-password");
                 break;
             // Email template steps
             case "email-subject-invite":
-                if (needsLogging)
-                    setSubStep("logging-category");
+                if (needsValkeyAdmin) {
+                    setSubStep("valkey-admin-allowed-ips");
+                }
+                else if (needsAppLogs)
+                    setSubStep("applogs-index");
+                else if (needsTracing)
+                    setSubStep(tracingFinalStep());
+                else if (needsLogging)
+                    setSubStep(loggingFinalStep());
                 else if (needsMonitoring)
-                    setSubStep("monitoring-remote-write-ask");
+                    setSubStep("monitoring-remote-write-destination");
                 else if (needsSSO)
                     setSubStep("sso-client-secret");
                 else if (needsAI)
@@ -333,35 +476,59 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
                 break;
         }
     };
+    // Section sequencing helpers. Each "goTo<Section>OrAfter" advances to the next
+    // enabled section, so adding a section only required inserting it into this
+    // chain (Logging -> Tracing -> AppLogs -> Valkey Admin -> Custom Emails).
+    const goToCustomEmailsOrDone = () => {
+        if (needsCustomEmails)
+            setSubStep("email-subject-invite");
+        else
+            onComplete();
+    };
+    const goToValkeyAdminOrAfter = () => {
+        if (needsValkeyAdmin)
+            setSubStep("valkey-admin-username");
+        else
+            goToCustomEmailsOrDone();
+    };
+    const goToAppLogsOrAfter = () => {
+        if (needsAppLogs)
+            setSubStep("applogs-endpoint");
+        else
+            goToValkeyAdminOrAfter();
+    };
+    const goToTracingOrAfter = () => {
+        if (needsTracing)
+            setSubStep("tracing-destination");
+        else
+            goToAppLogsOrAfter();
+    };
+    const goToLoggingOrAfter = () => {
+        if (needsLogging)
+            setSubStep("logging-sink");
+        else
+            goToTracingOrAfter();
+    };
+    const goToMonitoringOrAfter = () => {
+        if (needsMonitoring)
+            setSubStep("monitoring-remote-write-destination");
+        else
+            goToLoggingOrAfter();
+    };
     const advanceToNext = (from) => {
         switch (from) {
             case "openai-key":
                 if (needsSSO)
                     setSubStep("sso-provider");
-                else if (needsMonitoring)
-                    setSubStep("monitoring-remote-write-ask");
-                else if (needsLogging)
-                    setSubStep("logging-category");
-                else if (needsCustomEmails)
-                    setSubStep("email-subject-invite");
                 else
-                    onComplete();
+                    goToMonitoringOrAfter();
                 break;
             case "sso-client-secret":
-                if (needsMonitoring)
-                    setSubStep("monitoring-remote-write-ask");
-                else if (needsLogging)
-                    setSubStep("logging-category");
-                else if (needsCustomEmails)
-                    setSubStep("email-subject-invite");
-                else
-                    onComplete();
+                goToMonitoringOrAfter();
                 break;
-            case "monitoring-remote-write-ask":
             case "monitoring-remote-write-destination":
             case "monitoring-remote-write-url":
             case "monitoring-aws-region":
-            case "monitoring-aws-role-arn":
             case "monitoring-remote-write-azure-auth":
             case "monitoring-remote-write-generic-auth":
             case "monitoring-remote-write-client-id":
@@ -370,23 +537,7 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
             case "monitoring-remote-write-username-secret-ref":
             case "monitoring-remote-write-password-secret-ref":
             case "monitoring-remote-write-bearer-secret-ref":
-                if (needsLogging)
-                    setSubStep("logging-category");
-                else if (needsCustomEmails)
-                    setSubStep("email-subject-invite");
-                else
-                    onComplete();
-                break;
-            case "logging-bucket":
-            case "logging-s3-role-arn":
-            case "logging-azure-tenant-id":
-            case "logging-azure-connection-string-secret":
-            case "logging-gcp-service-account":
-                // Cloud storage config complete, check for custom emails
-                if (needsCustomEmails)
-                    setSubStep("email-subject-invite");
-                else
-                    onComplete();
+                goToLoggingOrAfter();
                 break;
             case "logging-datadog-config":
             case "logging-splunk-config":
@@ -394,11 +545,19 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
             case "logging-loki-config":
             case "logging-newrelic-config":
             case "logging-axiom-config":
-                // Platform config complete, check for custom emails
-                if (needsCustomEmails)
-                    setSubStep("email-subject-invite");
-                else
-                    onComplete();
+                // Decision-log platform config complete -> tracing/appLogs/emails.
+                goToTracingOrAfter();
+                break;
+            case "tracing-token":
+            case "tracing-otlp-cred":
+            case "tracing-azure-connection":
+                goToAppLogsOrAfter();
+                break;
+            case "applogs-index":
+                goToValkeyAdminOrAfter();
+                break;
+            case "valkey-admin-allowed-ips":
+                goToCustomEmailsOrDone();
                 break;
             case "email-template-change":
                 // All email config complete
@@ -473,24 +632,6 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
         advanceToNext("sso-client-secret");
     };
     // === Monitoring Configuration ===
-    const handleRemoteWriteAsk = (item) => {
-        const destination = item.value;
-        if (destination === "local-grafana") {
-            setRemoteWriteDestination(null);
-            dispatch({ type: "SET_PROMETHEUS_REMOTE_WRITE", url: "" });
-            dispatch({
-                type: "SET_PROMETHEUS_REMOTE_WRITE_CONFIG",
-                config: {
-                    prometheusMonitoringDestination: "local-grafana",
-                    prometheusRemoteWriteDestination: null,
-                    prometheusRemoteWriteAuthType: null,
-                },
-            });
-            advanceToNext("monitoring-remote-write-ask");
-            return;
-        }
-        handleRemoteWriteDestinationSelect({ value: destination });
-    };
     const handleRemoteWriteDestinationSelect = (item) => {
         const destination = item.value;
         setRemoteWriteDestination(destination);
@@ -502,22 +643,100 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
                 prometheusRemoteWriteDestination: destination,
             },
         });
-        setSubStep("monitoring-remote-write-url");
+        // Auto-discover the remote_write URL where we can, so the user selects an
+        // existing target instead of hand-building a URL. Manual entry stays available.
+        if (destination === "azure-monitor") {
+            loadAzureTargets();
+        }
+        else if (destination === "aws-amp") {
+            loadAwsRegions();
+        }
+        else {
+            setSubStep("monitoring-remote-write-url");
+        }
+    };
+    // Azure Monitor: discover Data Collection Rules that ingest Prometheus metrics
+    // and pre-assemble each remote_write URL.
+    const loadAzureTargets = async () => {
+        setSubStep("monitoring-azure-target-loading");
+        try {
+            setRwTargets(await listAzurePrometheusTargets());
+        }
+        catch {
+            setRwTargets([]);
+        }
+        setSubStep("monitoring-azure-target");
+    };
+    const handleAzureTargetSelect = (item) => {
+        if (item.value === REFRESH) {
+            loadAzureTargets();
+            return;
+        }
+        if (item.value === MANUAL) {
+            setSubStep("monitoring-remote-write-url");
+            return;
+        }
+        setRemoteWriteUrl(item.value);
+        dispatch({ type: "SET_PROMETHEUS_REMOTE_WRITE", url: item.value });
+        setError(null);
+        setSubStep("monitoring-remote-write-azure-auth");
+    };
+    // AWS Managed Prometheus: discover workspaces in the chosen region and
+    // pre-assemble each remote_write URL.
+    const loadAwsWorkspaces = async (region) => {
+        setSubStep("monitoring-aws-workspace-loading");
+        try {
+            setRwTargets(await listAwsPrometheusWorkspaces(region));
+        }
+        catch {
+            setRwTargets([]);
+        }
+        setSubStep("monitoring-aws-workspace");
+    };
+    const handleAwsWorkspaceSelect = (item) => {
+        if (item.value === REFRESH) {
+            loadAwsWorkspaces(remoteWriteAwsRegion);
+            return;
+        }
+        if (item.value === MANUAL) {
+            setSubStep("monitoring-remote-write-url");
+            return;
+        }
+        setRemoteWriteUrl(item.value);
+        dispatch({ type: "SET_PROMETHEUS_REMOTE_WRITE", url: item.value });
+        setError(null);
+        saveAwsAmpConfig("");
     };
     const handleRemoteWriteUrlSubmit = () => {
-        if (remoteWriteUrl) {
-            try {
-                new URL(remoteWriteUrl);
-            }
-            catch {
-                setError("Invalid URL format");
-                return;
-            }
+        if (!remoteWriteUrl) {
+            setError("Remote write URL is required. If you don't have a destination yet, go back and disable Metrics Export.");
+            return;
+        }
+        try {
+            new URL(remoteWriteUrl);
+        }
+        catch {
+            setError("Invalid URL format");
+            return;
+        }
+        // Azure Monitor needs the full DCE metrics-ingestion path, not the bare DCE
+        // host. Catch it here so the user gets immediate feedback instead of a
+        // failure at save time.
+        if (remoteWriteDestination === "azure-monitor" &&
+            !(remoteWriteUrl.includes("/dataCollectionRules/") &&
+                remoteWriteUrl.includes("/streams/") &&
+                remoteWriteUrl.includes("/api/v1/write"))) {
+            setError("Azure Monitor needs the full ingestion URL, e.g.\n" +
+                "https://<dce>.<region>.metrics.ingest.monitor.azure.com/dataCollectionRules/<dcrImmutableId>/streams/Microsoft-PrometheusMetrics/api/v1/write?api-version=2023-04-24\n" +
+                "(the data collection endpoint host alone won't work).");
+            return;
         }
         setError(null);
         dispatch({ type: "SET_PROMETHEUS_REMOTE_WRITE", url: remoteWriteUrl });
         if (remoteWriteDestination === "aws-amp") {
-            setSubStep("monitoring-aws-region");
+            // Region was already chosen before this manual-URL fallback (it's reached
+            // from the workspace picker), so save directly.
+            saveAwsAmpConfig("");
         }
         else if (remoteWriteDestination === "azure-monitor") {
             setSubStep("monitoring-remote-write-azure-auth");
@@ -537,19 +756,25 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
             setError("Select a remote_write destination first");
         }
     };
-    const handleAwsRemoteWriteRegionSubmit = () => {
-        if (!remoteWriteAwsRegion) {
-            setError("AWS region is required");
-            return;
+    // AWS Managed Prometheus: pick region then IRSA role from CLI-backed lists.
+    const loadAwsRegions = async () => {
+        setSubStep("monitoring-aws-region-loading");
+        try {
+            const regions = await listRegions("aws");
+            setRwRegions(regions.length > 0 ? regions : CLOUD_REGIONS.aws);
         }
-        setError(null);
-        setSubStep("monitoring-aws-role-arn");
-    };
-    const handleAwsRemoteWriteRoleArnSubmit = () => {
-        if (remoteWriteAwsRoleArn && !remoteWriteAwsRoleArn.startsWith("arn:")) {
-            setError("Enter a valid IAM role ARN or leave blank");
-            return;
+        catch {
+            setRwRegions(CLOUD_REGIONS.aws);
         }
+        setSubStep("monitoring-aws-region");
+    };
+    const handleAwsRegionSelect = (item) => {
+        setRemoteWriteAwsRegion(item.value);
+        // Discover AMP workspaces in this region; the role is the single Rulebricks
+        // role from the Storage step (reused at assembly), so there's no role prompt.
+        loadAwsWorkspaces(item.value);
+    };
+    const saveAwsAmpConfig = (roleArn) => {
         dispatch({
             type: "SET_PROMETHEUS_REMOTE_WRITE_CONFIG",
             config: {
@@ -557,11 +782,11 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
                 prometheusMonitoringDestination: "aws-amp",
                 prometheusRemoteWriteAuthType: "none",
                 prometheusRemoteWriteAwsRegion: remoteWriteAwsRegion,
-                prometheusRemoteWriteAwsRoleArn: remoteWriteAwsRoleArn,
+                prometheusRemoteWriteAwsRoleArn: roleArn,
             },
         });
         setError(null);
-        advanceToNext("monitoring-aws-role-arn");
+        advanceToNext("monitoring-aws-region");
     };
     const saveRemoteWriteConfig = (authType, overrides = {}) => {
         if (!remoteWriteDestination || !remoteWriteUrl) {
@@ -593,8 +818,55 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
             type: "SET_PROMETHEUS_REMOTE_WRITE_CONFIG",
             config: { prometheusRemoteWriteAuthType: authType },
         });
+        // Workload/managed identity reuse the single Rulebricks identity chosen in
+        // the Storage step (filled in during config assembly), so there's no second
+        // identity to pick here. Only OAuth needs its own app-registration credentials.
+        if (authType === "workload-identity" || authType === "managed-identity") {
+            saveRemoteWriteConfig(authType);
+            return;
+        }
+        loadAzureIdentitiesForRemoteWrite();
+    };
+    // Azure Monitor: pick the managed/workload identity client ID from a list and
+    // auto-fill the tenant ID from the active Azure CLI session.
+    const loadAzureIdentitiesForRemoteWrite = async () => {
+        setSubStep("monitoring-azure-identity-loading");
+        try {
+            const [identities, tenant] = await Promise.all([
+                listAzureManagedIdentities(),
+                remoteWriteTenantId
+                    ? Promise.resolve(null)
+                    : getAzureTenantId(),
+            ]);
+            setRwIdentities(identities);
+            if (tenant) {
+                setRemoteWriteTenantId(tenant);
+                setRwTenantAutoDetected(true);
+            }
+        }
+        catch {
+            setRwIdentities([]);
+        }
         setSubStep("monitoring-remote-write-client-id");
     };
+    const proceedAfterClientId = () => {
+        if (remoteWriteAuthType === "managed-identity") {
+            saveRemoteWriteConfig("managed-identity", {
+                clientId: remoteWriteClientId,
+            });
+            return;
+        }
+        setError(null);
+        setSubStep("monitoring-remote-write-tenant-id");
+    };
+    const handleRemoteWriteClientIdSelect = (item) => {
+        if (item.value === MANUAL) {
+            setSubStep("monitoring-remote-write-client-id-manual");
+            return;
+        }
+        setRemoteWriteClientId(item.value);
+        proceedAfterClientId();
+    };
     const handleGenericRemoteWriteAuthSelect = (item) => {
         const authType = item.value;
         setRemoteWriteAuthType(authType);
@@ -613,14 +885,7 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
             setError("Client ID is required");
             return;
         }
-        if (remoteWriteAuthType === "managed-identity") {
-            saveRemoteWriteConfig("managed-identity", {
-                clientId: remoteWriteClientId,
-            });
-            return;
-        }
-        setError(null);
-        setSubStep("monitoring-remote-write-tenant-id");
+        proceedAfterClientId();
     };
     const handleRemoteWriteTenantIdSubmit = () => {
         if (!remoteWriteTenantId) {
@@ -675,304 +940,318 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
             bearerTokenSecretRef: remoteWriteBearerSecretRef,
         });
     };
-    // === Logging Configuration ===
-    // Map logging sink to cloud provider
-    const sinkToProvider = (sink) => {
-        if (sink === "s3")
-            return "aws";
-        if (sink === "azure-blob")
-            return "azure";
-        if (sink === "gcs")
-            return "gcp";
-        return null;
-    };
-    // Is sink a cloud storage type?
-    const isCloudStorageSink = (sink) => {
-        return sink === "s3" || sink === "azure-blob" || sink === "gcs";
-    };
-    // Step 1: Select logging category
-    const handleLoggingCategorySelect = (item) => {
-        const category = item.value;
-        setLoggingCategory(category);
-        setSubStep("logging-sink");
-    };
-    // Step 2: Select logging sink based on category
-    const handleLoggingSinkSelect = async (item) => {
+    // === Logging Configuration (external logging platforms) ===
+    const handleLoggingSinkSelect = (item) => {
         const sink = item.value;
         setLoggingSink(sink);
         dispatch({ type: "SET_LOGGING_SINK", sink });
-        if (isCloudStorageSink(sink)) {
-            // Cloud storage: go to region selection
-            loadRegionsForLogging(sink);
+        switch (sink) {
+            case "datadog":
+                setSubStep("logging-datadog-config");
+                break;
+            case "splunk":
+                setSubStep("logging-splunk-config");
+                break;
+            case "elasticsearch":
+                setSubStep("logging-elasticsearch-config");
+                break;
+            case "loki":
+                setSubStep("logging-loki-config");
+                break;
+            case "newrelic":
+                setSubStep("logging-newrelic-config");
+                break;
+            case "axiom":
+                setSubStep("logging-axiom-config");
+                break;
         }
-        else {
-            // Logging platform: go to platform-specific config
-            switch (sink) {
-                case "datadog":
-                    setSubStep("logging-datadog-config");
-                    break;
-                case "splunk":
-                    setSubStep("logging-splunk-config");
-                    break;
-                case "elasticsearch":
-                    setSubStep("logging-elasticsearch-config");
-                    break;
-                case "loki":
-                    setSubStep("logging-loki-config");
-                    break;
-                case "newrelic":
-                    setSubStep("logging-newrelic-config");
-                    break;
-                case "axiom":
-                    setSubStep("logging-axiom-config");
-                    break;
-            }
+    };
+    // === Logging Platform Config Handlers ===
+    const handleDatadogConfigSubmit = () => {
+        if (!datadogApiKey) {
+            setError("Datadog API key is required");
+            return;
         }
+        setError(null);
+        dispatch({
+            type: "SET_LOGGING_CONFIG",
+            config: {
+                loggingPlatformCredential: datadogApiKey, // platform API key
+                loggingPlatformDetail: datadogSite, // platform site
+            },
+        });
+        advanceToNext("logging-datadog-config");
     };
-    // Load regions for cloud storage
-    const loadRegionsForLogging = async (sink) => {
-        const provider = sinkToProvider(sink);
-        if (!provider) {
-            setSubStep("logging-region");
+    const handleSplunkConfigSubmit = () => {
+        if (!splunkUrl) {
+            setError("Splunk HEC URL is required");
+            return;
+        }
+        if (!splunkHecToken) {
+            setError("Splunk HEC token is required");
             return;
         }
-        setSubStep("logging-region-loading");
         try {
-            const regions = await listRegions(provider);
-            if (regions.length > 0) {
-                setAvailableRegions(regions);
-            }
-            else {
-                setAvailableRegions(CLOUD_REGIONS[provider]);
-            }
+            new URL(splunkUrl);
         }
         catch {
-            setAvailableRegions(CLOUD_REGIONS[provider]);
+            setError("Invalid URL format");
+            return;
         }
-        setSubStep("logging-region");
-    };
-    // After region is selected, load buckets in that region
-    const handleLoggingRegionSelect = async (item) => {
-        setLoggingRegion(item.value);
+        setError(null);
         dispatch({
             type: "SET_LOGGING_CONFIG",
-            config: { loggingRegion: item.value },
+            config: {
+                loggingPlatformCredential: splunkHecToken,
+                loggingPlatformDetail: splunkUrl,
+            },
         });
-        // Now load buckets in this region
-        const provider = sinkToProvider(loggingSink);
-        if (provider) {
-            setSubStep("logging-bucket-loading");
-            try {
-                const buckets = await listBucketsInRegion(provider, item.value);
-                setAvailableBuckets(buckets);
-            }
-            catch {
-                setAvailableBuckets([]);
-            }
-        }
-        setSubStep("logging-bucket");
+        advanceToNext("logging-splunk-config");
     };
-    // Refresh bucket list
-    const refreshBuckets = async () => {
-        if (isRefreshing)
-            return;
-        const provider = sinkToProvider(loggingSink);
-        if (!provider || !loggingRegion)
+    const handleElasticsearchConfigSubmit = () => {
+        if (!elasticsearchUrl) {
+            setError("Elasticsearch URL is required");
             return;
-        setIsRefreshing(true);
+        }
         try {
-            const buckets = await listBucketsInRegion(provider, loggingRegion);
-            setAvailableBuckets(buckets);
+            new URL(elasticsearchUrl);
         }
         catch {
-            // Keep existing list on error
+            setError("Invalid URL format");
+            return;
         }
-        setIsRefreshing(false);
-    };
-    // Select bucket (no create option)
-    const handleLoggingBucketSelect = (item) => {
-        setLoggingBucket(item.value);
+        setError(null);
+        // Store the connection as JSON in the credential field for complex config.
         dispatch({
             type: "SET_LOGGING_CONFIG",
-            config: { loggingBucket: item.value },
+            config: {
+                loggingPlatformCredential: JSON.stringify({
+                    url: elasticsearchUrl,
+                    user: elasticsearchUser,
+                    password: elasticsearchPass,
+                    index: elasticsearchIndex,
+                }),
+                loggingPlatformDetail: elasticsearchIndex,
+            },
         });
-        if (loggingSink === "s3") {
-            setSubStep("logging-s3-role-arn");
-            return;
-        }
-        if (loggingSink === "azure-blob") {
-            setSubStep("logging-azure-container");
+        advanceToNext("logging-elasticsearch-config");
+    };
+    // === Distributed Tracing (Elastic APM) ===
+    const handleTracingEndpointSubmit = () => {
+        if (!tracingEndpoint) {
+            setError("Elastic APM OTLP endpoint is required");
             return;
         }
-        if (loggingSink === "gcs") {
-            setSubStep("logging-gcp-service-account");
-            return;
+        try {
+            new URL(tracingEndpoint);
         }
-        advanceToNext("logging-bucket");
-    };
-    const handleS3RoleArnSubmit = () => {
-        if (!s3RoleArn.startsWith("arn:")) {
-            setError("IAM role ARN is required for S3 IRSA");
+        catch {
+            setError("Invalid URL format");
             return;
         }
         setError(null);
         dispatch({
-            type: "SET_LOGGING_CONFIG",
+            type: "SET_TRACING_CONFIG",
             config: {
-                loggingCloudAuthMode: "workload-identity",
-                loggingAwsIamRoleArn: s3RoleArn,
+                tracingElasticEndpoint: tracingEndpoint,
+                tracingElasticAuthMode: "secret-token",
             },
         });
-        advanceToNext("logging-s3-role-arn");
+        setSubStep("tracing-token");
     };
-    const handleAzureBlobContainerSubmit = () => {
-        if (!azureBlobContainer) {
-            setError("Azure Blob container name is required");
+    const handleTracingTokenSubmit = () => {
+        if (!tracingToken) {
+            setError("Elastic APM secret token is required");
             return;
         }
         setError(null);
         dispatch({
-            type: "SET_LOGGING_CONFIG",
-            config: { loggingAzureBlobContainer: azureBlobContainer },
+            type: "SET_TRACING_CONFIG",
+            config: { tracingElasticSecretToken: tracingToken },
         });
-        setSubStep("logging-azure-auth");
+        advanceToNext("tracing-token");
     };
-    const handleAzureBlobAuthSelect = (item) => {
-        const authMode = item.value;
-        setLoggingCloudAuthMode(authMode);
+    const handleTracingDestinationSelect = (item) => {
+        const destination = item.value;
+        setTracingDestination(destination);
         dispatch({
-            type: "SET_LOGGING_CONFIG",
-            config: { loggingCloudAuthMode: authMode },
+            type: "SET_TRACING_CONFIG",
+            config: { tracingDestination: destination },
         });
-        setSubStep(authMode === "workload-identity"
-            ? "logging-azure-client-id"
-            : "logging-azure-connection-string-secret");
+        setError(null);
+        if (destination === "elastic")
+            setSubStep("tracing-endpoint");
+        else if (destination === "otlp")
+            setSubStep("tracing-otlp-endpoint");
+        else
+            setSubStep("tracing-azure-connection");
     };
-    const handleAzureBlobClientIdSubmit = () => {
-        if (!azureBlobClientId) {
-            setError("Managed identity client ID is required");
+    const handleTracingOtlpEndpointSubmit = () => {
+        if (!tracingOtlpEndpoint) {
+            setError("OTLP endpoint is required");
             return;
         }
+        try {
+            new URL(tracingOtlpEndpoint);
+        }
+        catch {
+            setError("Invalid URL format");
+            return;
+        }
+        setError(null);
+        dispatch({
+            type: "SET_TRACING_CONFIG",
+            config: { tracingOtlpEndpoint },
+        });
+        setSubStep("tracing-otlp-auth");
+    };
+    const handleTracingOtlpAuthSelect = (item) => {
+        const mode = item.value;
+        setTracingOtlpAuthMode(mode);
+        dispatch({
+            type: "SET_TRACING_CONFIG",
+            config: { tracingOtlpAuthMode: mode },
+        });
         setError(null);
-        setSubStep("logging-azure-tenant-id");
+        if (mode === "none") {
+            // No credential needed; the section is complete.
+            goToAppLogsOrAfter();
+        }
+        else {
+            setSubStep("tracing-otlp-cred");
+        }
     };
-    const handleAzureBlobTenantIdSubmit = () => {
-        if (!azureBlobTenantId) {
-            setError("Azure tenant ID is required");
+    const handleTracingOtlpCredSubmit = () => {
+        if (!tracingOtlpToken) {
+            setError("A credential is required for the selected OTLP auth mode");
             return;
         }
         setError(null);
         dispatch({
-            type: "SET_LOGGING_CONFIG",
-            config: {
-                loggingCloudAuthMode: "workload-identity",
-                loggingAzureBlobContainer: azureBlobContainer,
-                loggingAzureBlobClientId: azureBlobClientId,
-                loggingAzureBlobTenantId: azureBlobTenantId,
-            },
+            type: "SET_TRACING_CONFIG",
+            config: { tracingOtlpToken },
         });
-        advanceToNext("logging-azure-tenant-id");
+        advanceToNext("tracing-otlp-cred");
     };
-    const handleAzureBlobConnectionStringSecretSubmit = () => {
-        if (!azureBlobConnectionStringSecretRef.includes(":")) {
-            setError("Use secret-name:key format");
+    const handleTracingAzureConnectionSubmit = () => {
+        if (!tracingAzureConnectionString) {
+            setError("Azure Monitor connection string is required");
             return;
         }
         setError(null);
         dispatch({
-            type: "SET_LOGGING_CONFIG",
-            config: {
-                loggingAzureBlobContainer: azureBlobContainer,
-                loggingCloudAuthMode: "secret",
-                loggingAzureBlobConnectionStringSecretRef: azureBlobConnectionStringSecretRef,
-            },
+            type: "SET_TRACING_CONFIG",
+            config: { tracingAzureConnectionString },
         });
-        advanceToNext("logging-azure-connection-string-secret");
+        advanceToNext("tracing-azure-connection");
     };
-    const handleGcpServiceAccountSubmit = () => {
-        if (!gcpServiceAccountEmail.includes("@")) {
-            setError("Google service account email is required");
+    // === Application Log Shipping (BYO Elasticsearch) ===
+    const handleAppLogsEndpointSubmit = () => {
+        if (!appLogsEndpoint) {
+            setError("Elasticsearch endpoint is required");
+            return;
+        }
+        try {
+            new URL(appLogsEndpoint);
+        }
+        catch {
+            setError("Invalid URL format");
             return;
         }
         setError(null);
         dispatch({
-            type: "SET_LOGGING_CONFIG",
+            type: "SET_APP_LOGS_CONFIG",
             config: {
-                loggingCloudAuthMode: "workload-identity",
-                loggingGcpServiceAccountEmail: gcpServiceAccountEmail,
+                appLogsElasticEndpoint: appLogsEndpoint,
+                appLogsElasticAuthMode: "basic",
             },
         });
-        advanceToNext("logging-gcp-service-account");
+        setSubStep("applogs-user");
     };
-    // === Logging Platform Config Handlers ===
-    const handleDatadogConfigSubmit = () => {
-        if (!datadogApiKey) {
-            setError("Datadog API key is required");
+    const handleAppLogsUserSubmit = () => {
+        if (!appLogsUser) {
+            setError("Elasticsearch username is required");
             return;
         }
         setError(null);
         dispatch({
-            type: "SET_LOGGING_CONFIG",
-            config: {
-                loggingBucket: datadogApiKey, // Repurpose bucket field for API key
-                loggingRegion: datadogSite, // Repurpose region field for site
-            },
+            type: "SET_APP_LOGS_CONFIG",
+            config: { appLogsElasticUsername: appLogsUser },
         });
-        advanceToNext("logging-datadog-config");
+        setSubStep("applogs-pass");
     };
-    const handleSplunkConfigSubmit = () => {
-        if (!splunkUrl) {
-            setError("Splunk HEC URL is required");
+    const handleAppLogsPassSubmit = () => {
+        if (!appLogsPass) {
+            setError("Elasticsearch password is required");
             return;
         }
-        if (!splunkHecToken) {
-            setError("Splunk HEC token is required");
+        setError(null);
+        dispatch({
+            type: "SET_APP_LOGS_CONFIG",
+            config: { appLogsElasticPassword: appLogsPass },
+        });
+        setSubStep("applogs-index");
+    };
+    const handleAppLogsIndexSubmit = () => {
+        const index = appLogsIndex || "rulebricks-app-logs";
+        setError(null);
+        dispatch({
+            type: "SET_APP_LOGS_CONFIG",
+            config: { appLogsElasticIndex: index },
+        });
+        advanceToNext("applogs-index");
+    };
+    // === Valkey Admin Ingress ===
+    const handleValkeyAdminUsernameSubmit = () => {
+        const username = valkeyAdminUsername.trim();
+        if (!username) {
+            setError("Username is required");
             return;
         }
-        try {
-            new URL(splunkUrl);
-        }
-        catch {
-            setError("Invalid URL format");
+        if (username.includes(":")) {
+            setError("Username cannot contain ':'");
             return;
         }
+        setValkeyAdminUsername(username);
         setError(null);
-        dispatch({
-            type: "SET_LOGGING_CONFIG",
-            config: {
-                loggingBucket: splunkHecToken,
-                loggingRegion: splunkUrl,
-            },
-        });
-        advanceToNext("logging-splunk-config");
+        setSubStep("valkey-admin-password");
     };
-    const handleElasticsearchConfigSubmit = () => {
-        if (!elasticsearchUrl) {
-            setError("Elasticsearch URL is required");
+    const handleValkeyAdminPasswordSubmit = () => {
+        // Empty means "use a generated secure value", matching the Supabase flow.
+        const effectivePassword = valkeyAdminPassword.trim() || defaultValkeyAdminPassword;
+        if (effectivePassword.length < 8) {
+            setError("Valkey Admin password must be at least 8 characters");
             return;
         }
         try {
-            new URL(elasticsearchUrl);
+            const htpasswdLine = generateHtpasswdLine(valkeyAdminUsername, effectivePassword);
+            dispatch({
+                type: "SET_EXTERNAL_SERVICES",
+                config: {
+                    valkeyAdminExposure: "ingress",
+                    valkeyAdminHostname: "",
+                    valkeyAdminBasicAuthUsers: [htpasswdLine],
+                },
+            });
         }
-        catch {
-            setError("Invalid URL format");
+        catch (err) {
+            setError(err instanceof Error ? err.message : "Unable to hash password");
             return;
         }
         setError(null);
-        // Store as JSON in bucket field for complex config
+        setSubStep("valkey-admin-allowed-ips");
+    };
+    const handleValkeyAdminAllowedIPsSubmit = () => {
+        const allowedIPs = valkeyAdminAllowedIPs
+            .split(",")
+            .map((value) => value.trim())
+            .filter(Boolean);
         dispatch({
-            type: "SET_LOGGING_CONFIG",
-            config: {
-                loggingBucket: JSON.stringify({
-                    url: elasticsearchUrl,
-                    user: elasticsearchUser,
-                    password: elasticsearchPass,
-                    index: elasticsearchIndex,
-                }),
-                loggingRegion: elasticsearchIndex,
-            },
+            type: "SET_EXTERNAL_SERVICES",
+            config: { valkeyAdminAllowedIPs: allowedIPs },
         });
-        advanceToNext("logging-elasticsearch-config");
+        setError(null);
+        advanceToNext("valkey-admin-allowed-ips");
     };
     const handleLokiConfigSubmit = () => {
         if (!lokiUrl) {
@@ -990,8 +1269,8 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
         dispatch({
             type: "SET_LOGGING_CONFIG",
             config: {
-                loggingBucket: lokiUrl,
-                loggingRegion: "",
+                loggingPlatformCredential: lokiUrl,
+                loggingPlatformDetail: "",
             },
         });
         advanceToNext("logging-loki-config");
@@ -1009,8 +1288,8 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
         dispatch({
             type: "SET_LOGGING_CONFIG",
             config: {
-                loggingBucket: newrelicLicenseKey,
-                loggingRegion: newrelicAccountId,
+                loggingPlatformCredential: newrelicLicenseKey,
+                loggingPlatformDetail: newrelicAccountId,
             },
         });
         advanceToNext("logging-newrelic-config");
@@ -1028,8 +1307,8 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
         dispatch({
             type: "SET_LOGGING_CONFIG",
             config: {
-                loggingBucket: axiomApiToken,
-                loggingRegion: axiomDataset,
+                loggingPlatformCredential: axiomApiToken,
+                loggingPlatformDetail: axiomDataset,
             },
         });
         advanceToNext("logging-axiom-config");
@@ -1122,41 +1401,76 @@ export function FeatureConfigStep({ onComplete, onBack, }) {
         });
         advanceToNext("email-template-change");
     };
-    // Build bucket items for selection (no create option - just existing buckets)
-    const getBucketItems = () => {
-        return availableBuckets.map((b) => ({ label: b, value: b }));
-    };
-    // Get regions based on logging sink (use dynamic regions if available)
-    const getLoggingRegions = () => {
-        if (availableRegions.length > 0) {
-            return availableRegions.map((r) => ({ label: r, value: r }));
-        }
-        const provider = sinkToProvider(loggingSink);
-        if (!provider)
-            return [];
-        return CLOUD_REGIONS[provider].map((r) => ({ label: r, value: r }));
-    };
     // If nothing to configure, don't render
     if (!needsAI &&
         !needsSSO &&
         !needsMonitoring &&
         !needsLogging &&
+        !needsTracing &&
+        !needsAppLogs &&
+        !needsValkeyAdmin &&
         !needsCustomEmails) {
         return null;
     }
+    // Shared list item renderer (matches the wizard's other select lists).
+    const selectItem = ({ isSelected, label, }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] }));
     // Progress summary
     const ProgressSummary = () => (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [state.openaiApiKey && (_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsx(Text, { color: "gray", children: " OpenAI API key configured" })] })), state.ssoProvider && (_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" SSO: ", state.ssoProvider] })] })), state.prometheusRemoteWriteUrl && (_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsx(Text, { color: "gray", children: " Metrics remote write configured" })] }))] }));
     return (_jsxs(BorderBox, { title: "Feature Configuration", children: [subStep === "openai-key" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "OpenAI API Key" }), _jsx(Text, { color: "gray", dimColor: true, children: "Required for AI-powered rule generation features" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: openaiKey, onChange: setOpenaiKey, onSubmit: handleOpenAIKeySubmit, placeholder: "sk-...", mask: "*" }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "Get your API key at: https://platform.openai.com/api-keys" }) })] })), subStep === "sso-provider" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "SSO Provider" }), _jsx(Text, { color: "gray", dimColor: true, children: "Select your identity provider" }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: SSO_PROVIDERS, onSelect: handleSsoProviderSelect, itemComponent: ({ isSelected, label }) => (_jsx(Text, { color: isSelected ? colors.accent : undefined, children: label })) }) }), _jsx(ProgressSummary, {})] })), subStep === "sso-url" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsxs(Text, { bold: true, children: [ssoProvider?.toUpperCase(), " Provider URL"] }), _jsxs(Text, { color: "gray", dimColor: true, children: [ssoProvider === "azure" &&
                                 "e.g., https://login.microsoftonline.com/your-tenant-id", ssoProvider === "okta" && "e.g., https://your-org.okta.com", ssoProvider === "keycloak" &&
                                 "e.g., https://keycloak.example.com/realms/your-realm", ssoProvider === "ory" &&
-                                "e.g., https://your-project.projects.oryapis.com", ssoProvider === "other" && "The base URL of your OIDC provider"] }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: ssoUrl, onChange: setSsoUrl, onSubmit: handleSsoUrlSubmit, placeholder: "https://..." }) }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Provider: ", ssoProvider] })] })] })), subStep === "sso-client-id" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "OAuth Client ID" }), _jsx(Text, { color: "gray", dimColor: true, children: "The client/application ID from your identity provider" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: ssoClientId, onChange: setSsoClientId, onSubmit: handleSsoClientIdSubmit, placeholder: "your-client-id" }) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Provider: ", ssoProvider] })] }), ssoUrl && (_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" URL: ", ssoUrl] })] }))] })] })), subStep === "sso-client-secret" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "OAuth Client Secret" }), _jsx(Text, { color: "gray", dimColor: true, children: "The client secret from your identity provider" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: ssoClientSecret, onChange: setSsoClientSecret, onSubmit: handleSsoClientSecretSubmit, placeholder: "your-client-secret", mask: "*" }) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Provider: ", ssoProvider] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsx(Text, { color: "gray", children: " Client ID configured" })] })] })] })), subStep === "monitoring-remote-write-ask" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Monitoring Destination" }), _jsx(Text, { color: "gray", dimColor: true, children: "Choose where Prometheus metrics should be viewed or sent." }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: MONITORING_DESTINATIONS, onSelect: handleRemoteWriteAsk, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-url" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Remote Write URL" }), _jsx(Text, { color: "gray", dimColor: true, children: "Prometheus remote_write endpoint URL" }), remoteWriteDestination === "azure-monitor" && (_jsx(Text, { color: "gray", dimColor: true, children: "Use the ingestion URL from your Azure Monitor workspace/Data Collection Rule." })), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteUrl, onChange: setRemoteWriteUrl, onSubmit: handleRemoteWriteUrlSubmit, placeholder: "https://metrics.example.com/api/v1/write" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-aws-region" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "AWS Managed Prometheus Region" }), _jsx(Text, { color: "gray", dimColor: true, children: "Region used for SigV4 signing." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteAwsRegion, onChange: setRemoteWriteAwsRegion, onSubmit: handleAwsRemoteWriteRegionSubmit, placeholder: "us-east-1" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-aws-role-arn" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Prometheus IRSA Role ARN" }), _jsx(Text, { color: "gray", dimColor: true, children: "Optional. If provided, the Prometheus service account will be annotated with this role." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteAwsRoleArn, onChange: setRemoteWriteAwsRoleArn, onSubmit: handleAwsRemoteWriteRoleArnSubmit, placeholder: "arn:aws:iam::123456789012:role/rulebricks-prometheus" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-destination" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Remote Write Destination" }), _jsx(Text, { color: "gray", dimColor: true, children: "Select the monitoring backend so required auth fields can be collected." }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: REMOTE_WRITE_DESTINATIONS, onSelect: handleRemoteWriteDestinationSelect, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-azure-auth" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Azure Monitor Authentication" }), _jsx(Text, { color: "gray", dimColor: true, children: "Azure Monitor managed Prometheus requires Azure AD authentication." }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Cloud: ", remoteWriteAzureCloud] }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: AZURE_REMOTE_WRITE_AUTH, onSelect: handleAzureRemoteWriteAuthSelect, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-generic-auth" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Generic Remote Write Authentication" }), _jsx(Text, { color: "gray", dimColor: true, children: "Choose the auth method required by the remote_write endpoint." }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: GENERIC_REMOTE_WRITE_AUTH, onSelect: handleGenericRemoteWriteAuthSelect, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-client-id" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Azure Client ID" }), _jsx(Text, { color: "gray", dimColor: true, children: "Use the managed identity, workload identity, or app registration client ID." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteClientId, onChange: setRemoteWriteClientId, onSubmit: handleRemoteWriteClientIdSubmit, placeholder: "00000000-0000-0000-0000-000000000000" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-tenant-id" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Azure Tenant ID" }), _jsx(Text, { color: "gray", dimColor: true, children: "Required for workload identity and OAuth client-secret auth." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteTenantId, onChange: setRemoteWriteTenantId, onSubmit: handleRemoteWriteTenantIdSubmit, placeholder: "00000000-0000-0000-0000-000000000000" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-secret-ref" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Client Secret Reference" }), _jsx(Text, { color: "gray", dimColor: true, children: "Existing Kubernetes Secret key in the format name:key." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteSecretRef, onChange: setRemoteWriteSecretRef, onSubmit: handleRemoteWriteSecretRefSubmit, placeholder: "azure-monitor-oauth:client-secret" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-username-secret-ref" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Basic Auth Username Reference" }), _jsx(Text, { color: "gray", dimColor: true, children: "Existing Kubernetes Secret key in the format name:key. For Grafana Cloud, this is the instance ID." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteUsernameSecretRef, onChange: setRemoteWriteUsernameSecretRef, onSubmit: handleRemoteWriteUsernameSecretRefSubmit, placeholder: "prometheus-remote-write:username" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-password-secret-ref" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Basic Auth Password Reference" }), _jsx(Text, { color: "gray", dimColor: true, children: "Existing Kubernetes Secret key in the format name:key. For Grafana Cloud, this is an API token." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWritePasswordSecretRef, onChange: setRemoteWritePasswordSecretRef, onSubmit: handleRemoteWritePasswordSecretRefSubmit, placeholder: "prometheus-remote-write:password" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-bearer-secret-ref" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Bearer Token Reference" }), _jsx(Text, { color: "gray", dimColor: true, children: "Existing Kubernetes Secret key in the format name:key." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteBearerSecretRef, onChange: setRemoteWriteBearerSecretRef, onSubmit: handleRemoteWriteBearerSecretRefSubmit, placeholder: "prometheus-remote-write:token" }) }), _jsx(ProgressSummary, {})] })), subStep === "logging-category" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "External Logging Destination" }), _jsx(Text, { color: "gray", dimColor: true, children: "Choose how you want to store decision logs (Console logging is always included)" }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: LOGGING_CATEGORIES, onSelect: handleLoggingCategorySelect, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) }), _jsx(ProgressSummary, {})] })), subStep === "logging-sink" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: loggingCategory === "cloud-storage"
-                            ? "Select Cloud Storage"
-                            : "Select Logging Platform" }), _jsx(Text, { color: "gray", dimColor: true, children: loggingCategory === "cloud-storage"
-                            ? "Store logs in cloud object storage"
-                            : "Send logs to a centralized logging platform" }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: loggingCategory === "cloud-storage"
-                                ? CLOUD_STORAGE_SINKS
-                                : LOGGING_PLATFORM_SINKS, onSelect: handleLoggingSinkSelect, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) }), state.infrastructureMode === "existing" &&
-                        loggingCategory === "cloud-storage" && (_jsx(Box, { marginTop: 1, borderStyle: "round", borderColor: "yellow", paddingX: 1, children: _jsx(Text, { color: "yellow", children: "Note: Cloud storage requires IRSA/Workload Identity in your cluster." }) })), _jsx(ProgressSummary, {})] })), subStep === "logging-region-loading" && (_jsx(Box, { flexDirection: "column", marginY: 1, children: _jsx(Spinner, { label: "Loading available regions..." }) })), subStep === "logging-region" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsxs(Text, { bold: true, children: [loggingSink === "s3" && "Select AWS Region", loggingSink === "azure-blob" && "Select Azure Region", loggingSink === "gcs" && "Select GCP Region"] }), _jsx(Text, { color: "gray", dimColor: true, children: "Select the region where logs will be stored" }), _jsx(Box, { marginTop: 1, height: 10, flexDirection: "column", overflowY: "hidden", children: _jsx(SelectInput, { items: getLoggingRegions(), onSelect: handleLoggingRegionSelect, limit: 8, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" ", "Sink: ", LOGGING_SINK_INFO[loggingSink]?.name] })] })] })), subStep === "logging-bucket-loading" && (_jsx(Box, { flexDirection: "column", marginY: 1, children: _jsx(Spinner, { label: `Loading buckets in ${loggingRegion}...` }) })), subStep === "logging-bucket" && (_jsx(BucketSelector, { loggingSink: loggingSink, loggingRegion: loggingRegion, availableBuckets: availableBuckets, isRefreshing: isRefreshing, onSelect: handleLoggingBucketSelect, onRefresh: refreshBuckets, colors: colors })), subStep === "logging-s3-role-arn" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Vector S3 IRSA Role ARN" }), _jsx(Text, { color: "gray", dimColor: true, children: "IAM role trusted by the Vector Kubernetes service account." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: s3RoleArn, onChange: setS3RoleArn, onSubmit: handleS3RoleArnSubmit, placeholder: "arn:aws:iam::123456789012:role/rulebricks-vector" }) }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.success, children: ["\u2713 S3 bucket: ", loggingBucket] }) })] })), subStep === "logging-azure-container" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Azure Blob Container" }), _jsx(Text, { color: "gray", dimColor: true, children: "Enter the container where Rulebricks decision logs should be written." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: azureBlobContainer, onChange: setAzureBlobContainer, onSubmit: handleAzureBlobContainerSubmit, placeholder: "rulebricks-logs" }) }), _jsx(Box, { marginTop: 1, flexDirection: "column", children: _jsxs(Text, { color: colors.success, children: ["\u2713 Storage account: ", loggingBucket] }) })] })), subStep === "logging-azure-auth" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Azure Blob Authentication" }), _jsx(Text, { color: "gray", dimColor: true, children: "Workload identity is recommended. Connection string Secret is a fallback for clusters without Azure Workload Identity." }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: AZURE_LOGGING_AUTH, onSelect: handleAzureBlobAuthSelect, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) })] })), subStep === "logging-azure-client-id" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Azure Managed Identity Client ID" }), _jsx(Text, { color: "gray", dimColor: true, children: "Client ID for the identity federated to Vector's service account." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: azureBlobClientId, onChange: setAzureBlobClientId, onSubmit: handleAzureBlobClientIdSubmit, placeholder: "00000000-0000-0000-0000-000000000000" }) })] })), subStep === "logging-azure-tenant-id" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Azure Tenant ID" }), _jsx(Text, { color: "gray", dimColor: true, children: "Tenant ID used by Azure Workload Identity." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: azureBlobTenantId, onChange: setAzureBlobTenantId, onSubmit: handleAzureBlobTenantIdSubmit, placeholder: "00000000-0000-0000-0000-000000000000" }) })] })), subStep === "logging-azure-connection-string-secret" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Azure Storage Connection String Secret" }), _jsx(Text, { color: "gray", dimColor: true, children: "Enter an existing Kubernetes Secret key in the format name:key." }), _jsx(Text, { color: "gray", dimColor: true, children: "The key should contain the Azure Storage connection string." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: azureBlobConnectionStringSecretRef, onChange: setAzureBlobConnectionStringSecretRef, onSubmit: handleAzureBlobConnectionStringSecretSubmit, placeholder: "azure-blob-logs:connection-string" }) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { color: colors.success, children: ["\u2713 Storage account: ", loggingBucket] }), _jsxs(Text, { color: colors.success, children: ["\u2713 Container: ", azureBlobContainer] })] })] })), subStep === "logging-gcp-service-account" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Google Service Account Email" }), _jsx(Text, { color: "gray", dimColor: true, children: "GSA bound to the Vector Kubernetes service account through GKE Workload Identity." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: gcpServiceAccountEmail, onChange: setGcpServiceAccountEmail, onSubmit: handleGcpServiceAccountSubmit, placeholder: "rulebricks-vector@project.iam.gserviceaccount.com" }) }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.success, children: ["\u2713 GCS bucket: ", loggingBucket] }) })] })), subStep === "logging-datadog-config" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Datadog Configuration" }), _jsx(Text, { color: "gray", dimColor: true, children: "Configure Datadog Logs integration" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "API Key:" }), _jsx(Box, { children: _jsx(TextInput, { value: datadogApiKey, onChange: setDatadogApiKey, placeholder: "your-api-key", mask: "*" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Datadog Site:" }), _jsx(SelectInput, { items: DATADOG_SITES, initialIndex: DATADOG_SITES.findIndex((s) => s.value === datadogSite), onSelect: (item) => setDatadogSite(item.value), indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "Press Enter after selecting site to continue" }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: datadogApiKey ? colors.accent : colors.muted, bold: !!datadogApiKey, children: datadogApiKey
+                                "e.g., https://your-project.projects.oryapis.com", ssoProvider === "other" && "The base URL of your OIDC provider"] }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: ssoUrl, onChange: setSsoUrl, onSubmit: handleSsoUrlSubmit, placeholder: "https://..." }) }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Provider: ", ssoProvider] })] })] })), subStep === "sso-client-id" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "OAuth Client ID" }), _jsx(Text, { color: "gray", dimColor: true, children: "The client/application ID from your identity provider" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: ssoClientId, onChange: setSsoClientId, onSubmit: handleSsoClientIdSubmit, placeholder: "your-client-id" }) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Provider: ", ssoProvider] })] }), ssoUrl && (_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" URL: ", ssoUrl] })] }))] })] })), subStep === "sso-client-secret" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "OAuth Client Secret" }), _jsx(Text, { color: "gray", dimColor: true, children: "The client secret from your identity provider" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: ssoClientSecret, onChange: setSsoClientSecret, onSubmit: handleSsoClientSecretSubmit, placeholder: "your-client-secret", mask: "*" }) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Provider: ", ssoProvider] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsx(Text, { color: "gray", children: " Client ID configured" })] })] })] })), subStep === "monitoring-remote-write-url" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Remote Write URL" }), _jsx(Text, { color: "gray", dimColor: true, children: "Prometheus remote_write endpoint URL" }), remoteWriteDestination === "azure-monitor" && (_jsx(Text, { color: "gray", dimColor: true, children: "Use the ingestion URL from your Azure Monitor workspace/Data Collection Rule." })), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteUrl, onChange: setRemoteWriteUrl, onSubmit: handleRemoteWriteUrlSubmit, placeholder: "https://metrics.example.com/api/v1/write" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-aws-region-loading" && (_jsx(Box, { flexDirection: "column", marginY: 1, children: _jsx(Spinner, { label: "Loading AWS regions..." }) })), subStep === "monitoring-aws-region" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "AWS Managed Prometheus Region" }), _jsx(Text, { color: "gray", dimColor: true, children: "Region of your AMP workspace (defaults to your cluster region)." }), _jsx(Box, { marginTop: 1, height: 10, flexDirection: "column", overflowY: "hidden", children: _jsx(SelectInput, { items: rwRegions.map((r) => ({ label: r, value: r })), onSelect: handleAwsRegionSelect, limit: 8, initialIndex: Math.max(0, rwRegions.indexOf(remoteWriteAwsRegion)), indicatorComponent: () => null, itemComponent: selectItem }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-aws-workspace-loading" && (_jsx(Box, { flexDirection: "column", marginY: 1, children: _jsx(Spinner, { label: "Discovering AMP workspaces..." }) })), subStep === "monitoring-aws-workspace" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Select AMP Workspace" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Choose the workspace your Rulebricks role can write to. cluster-setup creates ", `${state.clusterName || "<cluster>"}-amp`, " and grants aps:RemoteWrite on it."] }), rwTargets.length === 0 && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "yellow", children: ["None found in ", remoteWriteAwsRegion, ". Refresh after creating one, or enter a URL manually."] }) })), (() => {
+                        const recommendedPrefix = `${state.clusterName || ""}-amp`.toLowerCase();
+                        const isRec = (name) => recommendedPrefix !== "-amp" &&
+                            name.toLowerCase().startsWith(recommendedPrefix);
+                        const sorted = [...rwTargets].sort((a, b) => {
+                            return ((isRec(a.name) ? 0 : 1) - (isRec(b.name) ? 0 : 1) ||
+                                a.name.localeCompare(b.name));
+                        });
+                        return (_jsx(Box, { marginTop: 1, height: 10, flexDirection: "column", overflowY: "hidden", children: _jsx(SelectInput, { items: [
+                                    ...sorted.map((t) => ({
+                                        label: isRec(t.name) ? `${t.name}  - recommended` : t.name,
+                                        value: t.url,
+                                    })),
+                                    { label: "↻ Refresh list", value: REFRESH },
+                                    { label: "Enter URL manually…", value: MANUAL },
+                                ], onSelect: handleAwsWorkspaceSelect, limit: 8, indicatorComponent: () => null, itemComponent: selectItem }) }));
+                    })(), _jsx(ProgressSummary, {})] })), subStep === "monitoring-azure-target-loading" && (_jsx(Box, { flexDirection: "column", marginY: 1, children: _jsx(Spinner, { label: "Discovering Azure Monitor data collection rules..." }) })), subStep === "monitoring-azure-target" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Select Azure Monitor target" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Choose the Data Collection Rule your Rulebricks identity can publish to. cluster-setup grants that on ", `${state.clusterName || "<cluster>"}-dcr`, "; the workspace's auto-created ", `${state.clusterName || "<cluster>"}-amw`, " rule usually lacks the publish role."] }), rwTargets.length === 0 && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "yellow", children: "None found. Refresh after creating a Prometheus DCR/DCE, or enter a URL manually." }) })), (() => {
+                        // Recommend the cluster-setup DCR (<cluster>-dcr) -- the one granted
+                        // Monitoring Metrics Publisher -- and list it first.
+                        const recommendedName = `${state.clusterName || ""}-dcr`.toLowerCase();
+                        const sorted = [...rwTargets].sort((a, b) => {
+                            const aRec = a.name.toLowerCase() === recommendedName ? 0 : 1;
+                            const bRec = b.name.toLowerCase() === recommendedName ? 0 : 1;
+                            return aRec - bRec || a.name.localeCompare(b.name);
+                        });
+                        return (_jsx(Box, { marginTop: 1, height: 10, flexDirection: "column", overflowY: "hidden", children: _jsx(SelectInput, { items: [
+                                    ...sorted.map((t) => ({
+                                        label: t.name.toLowerCase() === recommendedName
+                                            ? `${t.name}  - recommended`
+                                            : t.name,
+                                        value: t.url,
+                                    })),
+                                    { label: "↻ Refresh list", value: REFRESH },
+                                    { label: "Enter URL manually…", value: MANUAL },
+                                ], onSelect: handleAzureTargetSelect, limit: 8, indicatorComponent: () => null, itemComponent: selectItem }) }));
+                    })(), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-destination" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Metrics Export Destination" }), _jsx(Text, { color: "gray", dimColor: true, children: "Select the backend to send Prometheus metrics to so required auth fields can be collected." }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: remoteWriteDestinations, onSelect: handleRemoteWriteDestinationSelect, indicatorComponent: () => null, itemComponent: selectItem }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-azure-auth" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Azure Monitor Authentication" }), _jsx(Text, { color: "gray", dimColor: true, children: "Azure Monitor managed Prometheus requires Azure AD authentication." }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Cloud: ", remoteWriteAzureCloud] }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: AZURE_REMOTE_WRITE_AUTH, onSelect: handleAzureRemoteWriteAuthSelect, indicatorComponent: () => null, itemComponent: selectItem }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-generic-auth" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Generic Remote Write Authentication" }), _jsx(Text, { color: "gray", dimColor: true, children: "Choose the auth method required by the remote_write endpoint." }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: GENERIC_REMOTE_WRITE_AUTH, onSelect: handleGenericRemoteWriteAuthSelect, indicatorComponent: () => null, itemComponent: selectItem }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-azure-identity-loading" && (_jsx(Box, { flexDirection: "column", marginY: 1, children: _jsx(Spinner, { label: "Loading managed identities..." }) })), subStep === "monitoring-remote-write-client-id" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Azure Identity" }), _jsx(Text, { color: "gray", dimColor: true, children: "Select the managed/workload identity for remote_write, or enter a client ID manually." }), _jsx(Box, { marginTop: 1, height: 10, flexDirection: "column", overflowY: "hidden", children: _jsx(SelectInput, { items: [
+                                ...rwIdentities.map((i) => ({
+                                    label: `${i.name} (${i.clientId})`,
+                                    value: i.clientId,
+                                })),
+                                { label: "Enter manually…", value: MANUAL },
+                            ], onSelect: handleRemoteWriteClientIdSelect, limit: 8, initialIndex: Math.max(0, findClusterSetupDefaultIndex(rwIdentities.map((i) => i.name), "metrics-identity", { provider: "azure", clusterName: state.clusterName })), indicatorComponent: () => null, itemComponent: selectItem }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-client-id-manual" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Azure Client ID" }), _jsx(Text, { color: "gray", dimColor: true, children: "Use the managed identity, workload identity, or app registration client ID." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteClientId, onChange: setRemoteWriteClientId, onSubmit: handleRemoteWriteClientIdSubmit, placeholder: "00000000-0000-0000-0000-000000000000" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-tenant-id" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Azure Tenant ID" }), _jsx(Text, { color: "gray", dimColor: true, children: rwTenantAutoDetected
+                            ? "Auto-detected from your Azure CLI session - edit if needed."
+                            : "Required for workload identity and OAuth client-secret auth." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteTenantId, onChange: setRemoteWriteTenantId, onSubmit: handleRemoteWriteTenantIdSubmit, placeholder: "00000000-0000-0000-0000-000000000000" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-secret-ref" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Client Secret Reference" }), _jsx(Text, { color: "gray", dimColor: true, children: "Existing Kubernetes Secret key in the format name:key." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteSecretRef, onChange: setRemoteWriteSecretRef, onSubmit: handleRemoteWriteSecretRefSubmit, placeholder: "azure-monitor-oauth:client-secret" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-username-secret-ref" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Basic Auth Username Reference" }), _jsx(Text, { color: "gray", dimColor: true, children: "Existing Kubernetes Secret key in the format name:key. For Grafana Cloud, this is the instance ID." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteUsernameSecretRef, onChange: setRemoteWriteUsernameSecretRef, onSubmit: handleRemoteWriteUsernameSecretRefSubmit, placeholder: "prometheus-remote-write:username" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-password-secret-ref" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Basic Auth Password Reference" }), _jsx(Text, { color: "gray", dimColor: true, children: "Existing Kubernetes Secret key in the format name:key. For Grafana Cloud, this is an API token." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWritePasswordSecretRef, onChange: setRemoteWritePasswordSecretRef, onSubmit: handleRemoteWritePasswordSecretRefSubmit, placeholder: "prometheus-remote-write:password" }) }), _jsx(ProgressSummary, {})] })), subStep === "monitoring-remote-write-bearer-secret-ref" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Bearer Token Reference" }), _jsx(Text, { color: "gray", dimColor: true, children: "Existing Kubernetes Secret key in the format name:key." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: remoteWriteBearerSecretRef, onChange: setRemoteWriteBearerSecretRef, onSubmit: handleRemoteWriteBearerSecretRefSubmit, placeholder: "prometheus-remote-write:token" }) }), _jsx(ProgressSummary, {})] })), subStep === "logging-sink" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Additional Log Forwarding" }), _jsx(Text, { color: "gray", dimColor: true, children: "Optional: forward a copy of logs to a third-party logging platform. Decision logs are always archived to your object storage (configured in the Object Storage step); this is an additional destination." }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: LOGGING_PLATFORM_SINKS, onSelect: handleLoggingSinkSelect, indicatorComponent: () => null, itemComponent: selectItem }) }), _jsx(ProgressSummary, {})] })), subStep === "logging-datadog-config" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Datadog Configuration" }), _jsx(Text, { color: "gray", dimColor: true, children: "Configure Datadog Logs integration" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "API Key:" }), _jsx(Box, { children: _jsx(TextInput, { value: datadogApiKey, onChange: setDatadogApiKey, placeholder: "your-api-key", mask: "*" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Datadog Site:" }), _jsx(SelectInput, { items: DATADOG_SITES, initialIndex: DATADOG_SITES.findIndex((s) => s.value === datadogSite), onSelect: (item) => setDatadogSite(item.value), indicatorComponent: () => null, itemComponent: selectItem })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "Press Enter after selecting site to continue" }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: datadogApiKey ? colors.accent : colors.muted, bold: !!datadogApiKey, children: datadogApiKey
                                 ? "→ Press Enter to continue"
-                                : "Enter API key to continue" }) }), datadogApiKey && (_jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: "", onChange: () => { }, onSubmit: handleDatadogConfigSubmit, placeholder: "" }) }))] })), subStep === "logging-splunk-config" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Splunk HEC Configuration" }), _jsx(Text, { color: "gray", dimColor: true, children: "Configure Splunk HTTP Event Collector" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "HEC URL:" }), _jsx(Box, { children: _jsx(TextInput, { value: splunkUrl, onChange: setSplunkUrl, placeholder: "https://splunk.example.com:8088" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "HEC Token:" }), _jsx(Box, { children: _jsx(TextInput, { value: splunkHecToken, onChange: setSplunkHecToken, onSubmit: handleSplunkConfigSubmit, placeholder: "your-hec-token", mask: "*" }) })] })] })), subStep === "logging-elasticsearch-config" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Elasticsearch Configuration" }), _jsx(Text, { color: "gray", dimColor: true, children: "Configure Elasticsearch logging destination" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Elasticsearch URL:" }), _jsx(Box, { children: _jsx(TextInput, { value: elasticsearchUrl, onChange: setElasticsearchUrl, placeholder: "https://elasticsearch.example.com:9200" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Username (optional):" }), _jsx(Box, { children: _jsx(TextInput, { value: elasticsearchUser, onChange: setElasticsearchUser, placeholder: "elastic" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Password (optional):" }), _jsx(Box, { children: _jsx(TextInput, { value: elasticsearchPass, onChange: setElasticsearchPass, placeholder: "", mask: "*" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Index name:" }), _jsx(Box, { children: _jsx(TextInput, { value: elasticsearchIndex, onChange: setElasticsearchIndex, onSubmit: handleElasticsearchConfigSubmit, placeholder: "rulebricks-logs" }) })] })] })), subStep === "logging-loki-config" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Grafana Loki Configuration" }), _jsx(Text, { color: "gray", dimColor: true, children: "Configure Loki logging destination" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Loki URL:" }), _jsx(Text, { color: "gray", dimColor: true, children: "Include /loki/api/v1/push endpoint" }), _jsx(Box, { children: _jsx(TextInput, { value: lokiUrl, onChange: setLokiUrl, onSubmit: handleLokiConfigSubmit, placeholder: "https://loki.example.com/loki/api/v1/push" }) })] })] })), subStep === "logging-newrelic-config" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "New Relic Configuration" }), _jsx(Text, { color: "gray", dimColor: true, children: "Configure New Relic Logs integration" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "License Key:" }), _jsx(Box, { children: _jsx(TextInput, { value: newrelicLicenseKey, onChange: setNewrelicLicenseKey, placeholder: "your-license-key", mask: "*" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Account ID:" }), _jsx(Box, { children: _jsx(TextInput, { value: newrelicAccountId, onChange: setNewrelicAccountId, onSubmit: handleNewrelicConfigSubmit, placeholder: "1234567" }) })] })] })), subStep === "logging-axiom-config" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Axiom Configuration" }), _jsx(Text, { color: "gray", dimColor: true, children: "Configure Axiom logging destination" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "API Token:" }), _jsx(Box, { children: _jsx(TextInput, { value: axiomApiToken, onChange: setAxiomApiToken, placeholder: "xaat-...", mask: "*" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Dataset:" }), _jsx(Box, { children: _jsx(TextInput, { value: axiomDataset, onChange: setAxiomDataset, onSubmit: handleAxiomConfigSubmit, placeholder: "rulebricks" }) })] })] })), subStep === "email-subject-invite" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates" }), _jsx(Text, { color: "gray", dimColor: true, children: "Customize Supabase auth email subjects and templates." }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "First, let's customize the subject lines. Press Enter to use defaults." }) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Invite Email Subject:" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Default: \"", DEFAULT_EMAIL_SUBJECTS.invite, "\""] }), _jsx(Box, { children: _jsx(TextInput, { value: emailSubjectInvite, onChange: setEmailSubjectInvite, onSubmit: handleEmailSubjectInviteSubmit, placeholder: DEFAULT_EMAIL_SUBJECTS.invite }) })] })] })), subStep === "email-subject-confirm" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Subject Lines" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Confirmation Email Subject:" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Default: \"", DEFAULT_EMAIL_SUBJECTS.confirmation, "\""] }), _jsx(Box, { children: _jsx(TextInput, { value: emailSubjectConfirm, onChange: setEmailSubjectConfirm, onSubmit: handleEmailSubjectConfirmSubmit, placeholder: DEFAULT_EMAIL_SUBJECTS.confirmation }) })] }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Invite: ", emailSubjectInvite] })] })] })), subStep === "email-subject-recovery" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Subject Lines" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Password Recovery Email Subject:" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Default: \"", DEFAULT_EMAIL_SUBJECTS.recovery, "\""] }), _jsx(Box, { children: _jsx(TextInput, { value: emailSubjectRecovery, onChange: setEmailSubjectRecovery, onSubmit: handleEmailSubjectRecoverySubmit, placeholder: DEFAULT_EMAIL_SUBJECTS.recovery }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Invite: ", emailSubjectInvite] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Confirmation: ", emailSubjectConfirm] })] })] })] })), subStep === "email-subject-change" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Subject Lines" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Email Change Subject:" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Default: \"", DEFAULT_EMAIL_SUBJECTS.emailChange, "\""] }), _jsx(Box, { children: _jsx(TextInput, { value: emailSubjectChange, onChange: setEmailSubjectChange, onSubmit: handleEmailSubjectChangeSubmit, placeholder: DEFAULT_EMAIL_SUBJECTS.emailChange }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Invite: ", emailSubjectInvite] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Confirmation: ", emailSubjectConfirm] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Recovery: ", emailSubjectRecovery] })] })] })] })), subStep === "email-template-invite" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Template URLs" }), _jsx(Text, { color: "gray", dimColor: true, children: "Provide URLs to your custom HTML email templates." }), _jsx(Text, { color: "gray", dimColor: true, children: "Templates must be publicly accessible (S3, GCS, or any HTTPS URL)." }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Invite Template URL:" }), _jsx(Box, { children: _jsx(TextInput, { value: emailTemplateInvite, onChange: setEmailTemplateInvite, onSubmit: handleEmailTemplateInviteSubmit, placeholder: "https://bucket.s3.amazonaws.com/templates/invite.html" }) })] }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsx(Text, { color: "gray", children: " All subject lines configured" })] })] })), subStep === "email-template-confirm" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Template URLs" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Confirmation Template URL:" }), _jsx(Box, { children: _jsx(TextInput, { value: emailTemplateConfirm, onChange: setEmailTemplateConfirm, onSubmit: handleEmailTemplateConfirmSubmit, placeholder: "https://bucket.s3.amazonaws.com/templates/verify.html" }) })] }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Invite: ", emailTemplateInvite] })] })] })), subStep === "email-template-recovery" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Template URLs" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Recovery Template URL:" }), _jsx(Box, { children: _jsx(TextInput, { value: emailTemplateRecovery, onChange: setEmailTemplateRecovery, onSubmit: handleEmailTemplateRecoverySubmit, placeholder: "https://bucket.s3.amazonaws.com/templates/password_change.html" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Invite: ", emailTemplateInvite] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Confirmation: ", emailTemplateConfirm] })] })] })] })), subStep === "email-template-change" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Template URLs" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Email Change Template URL:" }), _jsx(Box, { children: _jsx(TextInput, { value: emailTemplateChange, onChange: setEmailTemplateChange, onSubmit: handleEmailTemplateChangeSubmit, placeholder: "https://bucket.s3.amazonaws.com/templates/email_change.html" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Invite: ", emailTemplateInvite] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Confirmation: ", emailTemplateConfirm] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Recovery: ", emailTemplateRecovery] })] })] })] })), error && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "red", children: ["\u2717 ", error] }) })), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "Esc to go back \u2022 Enter to continue" }) })] }));
+                                : "Enter API key to continue" }) }), datadogApiKey && (_jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: "", onChange: () => { }, onSubmit: handleDatadogConfigSubmit, placeholder: "" }) }))] })), subStep === "logging-splunk-config" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Splunk HEC Configuration" }), _jsx(Text, { color: "gray", dimColor: true, children: "Configure Splunk HTTP Event Collector" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "HEC URL:" }), _jsx(Box, { children: _jsx(TextInput, { value: splunkUrl, onChange: setSplunkUrl, placeholder: "https://splunk.example.com:8088" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "HEC Token:" }), _jsx(Box, { children: _jsx(TextInput, { value: splunkHecToken, onChange: setSplunkHecToken, onSubmit: handleSplunkConfigSubmit, placeholder: "your-hec-token", mask: "*" }) })] })] })), subStep === "logging-elasticsearch-config" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Elasticsearch Configuration" }), _jsx(Text, { color: "gray", dimColor: true, children: "Configure Elasticsearch logging destination" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Elasticsearch URL:" }), _jsx(Box, { children: _jsx(TextInput, { value: elasticsearchUrl, onChange: setElasticsearchUrl, placeholder: "https://elasticsearch.example.com:9200" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Username (optional):" }), _jsx(Box, { children: _jsx(TextInput, { value: elasticsearchUser, onChange: setElasticsearchUser, placeholder: "elastic" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Password (optional):" }), _jsx(Box, { children: _jsx(TextInput, { value: elasticsearchPass, onChange: setElasticsearchPass, placeholder: "", mask: "*" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Index name:" }), _jsx(Box, { children: _jsx(TextInput, { value: elasticsearchIndex, onChange: setElasticsearchIndex, onSubmit: handleElasticsearchConfigSubmit, placeholder: "rulebricks-logs" }) })] })] })), subStep === "logging-loki-config" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Grafana Loki Configuration" }), _jsx(Text, { color: "gray", dimColor: true, children: "Configure Loki logging destination" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Loki URL:" }), _jsx(Text, { color: "gray", dimColor: true, children: "Include /loki/api/v1/push endpoint" }), _jsx(Box, { children: _jsx(TextInput, { value: lokiUrl, onChange: setLokiUrl, onSubmit: handleLokiConfigSubmit, placeholder: "https://loki.example.com/loki/api/v1/push" }) })] })] })), subStep === "logging-newrelic-config" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "New Relic Configuration" }), _jsx(Text, { color: "gray", dimColor: true, children: "Configure New Relic Logs integration" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "License Key:" }), _jsx(Box, { children: _jsx(TextInput, { value: newrelicLicenseKey, onChange: setNewrelicLicenseKey, placeholder: "your-license-key", mask: "*" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Account ID:" }), _jsx(Box, { children: _jsx(TextInput, { value: newrelicAccountId, onChange: setNewrelicAccountId, onSubmit: handleNewrelicConfigSubmit, placeholder: "1234567" }) })] })] })), subStep === "logging-axiom-config" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Axiom Configuration" }), _jsx(Text, { color: "gray", dimColor: true, children: "Configure Axiom logging destination" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "API Token:" }), _jsx(Box, { children: _jsx(TextInput, { value: axiomApiToken, onChange: setAxiomApiToken, placeholder: "xaat-...", mask: "*" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Dataset:" }), _jsx(Box, { children: _jsx(TextInput, { value: axiomDataset, onChange: setAxiomDataset, onSubmit: handleAxiomConfigSubmit, placeholder: "rulebricks" }) })] })] })), subStep === "email-subject-invite" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates" }), _jsx(Text, { color: "gray", dimColor: true, children: "Customize Supabase auth email subjects and templates." }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "First, let's customize the subject lines. Press Enter to use defaults." }) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Invite Email Subject:" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Default: \"", DEFAULT_EMAIL_SUBJECTS.invite, "\""] }), _jsx(Box, { children: _jsx(TextInput, { value: emailSubjectInvite, onChange: setEmailSubjectInvite, onSubmit: handleEmailSubjectInviteSubmit, placeholder: DEFAULT_EMAIL_SUBJECTS.invite }) })] })] })), subStep === "email-subject-confirm" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Subject Lines" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Confirmation Email Subject:" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Default: \"", DEFAULT_EMAIL_SUBJECTS.confirmation, "\""] }), _jsx(Box, { children: _jsx(TextInput, { value: emailSubjectConfirm, onChange: setEmailSubjectConfirm, onSubmit: handleEmailSubjectConfirmSubmit, placeholder: DEFAULT_EMAIL_SUBJECTS.confirmation }) })] }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Invite: ", emailSubjectInvite] })] })] })), subStep === "email-subject-recovery" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Subject Lines" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Password Recovery Email Subject:" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Default: \"", DEFAULT_EMAIL_SUBJECTS.recovery, "\""] }), _jsx(Box, { children: _jsx(TextInput, { value: emailSubjectRecovery, onChange: setEmailSubjectRecovery, onSubmit: handleEmailSubjectRecoverySubmit, placeholder: DEFAULT_EMAIL_SUBJECTS.recovery }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Invite: ", emailSubjectInvite] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Confirmation: ", emailSubjectConfirm] })] })] })] })), subStep === "email-subject-change" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Subject Lines" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Email Change Subject:" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Default: \"", DEFAULT_EMAIL_SUBJECTS.emailChange, "\""] }), _jsx(Box, { children: _jsx(TextInput, { value: emailSubjectChange, onChange: setEmailSubjectChange, onSubmit: handleEmailSubjectChangeSubmit, placeholder: DEFAULT_EMAIL_SUBJECTS.emailChange }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Invite: ", emailSubjectInvite] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Confirmation: ", emailSubjectConfirm] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Recovery: ", emailSubjectRecovery] })] })] })] })), subStep === "email-template-invite" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Template URLs" }), _jsx(Text, { color: "gray", dimColor: true, children: "Provide URLs to your custom HTML email templates." }), _jsx(Text, { color: "gray", dimColor: true, children: "Templates must be publicly accessible (S3, GCS, or any HTTPS URL)." }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Invite Template URL:" }), _jsx(Box, { children: _jsx(TextInput, { value: emailTemplateInvite, onChange: setEmailTemplateInvite, onSubmit: handleEmailTemplateInviteSubmit, placeholder: "https://bucket.s3.amazonaws.com/templates/invite.html" }) })] }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsx(Text, { color: "gray", children: " All subject lines configured" })] })] })), subStep === "email-template-confirm" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Template URLs" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Confirmation Template URL:" }), _jsx(Box, { children: _jsx(TextInput, { value: emailTemplateConfirm, onChange: setEmailTemplateConfirm, onSubmit: handleEmailTemplateConfirmSubmit, placeholder: "https://bucket.s3.amazonaws.com/templates/verify.html" }) })] }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Invite: ", emailTemplateInvite] })] })] })), subStep === "email-template-recovery" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Template URLs" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Recovery Template URL:" }), _jsx(Box, { children: _jsx(TextInput, { value: emailTemplateRecovery, onChange: setEmailTemplateRecovery, onSubmit: handleEmailTemplateRecoverySubmit, placeholder: "https://bucket.s3.amazonaws.com/templates/password_change.html" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Invite: ", emailTemplateInvite] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Confirmation: ", emailTemplateConfirm] })] })] })] })), subStep === "email-template-change" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Custom Email Templates - Template URLs" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { children: "Email Change Template URL:" }), _jsx(Box, { children: _jsx(TextInput, { value: emailTemplateChange, onChange: setEmailTemplateChange, onSubmit: handleEmailTemplateChangeSubmit, placeholder: "https://bucket.s3.amazonaws.com/templates/email_change.html" }) })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Invite: ", emailTemplateInvite] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Confirmation: ", emailTemplateConfirm] })] }), _jsxs(Box, { children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" Recovery: ", emailTemplateRecovery] })] })] })] })), subStep === "tracing-destination" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Distributed Tracing - destination" }), _jsx(Text, { color: "gray", dimColor: true, children: "Where the in-cluster OpenTelemetry Collector exports traces. Works on AWS and Azure." }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: [
+                                { label: "Elastic APM (Elastic Cloud / self-hosted)", value: "elastic" },
+                                { label: "Generic OTLP/HTTP (Tempo, Honeycomb, Jaeger, ...)", value: "otlp" },
+                                { label: "Azure Monitor / Application Insights", value: "azure-monitor" },
+                            ], initialIndex: Math.max(0, ["elastic", "otlp", "azure-monitor"].indexOf(tracingDestination)), onSelect: handleTracingDestinationSelect }) })] })), subStep === "tracing-otlp-endpoint" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Distributed Tracing - OTLP/HTTP endpoint" }), _jsx(Text, { color: "gray", dimColor: true, children: "Full OTLP/HTTP traces endpoint of your backend (e.g. a Grafana Cloud OTLP gateway or Honeycomb)." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: tracingOtlpEndpoint, onChange: setTracingOtlpEndpoint, onSubmit: handleTracingOtlpEndpointSubmit, placeholder: "https://otlp-gateway.example.com/otlp" }) })] })), subStep === "tracing-otlp-auth" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Distributed Tracing - OTLP authentication" }), _jsx(Text, { color: "gray", dimColor: true, children: "How the collector authenticates to the OTLP endpoint. (For a custom header name, configure tracing in your config file.)" }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: [
+                                { label: "None", value: "none" },
+                                { label: "Bearer token (Authorization: Bearer)", value: "bearer" },
+                                { label: "API key (Authorization: ApiKey)", value: "api-key" },
+                            ], initialIndex: Math.max(0, ["none", "bearer", "api-key"].indexOf(tracingOtlpAuthMode)), onSelect: handleTracingOtlpAuthSelect }) })] })), subStep === "tracing-otlp-cred" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Distributed Tracing - OTLP credential" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["Sent as Authorization:", " ", tracingOtlpAuthMode === "api-key" ? "ApiKey" : "Bearer", " <value>."] }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: tracingOtlpToken, onChange: setTracingOtlpToken, onSubmit: handleTracingOtlpCredSubmit, placeholder: "otlp-credential", mask: "*" }) })] })), subStep === "tracing-azure-connection" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Distributed Tracing - Azure Monitor connection string" }), _jsx(Text, { color: "gray", dimColor: true, children: "Application Insights connection string (carries the ingestion endpoint + instrumentation key)." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: tracingAzureConnectionString, onChange: setTracingAzureConnectionString, onSubmit: handleTracingAzureConnectionSubmit, placeholder: "InstrumentationKey=...;IngestionEndpoint=https://...", mask: "*" }) })] })), subStep === "tracing-endpoint" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Distributed Tracing - Elastic APM endpoint" }), _jsx(Text, { color: "gray", dimColor: true, children: "OTLP endpoint of your (customer-managed) Elastic APM. The in-cluster OpenTelemetry Collector forwards traces here." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: tracingEndpoint, onChange: setTracingEndpoint, onSubmit: handleTracingEndpointSubmit, placeholder: "https://<deployment>.apm.<region>.cloud.es.io:443" }) })] })), subStep === "tracing-token" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Distributed Tracing - Elastic APM secret token" }), _jsx(Text, { color: "gray", dimColor: true, children: "Sent as Authorization: Bearer <token> to Elastic APM. (For API key auth, configure tracing in your config file instead.)" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: tracingToken, onChange: setTracingToken, onSubmit: handleTracingTokenSubmit, placeholder: "elastic-apm-secret-token", mask: "*" }) })] })), subStep === "applogs-endpoint" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Application Log Shipping - BYO Elasticsearch endpoint" }), _jsx(Text, { color: "gray", dimColor: true, children: "Optional BYO sink via Vector. For AWS/Azure native log collection, enable the provider's cluster logging agent instead. Decision logs stay in object storage." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: appLogsEndpoint, onChange: setAppLogsEndpoint, onSubmit: handleAppLogsEndpointSubmit, placeholder: "https://<host>.es.<region>.cloud.es.io:9243" }) })] })), subStep === "applogs-user" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Application Log Shipping - Elasticsearch username" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: appLogsUser, onChange: setAppLogsUser, onSubmit: handleAppLogsUserSubmit, placeholder: "elastic" }) })] })), subStep === "applogs-pass" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Application Log Shipping - Elasticsearch password" }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: appLogsPass, onChange: setAppLogsPass, onSubmit: handleAppLogsPassSubmit, placeholder: "password", mask: "*" }) })] })), subStep === "applogs-index" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Application Log Shipping - index name" }), _jsx(Text, { color: "gray", dimColor: true, children: "Elasticsearch index (data stream) for app logs." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: appLogsIndex, onChange: setAppLogsIndex, onSubmit: handleAppLogsIndexSubmit, placeholder: "rulebricks-app-logs" }) })] })), subStep === "valkey-admin-username" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Valkey Admin BasicAuth Username" }), _jsxs(Text, { color: "gray", dimColor: true, children: ["This username protects https://valkey.", state.domain, "."] }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: valkeyAdminUsername, onChange: setValkeyAdminUsername, onSubmit: handleValkeyAdminUsernameSubmit, placeholder: "admin" }) })] })), subStep === "valkey-admin-password" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Valkey Admin BasicAuth Password" }), _jsx(Text, { color: "gray", dimColor: true, children: "Password for accessing the Valkey Admin console. Leave empty to generate a secure value. The CLI stores only an htpasswd bcrypt hash in generated Helm values." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: valkeyAdminPassword, onChange: setValkeyAdminPassword, onSubmit: handleValkeyAdminPasswordSubmit, placeholder: "Leave empty to generate a secure value", mask: "*" }) })] })), subStep === "valkey-admin-allowed-ips" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { bold: true, children: "Valkey Admin Allowed IPs" }), _jsx(Text, { color: "gray", dimColor: true, children: "Optional comma-separated CIDR allowlist. Leave blank to allow any IP that can reach Traefik." }), _jsx(Box, { marginTop: 1, children: _jsx(TextInput, { value: valkeyAdminAllowedIPs, onChange: setValkeyAdminAllowedIPs, onSubmit: handleValkeyAdminAllowedIPsSubmit, placeholder: "203.0.113.0/24, 198.51.100.10/32" }) })] })), error && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "red", children: ["\u2717 ", error] }) })), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "Esc to go back \u2022 Enter to continue" }) })] }));
 }