@sembix/cli 0.1.0

package/dist/prompts/environment-setup.js

@@ -0,0 +1,689 @@
+import { input, select, confirm } from '@inquirer/prompts';
+import { awsRegions, awsAccountIdSchema, iamRoleArnSchema, acmCertArnSchema, route53ZoneIdSchema } from '../types.js';
+import * as ui from '../utils/ui.js';
+import chalk from 'chalk';
+import { promptIfMissing } from './prompt-helpers.js';
+/**
+ * Helper function to display information before a prompt
+ */
+function explainField(title, description, example) {
+    console.log();
+    console.log(chalk.cyan('❓ ' + chalk.bold(title)));
+    console.log(chalk.dim('   ' + description));
+    if (example) {
+        console.log(chalk.yellow('   Example: ') + chalk.white(example));
+    }
+    console.log();
+}
+export async function promptEnvironmentSetup(githubClient, providedEnvironmentName, providedRepo, partialConfig, isUpdate = false) {
+    ui.section('Step 1: Repository Selection');
+    console.log(chalk.dim('📦 Select the GitHub repository where your Sembix Studio deployment will be configured.'));
+    console.log(chalk.dim('   This repository contains your deployment workflows and configuration files.'));
+    console.log();
+    // Step 1: Repository Selection
+    let repositoryChoice;
+    let owner;
+    let repo;
+    if (providedRepo) {
+        // Repository provided via CLI argument - validate it exists
+        const parts = providedRepo.split('/');
+        if (parts.length !== 2) {
+            ui.error('Invalid repository format. Use: owner/repo');
+            process.exit(1);
+        }
+        [owner, repo] = parts;
+        // Verify repository exists
+        try {
+            await githubClient.getRepository(owner, repo);
+            repositoryChoice = providedRepo;
+            ui.info(`Using repository: ${ui.highlight(repositoryChoice)}`);
+            console.log();
+        }
+        catch {
+            ui.error(`Repository '${providedRepo}' not found or not accessible.`);
+            console.log();
+            console.log(ui.dim('💡 Make sure:'));
+            console.log(ui.dim('   • The repository name is correct (owner/repo)'));
+            console.log(ui.dim('   • Your GitHub token has access to this repository'));
+            process.exit(1);
+        }
+    }
+    else {
+        // Interactive repository selection
+        const repos = await githubClient.listRepositories();
+        if (repos.length === 0) {
+            ui.error('No repositories found for your account.');
+            console.log();
+            console.log(ui.dim('💡 Tip: Make sure your GitHub token has access to the repositories you want to manage.'));
+            process.exit(1);
+        }
+        if (repos.length === 1) {
+            repositoryChoice = repos[0].full_name;
+            ui.info(`Using repository: ${ui.highlight(repositoryChoice)}`);
+            console.log();
+        }
+        else {
+            repositoryChoice = await select({
+                message: 'Select your deployment repository:',
+                choices: repos.map(repo => ({
+                    name: repo.full_name,
+                    value: repo.full_name,
+                })),
+            });
+        }
+        [owner, repo] = repositoryChoice.split('/');
+    }
+    // ============================================================
+    // STEP 2: BASIC CONFIGURATION
+    // ============================================================
+    ui.section('Step 2: Basic Configuration');
+    console.log(chalk.dim('⚙️  Configure the basic settings for your new Sembix Studio environment.'));
+    console.log(chalk.dim('   These settings tell us where to deploy and how to connect to AWS.'));
+    console.log();
+    // Environment Name
+    let environmentName;
+    if (providedEnvironmentName) {
+        // Environment name provided via CLI argument - validate it
+        if (!/^[a-z0-9-]+$/.test(providedEnvironmentName) || providedEnvironmentName.length < 3) {
+            ui.error('Invalid environment name. Must be lowercase letters, numbers, and hyphens (min 3 chars).');
+            process.exit(1);
+        }
+        // Check if environment already exists (only for create, not update)
+        if (!isUpdate) {
+            const envExists = await githubClient.environmentExists(owner, repo, providedEnvironmentName);
+            if (envExists) {
+                ui.error(`Environment '${providedEnvironmentName}' already exists in ${owner}/${repo}`);
+                console.log();
+                console.log(ui.dim('💡 Tip:'));
+                console.log(ui.dim('   • Use a different environment name'));
+                console.log(ui.dim('   • Or update the existing environment with: sembix studio update'));
+                process.exit(1);
+            }
+        }
+        environmentName = providedEnvironmentName;
+        ui.info(`Using environment name: ${ui.highlight(environmentName)}`);
+        console.log();
+    }
+    else {
+        // Interactive environment name prompt
+        explainField('Environment Name', 'This is the name of your GitHub Actions environment. It should be unique and descriptive.\nUse lowercase letters, numbers, and hyphens only (no spaces or special characters).', 'client-abc-production or acme-staging');
+        environmentName = await input({
+            message: 'Environment name:',
+            validate: (value) => {
+                if (!value)
+                    return 'Environment name is required';
+                if (!/^[a-z0-9-]+$/.test(value)) {
+                    return 'Must be lowercase letters, numbers, and hyphens only (no spaces)';
+                }
+                if (value.length < 3)
+                    return 'Must be at least 3 characters long';
+                return true;
+            },
+        });
+    }
+    // AWS Account ID
+    const awsAccountId = await promptIfMissing(partialConfig?.awsAccountId, async () => {
+        explainField('AWS Account ID', 'This is your 12-digit AWS account number where Sembix Studio will be deployed.\nYou can find this in the AWS Console by clicking on your account name in the top right.', '123456789012');
+        return input({
+            message: 'AWS Account ID (12 digits):',
+            validate: (value) => {
+                if (!value)
+                    return 'AWS Account ID is required';
+                const result = awsAccountIdSchema.safeParse(value);
+                if (!result.success)
+                    return 'Must be exactly 12 digits';
+                return true;
+            },
+        });
+    }, 'AWS Account ID');
+    // AWS Region
+    const awsRegion = await promptIfMissing(partialConfig?.awsRegion, async () => {
+        explainField('AWS Region', 'Choose the AWS region where you want to deploy Sembix Studio.\nPick a region close to your users for better performance.', 'us-east-1 (Virginia) or eu-west-1 (Ireland)');
+        return select({
+            message: 'AWS Region:',
+            choices: awsRegions.map(region => ({
+                name: region,
+                value: region,
+            })),
+            default: 'us-east-1',
+        });
+    }, 'AWS Region');
+    // GitHub Actions Role ARN
+    const customerRoleArn = await promptIfMissing(partialConfig?.customerRoleArn, async () => {
+        explainField('GitHub Actions Deployment Role ARN', 'This is the IAM role that GitHub Actions will assume to deploy infrastructure to your AWS account.\nIt must have permissions to create and manage AWS resources (VPCs, ECS, RDS, etc.).', 'arn:aws:iam::123456789012:role/GitHubActionsDeployRole');
+        return input({
+            message: 'GitHub Actions Role ARN:',
+            validate: (value) => {
+                if (!value)
+                    return 'Role ARN is required';
+                const result = iamRoleArnSchema.safeParse(value);
+                if (!result.success)
+                    return 'Must be a valid IAM role ARN (arn:aws:iam::ACCOUNT:role/NAME)';
+                return true;
+            },
+        });
+    }, 'GitHub Actions Role ARN');
+    // Terraform State Bucket
+    const terraformStateBucket = await promptIfMissing(partialConfig?.terraformStateBucket, async () => {
+        explainField('Terraform State S3 Bucket', 'This is the S3 bucket where Terraform will store its state file.\nThe state file keeps track of all the infrastructure Terraform creates.\nMake sure this bucket already exists in your AWS account.', 'my-terraform-state-bucket');
+        return input({
+            message: 'Terraform State S3 Bucket name:',
+            validate: (value) => {
+                if (!value)
+                    return 'Bucket name is required';
+                if (!/^[a-z0-9][a-z0-9-]*[a-z0-9]$/.test(value)) {
+                    return 'Bucket name must be lowercase letters, numbers, and hyphens';
+                }
+                return true;
+            },
+        });
+    }, 'Terraform State Bucket');
+    // ============================================================
+    // STEP 3: DATABASE CONFIGURATION
+    // ============================================================
+    let databaseName;
+    let databaseUser;
+    if (partialConfig?.database?.name && partialConfig?.database?.user) {
+        // Both database fields provided - skip section
+        databaseName = partialConfig.database.name;
+        databaseUser = partialConfig.database.user;
+        ui.info(`Using Database: ${ui.highlight(databaseName)} / ${ui.highlight(databaseUser)} (from config)`);
+        console.log();
+    }
+    else {
+        ui.section('Step 3: Database Configuration');
+        console.log(chalk.dim('🗄️  Configure the PostgreSQL database settings for Sembix Studio.'));
+        console.log(chalk.dim('   The database stores all your Studio data (workflows, users, etc.).'));
+        console.log();
+        // Database Name
+        databaseName = await promptIfMissing(partialConfig?.database?.name, async () => {
+            explainField('Database Name', 'The name of the PostgreSQL database that will be created for Sembix Studio.\nMust start with a letter and contain only letters, numbers, and underscores.', 'sembix_studio or studio_production');
+            return input({
+                message: 'Database name:',
+                default: 'sembix_studio',
+                validate: (value) => {
+                    if (!value)
+                        return 'Database name is required';
+                    if (!/^[a-zA-Z][a-zA-Z0-9_]*$/.test(value)) {
+                        return 'Must start with a letter and contain only letters, numbers, and underscores';
+                    }
+                    return true;
+                },
+            });
+        }, 'Database name');
+        // Database User
+        databaseUser = await promptIfMissing(partialConfig?.database?.user, async () => {
+            explainField('Database User', 'The PostgreSQL username that Sembix Studio will use to connect to the database.\nMust start with a letter and contain only letters, numbers, and underscores.', 'sembix_studio_user or studio_app');
+            return input({
+                message: 'Database user:',
+                default: 'sembix_studio_user',
+                validate: (value) => {
+                    if (!value)
+                        return 'Database user is required';
+                    if (!/^[a-zA-Z][a-zA-Z0-9_]*$/.test(value)) {
+                        return 'Must start with a letter and contain only letters, numbers, and underscores';
+                    }
+                    return true;
+                },
+            });
+        }, 'Database user');
+    }
+    // ============================================================
+    // STEP 4: NETWORKING & INFRASTRUCTURE
+    // ============================================================
+    ui.section('Step 4: Networking & Infrastructure');
+    console.log(chalk.dim('🌐 Configure networking settings for your Sembix Studio deployment.'));
+    console.log(chalk.dim('   You can either create a new VPC or use an existing one.'));
+    console.log();
+    // VPC Endpoints
+    explainField('VPC Endpoints', 'VPC endpoints allow your AWS resources to communicate with AWS services privately (without going through the internet).\nThis improves security and can reduce data transfer costs.\n\n' +
+        chalk.green('✓ Recommended: ') + 'Enable this unless you have a specific reason not to.', 'Choose Yes (recommended)');
+    const enableVpcEndpoints = await confirm({
+        message: 'Enable VPC endpoints for AWS services?',
+        default: true,
+    });
+    // Custom Networking
+    console.log();
+    console.log(chalk.cyan('❓ ' + chalk.bold('Use Existing VPC?')));
+    console.log(chalk.dim('   You have two options:'));
+    console.log(chalk.dim('   • ' + chalk.white('No (Create New)') + ' - We\'ll create a brand new VPC with all necessary networking (recommended for new deployments)'));
+    console.log(chalk.dim('   • ' + chalk.white('Yes (Use Existing)') + ' - You provide an existing VPC and subnets (for integrating with existing infrastructure)'));
+    console.log();
+    const useCustomNetworking = await confirm({
+        message: 'Do you want to use an existing VPC?',
+        default: false,
+    });
+    let networking;
+    if (useCustomNetworking) {
+        // ============================================================
+        // CUSTOM NETWORKING (Existing VPC)
+        // ============================================================
+        console.log();
+        console.log(chalk.yellow('📝 Using Existing VPC'));
+        console.log(chalk.dim('   You\'ll need to provide your VPC ID and subnet IDs from the AWS Console.'));
+        console.log();
+        explainField('VPC ID', 'The ID of your existing Virtual Private Cloud.\nYou can find this in the AWS Console under VPC → Your VPCs.', 'vpc-0123456789abcdef0');
+        const customVpcId = await input({
+            message: 'VPC ID:',
+            validate: (value) => {
+                if (!value)
+                    return 'VPC ID is required when using existing VPC';
+                if (!/^vpc-[a-f0-9]+$/.test(value))
+                    return 'Must be a valid VPC ID (vpc-xxxxx)';
+                return true;
+            },
+        });
+        explainField('Public Subnet IDs', 'Public subnets have direct internet access (used for load balancers and NAT gateways).\nProvide a comma-separated list of subnet IDs.', 'subnet-abc123,subnet-def456');
+        const customPublicSubnetIds = await input({
+            message: 'Public Subnet IDs (comma-separated):',
+            validate: (value) => {
+                if (!value)
+                    return 'At least one public subnet is required';
+                const subnets = value.split(',').map(s => s.trim());
+                if (subnets.some(s => !/^subnet-[a-f0-9]+$/.test(s))) {
+                    return 'All subnet IDs must be valid (subnet-xxxxx)';
+                }
+                return true;
+            },
+        });
+        explainField('Private Subnet IDs', 'Private subnets do NOT have direct internet access (used for databases and application servers).\nProvide a comma-separated list of subnet IDs.', 'subnet-ghi789,subnet-jkl012');
+        const customPrivateSubnetIds = await input({
+            message: 'Private Subnet IDs (comma-separated):',
+            validate: (value) => {
+                if (!value)
+                    return 'At least one private subnet is required';
+                const subnets = value.split(',').map(s => s.trim());
+                if (subnets.some(s => !/^subnet-[a-f0-9]+$/.test(s))) {
+                    return 'All subnet IDs must be valid (subnet-xxxxx)';
+                }
+                return true;
+            },
+        });
+        networking = {
+            enableVpcEndpoints,
+            useCustomNetworking: true,
+            customVpcId,
+            customPublicSubnetIds,
+            customPrivateSubnetIds,
+        };
+    }
+    else {
+        // ============================================================
+        // NEW VPC CREATION
+        // ============================================================
+        console.log();
+        console.log(chalk.green('✨ Creating New VPC'));
+        console.log(chalk.dim('   We\'ll create a new VPC with all necessary networking components.'));
+        console.log(chalk.dim('   You can use the default values or customize them.'));
+        console.log();
+        explainField('VPC CIDR Block', 'This is the IP address range for your entire VPC (in CIDR notation).\nThe default (10.0.0.0/16) gives you 65,536 IP addresses, which is plenty for most deployments.\n\n' +
+            chalk.green('💡 Tip: ') + 'Press Enter to use the default unless you have specific networking requirements.', '10.0.0.0/16 (default, recommended)');
+        const vpcCidr = await input({
+            message: 'VPC CIDR Block:',
+            default: '10.0.0.0/16',
+            validate: (value) => {
+                if (!value)
+                    return 'VPC CIDR is required';
+                if (!/^\d+\.\d+\.\d+\.\d+\/\d+$/.test(value)) {
+                    return 'Must be a valid CIDR block (e.g., 10.0.0.0/16)';
+                }
+                return true;
+            },
+        });
+        explainField('Public Subnet CIDRs', 'IP ranges for public subnets (have internet access). Format as a JSON array.\nEach subnet will be created in a different availability zone for high availability.\n\n' +
+            chalk.green('💡 Tip: ') + 'Press Enter to use the defaults.', '["10.0.0.0/24","10.0.3.0/24"]');
+        const publicSubnetCidrs = await input({
+            message: 'Public Subnet CIDRs (JSON array):',
+            default: '["10.0.0.0/24","10.0.3.0/24"]',
+            validate: (value) => {
+                if (!value)
+                    return 'Public subnet CIDRs are required';
+                try {
+                    const parsed = JSON.parse(value);
+                    if (!Array.isArray(parsed) || parsed.length === 0) {
+                        return 'Must be a non-empty JSON array';
+                    }
+                    return true;
+                }
+                catch {
+                    return 'Must be valid JSON array (e.g., ["10.0.0.0/24","10.0.3.0/24"])';
+                }
+            },
+        });
+        explainField('Private Subnet CIDRs', 'IP ranges for private subnets (no direct internet access). Format as a JSON array.\nThese are used for databases and application servers that don\'t need public access.\n\n' +
+            chalk.green('💡 Tip: ') + 'Press Enter to use the defaults.', '["10.0.1.0/24","10.0.2.0/24"]');
+        const privateSubnetCidrs = await input({
+            message: 'Private Subnet CIDRs (JSON array):',
+            default: '["10.0.1.0/24","10.0.2.0/24"]',
+            validate: (value) => {
+                if (!value)
+                    return 'Private subnet CIDRs are required';
+                try {
+                    const parsed = JSON.parse(value);
+                    if (!Array.isArray(parsed) || parsed.length === 0) {
+                        return 'Must be a non-empty JSON array';
+                    }
+                    return true;
+                }
+                catch {
+                    return 'Must be valid JSON array (e.g., ["10.0.1.0/24","10.0.2.0/24"])';
+                }
+            },
+        });
+        explainField('Availability Zones', 'AWS Availability Zones are isolated locations within a region.\nUsing multiple AZs provides high availability and fault tolerance.\n\n' +
+            chalk.green('✓ Recommended: ') + '2 AZs is sufficient for most deployments.', '2 (recommended)');
+        const azCount = await select({
+            message: 'Number of Availability Zones:',
+            choices: [
+                { name: '2 (recommended - good balance of cost and availability)', value: '2' },
+                { name: '3 (maximum availability)', value: '3' },
+            ],
+            default: '2',
+        });
+        networking = {
+            enableVpcEndpoints,
+            useCustomNetworking: false,
+            vpcCidr,
+            publicSubnetCidrs,
+            privateSubnetCidrs,
+            azCount,
+        };
+    }
+    // ============================================================
+    // STEP 5: SECURITY & IAM (OPTIONAL)
+    // ============================================================
+    ui.section('Step 5: Security & IAM (Optional)');
+    console.log(chalk.dim('🔒 Configure advanced security settings.'));
+    console.log(chalk.dim('   These are optional. Most users can skip this section by pressing Enter.'));
+    console.log();
+    // KMS Key
+    explainField('Workflow Runs KMS Key (Optional)', 'AWS KMS (Key Management Service) key for encrypting workflow execution data.\nLeave blank to use AWS-managed encryption (recommended for most users).\n\n' +
+        chalk.green('💡 Tip: ') + 'Press Enter to skip unless you have specific compliance requirements.', 'alias/my-kms-key or leave blank');
+    const workflowRunsKeyAlias = await input({
+        message: 'Workflow Runs KMS Key Alias (press Enter to skip):',
+        default: '',
+    });
+    // Custom Security Groups
+    console.log();
+    console.log(chalk.cyan('❓ ' + chalk.bold('Custom Security Groups')));
+    console.log(chalk.dim('   Security groups control network traffic to/from AWS resources.'));
+    console.log(chalk.dim('   • ' + chalk.white('No') + ' - We\'ll create new security groups with proper rules (recommended)'));
+    console.log(chalk.dim('   • ' + chalk.white('Yes') + ' - You provide existing security group IDs (for advanced users)'));
+    console.log();
+    const useCustomSecurityGroups = await confirm({
+        message: 'Use custom security groups?',
+        default: false,
+    });
+    let customSecurityGroups = undefined;
+    if (useCustomSecurityGroups) {
+        console.log();
+        console.log(chalk.yellow('📝 Custom Security Groups'));
+        console.log(chalk.dim('   Provide the security group IDs from AWS Console.'));
+        console.log();
+        customSecurityGroups = {
+            workflowEngine: await input({
+                message: 'Workflow Engine Security Group ID:',
+                validate: (v) => !v || /^sg-[a-f0-9]+$/.test(v) || 'Must be valid SG ID (sg-xxxxx)'
+            }),
+            aurora: await input({
+                message: 'Aurora Database Security Group ID:',
+                validate: (v) => !v || /^sg-[a-f0-9]+$/.test(v) || 'Must be valid SG ID (sg-xxxxx)'
+            }),
+            rdsProxy: await input({
+                message: 'RDS Proxy Security Group ID:',
+                validate: (v) => !v || /^sg-[a-f0-9]+$/.test(v) || 'Must be valid SG ID (sg-xxxxx)'
+            }),
+            bffEcs: await input({
+                message: 'BFF ECS Service Security Group ID:',
+                validate: (v) => !v || /^sg-[a-f0-9]+$/.test(v) || 'Must be valid SG ID (sg-xxxxx)'
+            }),
+            bastion: await input({
+                message: 'Bastion Host Security Group ID:',
+                validate: (v) => !v || /^sg-[a-f0-9]+$/.test(v) || 'Must be valid SG ID (sg-xxxxx)'
+            }),
+            bffAlb: await input({
+                message: 'BFF Load Balancer Security Group ID:',
+                validate: (v) => !v || /^sg-[a-f0-9]+$/.test(v) || 'Must be valid SG ID (sg-xxxxx)'
+            }),
+        };
+    }
+    // Custom IAM Roles
+    console.log();
+    console.log(chalk.cyan('❓ ' + chalk.bold('Custom IAM Roles')));
+    console.log(chalk.dim('   IAM roles define permissions for AWS resources.'));
+    console.log(chalk.dim('   • ' + chalk.white('No') + ' - We\'ll create new IAM roles with proper permissions (recommended)'));
+    console.log(chalk.dim('   • ' + chalk.white('Yes') + ' - You provide existing IAM role ARNs (for advanced users)'));
+    console.log();
+    const useCustomIamPolicies = await confirm({
+        message: 'Use custom IAM roles?',
+        default: false,
+    });
+    let customIamRoles = undefined;
+    if (useCustomIamPolicies) {
+        console.log();
+        console.log(chalk.yellow('📝 Custom IAM Roles'));
+        console.log(chalk.dim('   Provide the IAM role ARNs from AWS Console.'));
+        console.log();
+        const validateRoleArn = (v) => !v || /^arn:aws:iam::\d{12}:role\/.+$/.test(v) || 'Must be valid IAM role ARN';
+        customIamRoles = {
+            workflowEngineExecutionRole: await input({
+                message: 'Workflow Engine Execution Role ARN:',
+                validate: validateRoleArn
+            }),
+            workflowEngineTaskRole: await input({
+                message: 'Workflow Engine Task Role ARN:',
+                validate: validateRoleArn
+            }),
+            bffEcsTaskExecutionRole: await input({
+                message: 'BFF ECS Task Execution Role ARN:',
+                validate: validateRoleArn
+            }),
+            bffEcsTaskRole: await input({
+                message: 'BFF ECS Task Role ARN:',
+                validate: validateRoleArn
+            }),
+            rdsProxyRole: await input({
+                message: 'RDS Proxy Role ARN:',
+                validate: validateRoleArn
+            }),
+            sembixStudioMemoryRole: await input({
+                message: 'Sembix Studio Memory Role ARN:',
+                validate: validateRoleArn
+            }),
+            sembixStudioNotificationRole: await input({
+                message: 'Sembix Studio Notification Role ARN:',
+                validate: validateRoleArn
+            }),
+        };
+    }
+    // ============================================================
+    // STEP 6: DNS & TLS CONFIGURATION
+    // ============================================================
+    ui.section('Step 6: DNS & TLS Configuration');
+    console.log(chalk.dim('🔐 Configure custom domains and SSL/TLS certificates for secure HTTPS access.'));
+    console.log();
+    console.log(chalk.dim('📌 ' + chalk.bold('Architecture Overview:')));
+    console.log(chalk.dim('   Sembix Studio has two public-facing components:'));
+    console.log(chalk.dim('   1. CloudFront Distribution → Serves the React frontend (Studio UI)'));
+    console.log(chalk.dim('   2. Application Load Balancer (ALB) → Exposes the BFF API'));
+    console.log(chalk.dim('   Both need custom domains and SSL certificates.'));
+    console.log();
+    // CloudFront Domain
+    const cloudfrontDomain = await promptIfMissing(partialConfig?.tls?.cloudfrontDomain, async () => {
+        explainField('CloudFront Domain', 'The custom domain name for your Studio UI (the website users will visit).\nThis domain must match the SSL certificate you provide below.\n\n' +
+            chalk.green('💡 Example: ') + 'If your company is Acme Corp, you might use: studio.acme.com', 'studio.example.com or studio.acme.com');
+        return input({
+            message: 'CloudFront Domain:',
+            validate: (value) => {
+                if (!value)
+                    return 'CloudFront domain is required';
+                if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/.test(value)) {
+                    return 'Must be a valid domain name';
+                }
+                return true;
+            },
+        });
+    }, 'CloudFront Domain');
+    // CloudFront Certificate
+    const cloudfrontCertArn = await promptIfMissing(partialConfig?.tls?.cloudfrontCertArn, async () => {
+        explainField('CloudFront SSL Certificate', 'The ACM (AWS Certificate Manager) certificate ARN for your CloudFront domain.\n\n' +
+            chalk.red('⚠️  IMPORTANT: ') + 'This certificate ' + chalk.bold('MUST') + ' be in the ' + chalk.bold('us-east-1') + ' region.\n' +
+            '   (This is a CloudFront requirement, even if your infrastructure is in a different region)\n\n' +
+            chalk.green('💡 Tip: ') + 'Create the certificate in ACM in us-east-1, then copy the ARN here.', 'arn:aws:acm:us-east-1:123456789012:certificate/abc123...');
+        return input({
+            message: 'CloudFront Certificate ARN (must be in us-east-1):',
+            validate: (value) => {
+                if (!value)
+                    return 'CloudFront certificate ARN is required';
+                const result = acmCertArnSchema.safeParse(value);
+                if (!result.success)
+                    return 'Must be a valid ACM certificate ARN';
+                if (!value.includes('us-east-1')) {
+                    return chalk.red('ERROR: ') + 'CloudFront certificate MUST be in us-east-1 region (CloudFront requirement)';
+                }
+                return true;
+            },
+        });
+    }, 'CloudFront Certificate ARN');
+    // ALB Certificate
+    const bffAlbCertificateArn = await promptIfMissing(partialConfig?.tls?.bffAlbCertificateArn, async () => {
+        explainField('BFF ALB SSL Certificate', 'The ACM certificate ARN for your BFF (Backend For Frontend) API load balancer.\nThis certificate should be in the same region as your infrastructure.\n\n' +
+            chalk.green('💡 Tip: ') + 'This can be the same domain as CloudFront or a different subdomain (e.g., api.example.com).', 'arn:aws:acm:' + awsRegion + ':123456789012:certificate/def456...');
+        return input({
+            message: 'BFF ALB Certificate ARN:',
+            validate: (value) => {
+                if (!value)
+                    return 'BFF ALB certificate ARN is required';
+                const result = acmCertArnSchema.safeParse(value);
+                if (!result.success)
+                    return 'Must be a valid ACM certificate ARN';
+                return true;
+            },
+        });
+    }, 'BFF ALB Certificate ARN');
+    // Hosted Zone ID
+    const hostedZoneId = await promptIfMissing(partialConfig?.tls?.hostedZoneId, async () => {
+        explainField('Route53 Hosted Zone ID', 'The ID of your Route53 hosted zone where DNS records will be automatically created.\nYou can find this in the AWS Console under Route53 → Hosted zones.\n\n' +
+            chalk.green('💡 Tip: ') + 'The hosted zone should manage the domain you\'re using (e.g., example.com).', 'Z1234567890ABC');
+        return input({
+            message: 'Route53 Hosted Zone ID:',
+            validate: (value) => {
+                if (!value)
+                    return 'Hosted Zone ID is required';
+                const result = route53ZoneIdSchema.safeParse(value);
+                if (!result.success)
+                    return 'Must be a valid Route53 hosted zone ID (starts with Z)';
+                return true;
+            },
+        });
+    }, 'Route53 Hosted Zone ID');
+    // ============================================================
+    // STEP 7: FEATURE CONFIGURATION
+    // ============================================================
+    ui.section('Step 7: Feature Configuration');
+    console.log(chalk.dim('🎛️  Enable or disable optional Sembix Studio services.'));
+    console.log(chalk.dim('   Most users should enable all features.'));
+    console.log();
+    // Sembix Studio Memory
+    explainField('Sembix Studio Memory Service', 'The Memory service provides workflow state persistence and caching.\n\n' +
+        chalk.green('✓ Recommended: ') + 'Enable this feature for full Studio functionality.', 'Choose Yes (recommended)');
+    const deploySembixStudioMemory = await confirm({
+        message: 'Deploy Sembix Studio Memory service?',
+        default: true,
+    });
+    // Sembix Studio Notifications
+    explainField('Sembix Studio Notifications Service', 'The Notifications service handles alerts, messaging, and event notifications.\n\n' +
+        chalk.green('✓ Recommended: ') + 'Enable this feature for user notifications and alerts.', 'Choose Yes (recommended)');
+    const deploySembixStudioNotifications = await confirm({
+        message: 'Deploy Sembix Studio Notifications service?',
+        default: true,
+    });
+    // WAF
+    explainField('Web Application Firewall (WAF)', 'AWS WAF protects your BFF API from common web exploits and attacks.\nIt provides an additional layer of security at the application level.\n\n' +
+        chalk.green('✓ Recommended: ') + 'Enable this for production environments.', 'Choose Yes (recommended for production)');
+    const enableBffWaf = await confirm({
+        message: 'Enable Web Application Firewall (WAF) for BFF?',
+        default: true,
+    });
+    // ============================================================
+    // STEP 8: FRONTEND CONFIGURATION
+    // ============================================================
+    ui.section('Step 8: Frontend Configuration');
+    console.log(chalk.dim('⚛️  Configure integrations for the Sembix Studio frontend (React UI).'));
+    console.log();
+    // GitHub App Client ID
+    const githubAppClientId = await promptIfMissing(partialConfig?.frontend?.githubAppClientId, async () => {
+        explainField('GitHub App Client ID', 'The OAuth Client ID from your GitHub App.\nThis allows users to authenticate with GitHub and access repositories.\n\n' +
+            chalk.green('💡 Tip: ') + 'Create a GitHub App in your organization settings, then copy the Client ID.', 'Iv1.0123456789abcdef');
+        return input({
+            message: 'GitHub App Client ID:',
+            validate: (value) => {
+                if (!value)
+                    return 'GitHub App Client ID is required';
+                return true;
+            },
+        });
+    }, 'GitHub App Client ID');
+    // GitHub App Name
+    const githubAppName = await promptIfMissing(partialConfig?.frontend?.githubAppName, async () => {
+        explainField('GitHub App Name', 'The name of your GitHub App (as it appears in GitHub).\nThis is shown to users during the OAuth flow.', 'sembix-studio-app or acme-studio');
+        return input({
+            message: 'GitHub App Name:',
+            validate: (value) => {
+                if (!value)
+                    return 'GitHub App Name is required';
+                return true;
+            },
+        });
+    }, 'GitHub App Name');
+    // Jira Client ID
+    const jiraClientId = await promptIfMissing(partialConfig?.frontend?.jiraClientId, async () => {
+        explainField('Jira Client ID', 'The OAuth Client ID from your Atlassian/Jira app.\nThis enables Jira integration for issue tracking and project management.\n\n' +
+            chalk.green('💡 Tip: ') + 'Create an OAuth app in your Atlassian Developer Console.', 'abc123def456ghi789');
+        return input({
+            message: 'Jira Client ID:',
+            validate: (value) => {
+                if (!value)
+                    return 'Jira Client ID is required';
+                return true;
+            },
+        });
+    }, 'Jira Client ID');
+    return {
+        repository: { owner, repo },
+        environmentName,
+        awsAccountId,
+        awsRegion,
+        customerRoleArn,
+        terraformStateBucket,
+        database: {
+            name: databaseName,
+            user: databaseUser,
+        },
+        networking,
+        security: {
+            workflowRunsKeyAlias: workflowRunsKeyAlias || undefined,
+            useCustomSecurityGroups,
+            customSecurityGroups,
+            useCustomIamPolicies,
+            customIamRoles,
+        },
+        tls: {
+            cloudfrontDomain,
+            cloudfrontCertArn,
+            bffAlbCertificateArn,
+            hostedZoneId,
+        },
+        features: {
+            deploySembixStudioMemory,
+            deploySembixStudioNotifications,
+            enableBffWaf,
+        },
+        frontend: {
+            githubAppClientId,
+            githubAppName,
+            jiraClientId,
+        },
+    };
+}
+//# sourceMappingURL=environment-setup.js.map