@sembix/cli 1.9.0 → 1.10.1

package/dist/prompts/environment-setup.js

@@ -1,11 +1,11 @@
 import { input, select, confirm } from '@inquirer/prompts';
-import { awsRegions, awsAccountIdSchema, iamRoleArnSchema, acmCertArnSchema, route53ZoneIdSchema } from '../types.js';
+import { awsRegions, awsAccountIdSchema, iamRoleArnSchema, acmCertArnSchema, route53ZoneIdSchema, secretsManagerArnSchema } from '../types.js';
 import * as ui from '../utils/ui.js';
 import chalk from 'chalk';
 import { promptIfMissing } from './prompt-helpers.js';
-/**
- * Helper function to display information before a prompt
- */
+// ============================================================
+// HELPERS
+// ============================================================
 function explainField(title, description, example) {
     console.log();
     console.log(chalk.cyan('❓ ' + chalk.bold(title)));
@@ -15,88 +15,129 @@ function explainField(title, description, example) {
     }
     console.log();
 }
-export async function promptEnvironmentSetup(githubClient, providedEnvironmentName, providedRepo, partialConfig, isUpdate = false) {
-    ui.section('Step 1: Repository Selection');
-    console.log(chalk.dim('📦 Select the GitHub repository where your Sembix Studio deployment will be configured.'));
-    console.log(chalk.dim('   This repository contains your deployment workflows and configuration files.'));
+function hasAdvancedFields(partialConfig) {
+    if (!partialConfig)
+        return false;
+    const { security, tls, networking } = partialConfig;
+    return !!(security?.useCustomSecurityGroups ||
+        security?.useCustomIamPolicies ||
+        security?.customSecurityGroups ||
+        security?.customIamRoles ||
+        security?.workflowRunsKeyAlias ||
+        tls?.certificateArn ||
+        tls?.bffAlbInternal ||
+        tls?.bffInternalAlbCertificateArn ||
+        tls?.privateCaCertSecretArn ||
+        networking?.useCustomNetworking);
+}
+function getStepCount(mode) {
+    return mode === 'express' ? 4 : 8;
+}
+// ============================================================
+// STEP: MODE SELECTION
+// ============================================================
+async function promptModeSelection(partialConfig) {
+    if (hasAdvancedFields(partialConfig)) {
+        ui.info('Advanced mode auto-selected (config contains advanced fields)');
+        console.log();
+        return 'advanced';
+    }
+    console.log();
+    console.log(chalk.dim('  Choose how you\'d like to configure your environment:'));
+    console.log();
+    return select({
+        message: 'Select setup mode:',
+        choices: [
+            {
+                name: 'Express (Recommended) — Quick setup with sensible defaults (~12 questions)',
+                value: 'express',
+            },
+            {
+                name: 'Advanced — Full control over all configuration options (~35+ questions)',
+                value: 'advanced',
+            },
+        ],
+        default: 'express',
+    });
+}
+// ============================================================
+// STEP: REPOSITORY SELECTION
+// ============================================================
+async function promptRepository(ctx, stepNumber, providedRepo) {
+    ui.stepHeader(stepNumber, getStepCount(ctx.mode), 'Repository Selection');
+    console.log(chalk.dim('  Select the GitHub repository where your Sembix Studio deployment will be configured.'));
+    console.log(chalk.dim('  This repository contains your deployment workflows and configuration files.'));
     console.log();
-    // Step 1: Repository Selection
-    let repositoryChoice;
-    let owner;
-    let repo;
     if (providedRepo) {
-        // Repository provided via CLI argument - validate it exists
         const parts = providedRepo.split('/');
         if (parts.length !== 2) {
             ui.error('Invalid repository format. Use: owner/repo');
             process.exit(1);
         }
-        [owner, repo] = parts;
-        // Verify repository exists
+        const [owner, repo] = parts;
         try {
-            await githubClient.getRepository(owner, repo);
-            repositoryChoice = providedRepo;
-            ui.info(`Using repository: ${ui.highlight(repositoryChoice)}`);
+            await ctx.githubClient.getRepository(owner, repo);
+            ui.info(`Using repository: ${ui.highlight(providedRepo)}`);
             console.log();
+            return { owner, repo };
         }
         catch {
             ui.error(`Repository '${providedRepo}' not found or not accessible.`);
             console.log();
-            console.log(ui.dim('💡 Make sure:'));
-            console.log(ui.dim('   • The repository name is correct (owner/repo)'));
-            console.log(ui.dim('   • Your GitHub token has access to this repository'));
+            console.log(ui.dim('  Make sure:'));
+            console.log(ui.dim('   - The repository name is correct (owner/repo)'));
+            console.log(ui.dim('   - Your GitHub token has access to this repository'));
             process.exit(1);
         }
     }
+    const repos = await ctx.githubClient.listRepositories();
+    if (repos.length === 0) {
+        ui.error('No repositories found for your account.');
+        console.log();
+        console.log(ui.dim('  Tip: Make sure your GitHub token has access to the repositories you want to manage.'));
+        process.exit(1);
+    }
+    let repositoryChoice;
+    if (repos.length === 1) {
+        repositoryChoice = repos[0].full_name;
+        ui.info(`Using repository: ${ui.highlight(repositoryChoice)}`);
+        console.log();
+    }
     else {
-        // Interactive repository selection
-        const repos = await githubClient.listRepositories();
-        if (repos.length === 0) {
-            ui.error('No repositories found for your account.');
-            console.log();
-            console.log(ui.dim('💡 Tip: Make sure your GitHub token has access to the repositories you want to manage.'));
-            process.exit(1);
-        }
-        if (repos.length === 1) {
-            repositoryChoice = repos[0].full_name;
-            ui.info(`Using repository: ${ui.highlight(repositoryChoice)}`);
-            console.log();
-        }
-        else {
-            repositoryChoice = await select({
-                message: 'Select your deployment repository:',
-                choices: repos.map(repo => ({
-                    name: repo.full_name,
-                    value: repo.full_name,
-                })),
-            });
-        }
-        [owner, repo] = repositoryChoice.split('/');
+        repositoryChoice = await select({
+            message: 'Select your deployment repository:',
+            choices: repos.map(r => ({
+                name: r.full_name,
+                value: r.full_name,
+            })),
+        });
     }
-    // ============================================================
-    // STEP 2: BASIC CONFIGURATION
-    // ============================================================
-    ui.section('Step 2: Basic Configuration');
-    console.log(chalk.dim('⚙️  Configure the basic settings for your new Sembix Studio environment.'));
-    console.log(chalk.dim('   These settings tell us where to deploy and how to connect to AWS.'));
+    const [owner, repo] = repositoryChoice.split('/');
+    return { owner, repo };
+}
+// ============================================================
+// STEP: BASIC CONFIGURATION
+// ============================================================
+async function promptBasicConfig(ctx, stepNumber, owner, repo, providedEnvironmentName) {
+    ui.stepHeader(stepNumber, getStepCount(ctx.mode), 'Basic Configuration');
+    console.log(chalk.dim('  Configure the basic settings for your Sembix Studio environment.'));
+    console.log(chalk.dim('  These settings tell us where to deploy and how to connect to AWS.'));
     console.log();
     // Environment Name
     let environmentName;
     if (providedEnvironmentName) {
-        // Environment name provided via CLI argument - validate it
         if (!/^[a-z0-9-]+$/.test(providedEnvironmentName) || providedEnvironmentName.length < 3) {
             ui.error('Invalid environment name. Must be lowercase letters, numbers, and hyphens (min 3 chars).');
             process.exit(1);
         }
-        // Check if environment already exists (only for create, not update)
-        if (!isUpdate) {
-            const envExists = await githubClient.environmentExists(owner, repo, providedEnvironmentName);
+        if (!ctx.isUpdate) {
+            const envExists = await ctx.githubClient.environmentExists(owner, repo, providedEnvironmentName);
             if (envExists) {
                 ui.error(`Environment '${providedEnvironmentName}' already exists in ${owner}/${repo}`);
                 console.log();
-                console.log(ui.dim('💡 Tip:'));
-                console.log(ui.dim('   • Use a different environment name'));
-                console.log(ui.dim('   • Or update the existing environment with: sembix studio update'));
+                console.log(ui.dim('  Tip:'));
+                console.log(ui.dim('   - Use a different environment name'));
+                console.log(ui.dim('   - Or update the existing environment with: sembix studio update'));
                 process.exit(1);
             }
         }
@@ -105,7 +146,6 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
         console.log();
     }
     else {
-        // Interactive environment name prompt
         explainField('Environment Name', 'This is the name of your GitHub Actions environment. It should be unique and descriptive.\nUse lowercase letters, numbers, and hyphens only (no spaces or special characters).', 'client-abc-production or acme-staging');
         environmentName = await input({
             message: 'Environment name:',
@@ -122,7 +162,7 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
         });
     }
     // AWS Account ID
-    const awsAccountId = await promptIfMissing(partialConfig?.awsAccountId, async () => {
+    const awsAccountId = await promptIfMissing(ctx.partialConfig?.awsAccountId, async () => {
         explainField('AWS Account ID', 'This is your 12-digit AWS account number where Sembix Studio will be deployed.\nYou can find this in the AWS Console by clicking on your account name in the top right.', '123456789012');
         return input({
             message: 'AWS Account ID (12 digits):',
@@ -137,7 +177,7 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
         });
     }, 'AWS Account ID');
     // AWS Region
-    const awsRegion = await promptIfMissing(partialConfig?.awsRegion, async () => {
+    const awsRegion = await promptIfMissing(ctx.partialConfig?.awsRegion, async () => {
         explainField('AWS Region', 'Choose the AWS region where you want to deploy Sembix Studio.\nPick a region close to your users for better performance.', 'us-east-1 (Virginia) or eu-west-1 (Ireland)');
         return select({
             message: 'AWS Region:',
@@ -149,7 +189,7 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
         });
     }, 'AWS Region');
     // GitHub Actions Role ARN
-    const customerRoleArn = await promptIfMissing(partialConfig?.customerRoleArn, async () => {
+    const customerRoleArn = await promptIfMissing(ctx.partialConfig?.customerRoleArn, async () => {
         explainField('GitHub Actions Deployment Role ARN', 'This is the IAM role that GitHub Actions will assume to deploy infrastructure to your AWS account.\nIt must have permissions to create and manage AWS resources (VPCs, ECS, RDS, etc.).', 'arn:aws:iam::123456789012:role/GitHubActionsDeployRole');
         return input({
             message: 'GitHub Actions Role ARN:',
@@ -164,7 +204,7 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
         });
     }, 'GitHub Actions Role ARN');
     // Terraform State Bucket
-    const terraformStateBucket = await promptIfMissing(partialConfig?.terraformStateBucket, async () => {
+    const terraformStateBucket = await promptIfMissing(ctx.partialConfig?.terraformStateBucket, async () => {
         explainField('Terraform State S3 Bucket', 'This is the S3 bucket where Terraform will store its state file.\nThe state file keeps track of all the infrastructure Terraform creates.\nMake sure this bucket already exists in your AWS account.', 'my-terraform-state-bucket');
         return input({
             message: 'Terraform State S3 Bucket name:',
@@ -178,91 +218,110 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
             },
         });
     }, 'Terraform State Bucket');
-    // ============================================================
-    // STEP 3: DATABASE CONFIGURATION
-    // ============================================================
-    let databaseName;
-    let databaseUser;
+    return { environmentName, awsAccountId, awsRegion, customerRoleArn, terraformStateBucket };
+}
+// ============================================================
+// STEP: DATABASE CONFIGURATION
+// ============================================================
+async function promptDatabase(ctx, stepNumber) {
+    const { partialConfig } = ctx;
+    // Config always wins
     if (partialConfig?.database?.name && partialConfig?.database?.user) {
-        // Both database fields provided - skip section
-        databaseName = partialConfig.database.name;
-        databaseUser = partialConfig.database.user;
-        ui.info(`Using Database: ${ui.highlight(databaseName)} / ${ui.highlight(databaseUser)} (from config)`);
+        ui.info(`Using Database: ${ui.highlight(partialConfig.database.name)} / ${ui.highlight(partialConfig.database.user)} (from config)`);
         console.log();
+        return { name: partialConfig.database.name, user: partialConfig.database.user };
     }
-    else {
-        ui.section('Step 3: Database Configuration');
-        console.log(chalk.dim('🗄️  Configure the PostgreSQL database settings for Sembix Studio.'));
-        console.log(chalk.dim('   The database stores all your Studio data (workflows, users, etc.).'));
+    // Express mode: use defaults
+    if (ctx.mode === 'express') {
+        const name = partialConfig?.database?.name ?? 'sembix_studio';
+        const user = partialConfig?.database?.user ?? 'sembix_studio_user';
+        ui.info(`Using default Database: ${ui.highlight(name)} / ${ui.highlight(user)}`);
         console.log();
-        // Database Name
-        databaseName = await promptIfMissing(partialConfig?.database?.name, async () => {
-            explainField('Database Name', 'The name of the PostgreSQL database that will be created for Sembix Studio.\nMust start with a letter and contain only letters, numbers, and underscores.', 'sembix_studio or studio_production');
-            return input({
-                message: 'Database name:',
-                default: 'sembix_studio',
-                validate: (value) => {
-                    if (!value)
-                        return 'Database name is required';
-                    if (!/^[a-zA-Z][a-zA-Z0-9_]*$/.test(value)) {
-                        return 'Must start with a letter and contain only letters, numbers, and underscores';
-                    }
-                    return true;
-                },
-            });
-        }, 'Database name');
-        // Database User
-        databaseUser = await promptIfMissing(partialConfig?.database?.user, async () => {
-            explainField('Database User', 'The PostgreSQL username that Sembix Studio will use to connect to the database.\nMust start with a letter and contain only letters, numbers, and underscores.', 'sembix_studio_user or studio_app');
-            return input({
-                message: 'Database user:',
-                default: 'sembix_studio_user',
-                validate: (value) => {
-                    if (!value)
-                        return 'Database user is required';
-                    if (!/^[a-zA-Z][a-zA-Z0-9_]*$/.test(value)) {
-                        return 'Must start with a letter and contain only letters, numbers, and underscores';
-                    }
-                    return true;
-                },
-            });
-        }, 'Database user');
+        return { name, user };
+    }
+    // Advanced mode: prompt
+    ui.stepHeader(stepNumber, getStepCount(ctx.mode), 'Database Configuration');
+    console.log(chalk.dim('  Configure the PostgreSQL database settings for Sembix Studio.'));
+    console.log(chalk.dim('  The database stores all your Studio data (workflows, users, etc.).'));
+    console.log();
+    const name = await promptIfMissing(partialConfig?.database?.name, async () => {
+        explainField('Database Name', 'The name of the PostgreSQL database that will be created for Sembix Studio.\nMust start with a letter and contain only letters, numbers, and underscores.', 'sembix_studio or studio_production');
+        return input({
+            message: 'Database name:',
+            default: 'sembix_studio',
+            validate: (value) => {
+                if (!value)
+                    return 'Database name is required';
+                if (!/^[a-zA-Z][a-zA-Z0-9_]*$/.test(value)) {
+                    return 'Must start with a letter and contain only letters, numbers, and underscores';
+                }
+                return true;
+            },
+        });
+    }, 'Database name');
+    const user = await promptIfMissing(partialConfig?.database?.user, async () => {
+        explainField('Database User', 'The PostgreSQL username that Sembix Studio will use to connect to the database.\nMust start with a letter and contain only letters, numbers, and underscores.', 'sembix_studio_user or studio_app');
+        return input({
+            message: 'Database user:',
+            default: 'sembix_studio_user',
+            validate: (value) => {
+                if (!value)
+                    return 'Database user is required';
+                if (!/^[a-zA-Z][a-zA-Z0-9_]*$/.test(value)) {
+                    return 'Must start with a letter and contain only letters, numbers, and underscores';
+                }
+                return true;
+            },
+        });
+    }, 'Database user');
+    return { name, user };
+}
+// ============================================================
+// STEP: NETWORKING & INFRASTRUCTURE
+// ============================================================
+async function promptNetworking(ctx, stepNumber) {
+    // Express mode: use new VPC with all defaults
+    if (ctx.mode === 'express') {
+        ui.info('Using default Networking: New VPC (10.0.0.0/16, VPC endpoints enabled)');
+        console.log();
+        return {
+            enableVpcEndpoints: true,
+            useCustomNetworking: false,
+            vpcCidr: '10.0.0.0/16',
+            publicSubnetCidrs: '["10.0.0.0/24","10.0.3.0/24"]',
+            privateSubnetCidrs: '["10.0.1.0/24","10.0.2.0/24"]',
+            azCount: '2',
+        };
     }
-    // ============================================================
-    // STEP 4: NETWORKING & INFRASTRUCTURE
-    // ============================================================
-    ui.section('Step 4: Networking & Infrastructure');
-    console.log(chalk.dim('🌐 Configure networking settings for your Sembix Studio deployment.'));
-    console.log(chalk.dim('   You can either create a new VPC or use an existing one.'));
+    // Advanced mode: prompt
+    ui.stepHeader(stepNumber, getStepCount(ctx.mode), 'Networking & Infrastructure');
+    console.log(chalk.dim('  Configure networking settings for your Sembix Studio deployment.'));
+    console.log(chalk.dim('  You can either create a new VPC or use an existing one.'));
     console.log();
     // VPC Endpoints
     explainField('VPC Endpoints', 'VPC endpoints allow your AWS resources to communicate with AWS services privately (without going through the internet).\nThis improves security and can reduce data transfer costs.\n\n' +
-        chalk.green('✓ Recommended: ') + 'Enable this unless you have a specific reason not to.', 'Choose Yes (recommended)');
+        chalk.green('  Recommended: ') + 'Enable this unless you have a specific reason not to.', 'Choose Yes (recommended)');
     const enableVpcEndpoints = await confirm({
         message: 'Enable VPC endpoints for AWS services?',
         default: true,
     });
     // Custom Networking
     console.log();
-    console.log(chalk.cyan('❓ ' + chalk.bold('Use Existing VPC?')));
+    console.log(chalk.cyan('  ' + chalk.bold('Use Existing VPC?')));
     console.log(chalk.dim('   You have two options:'));
-    console.log(chalk.dim('   • ' + chalk.white('No (Create New)') + ' - We\'ll create a brand new VPC with all necessary networking (recommended for new deployments)'));
-    console.log(chalk.dim('   • ' + chalk.white('Yes (Use Existing)') + ' - You provide an existing VPC and subnets (for integrating with existing infrastructure)'));
+    console.log(chalk.dim('   - ' + chalk.white('No (Create New)') + ' - We\'ll create a brand new VPC with all necessary networking (recommended for new deployments)'));
+    console.log(chalk.dim('   - ' + chalk.white('Yes (Use Existing)') + ' - You provide an existing VPC and subnets (for integrating with existing infrastructure)'));
     console.log();
     const useCustomNetworking = await confirm({
         message: 'Do you want to use an existing VPC?',
         default: false,
     });
-    let networking;
     if (useCustomNetworking) {
-        // ============================================================
-        // CUSTOM NETWORKING (Existing VPC)
-        // ============================================================
         console.log();
-        console.log(chalk.yellow('📝 Using Existing VPC'));
-        console.log(chalk.dim('   You\'ll need to provide your VPC ID and subnet IDs from the AWS Console.'));
+        console.log(chalk.yellow('  Using Existing VPC'));
+        console.log(chalk.dim('  You\'ll need to provide your VPC ID and subnet IDs from the AWS Console.'));
         console.log();
-        explainField('VPC ID', 'The ID of your existing Virtual Private Cloud.\nYou can find this in the AWS Console under VPC → Your VPCs.', 'vpc-0123456789abcdef0');
+        explainField('VPC ID', 'The ID of your existing Virtual Private Cloud.\nYou can find this in the AWS Console under VPC > Your VPCs.', 'vpc-0123456789abcdef0');
         const customVpcId = await input({
             message: 'VPC ID:',
             validate: (value) => {
@@ -299,7 +358,7 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
                 return true;
             },
         });
-        networking = {
+        return {
             enableVpcEndpoints,
             useCustomNetworking: true,
             customVpcId,
@@ -307,108 +366,117 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
             customPrivateSubnetIds,
         };
     }
-    else {
-        // ============================================================
-        // NEW VPC CREATION
-        // ============================================================
-        console.log();
-        console.log(chalk.green('✨ Creating New VPC'));
-        console.log(chalk.dim('   We\'ll create a new VPC with all necessary networking components.'));
-        console.log(chalk.dim('   You can use the default values or customize them.'));
-        console.log();
-        explainField('VPC CIDR Block', 'This is the IP address range for your entire VPC (in CIDR notation).\nThe default (10.0.0.0/16) gives you 65,536 IP addresses, which is plenty for most deployments.\n\n' +
-            chalk.green('💡 Tip: ') + 'Press Enter to use the default unless you have specific networking requirements.', '10.0.0.0/16 (default, recommended)');
-        const vpcCidr = await input({
-            message: 'VPC CIDR Block:',
-            default: '10.0.0.0/16',
-            validate: (value) => {
-                if (!value)
-                    return 'VPC CIDR is required';
-                if (!/^\d+\.\d+\.\d+\.\d+\/\d+$/.test(value)) {
-                    return 'Must be a valid CIDR block (e.g., 10.0.0.0/16)';
+    // New VPC Creation
+    console.log();
+    console.log(chalk.green('  Creating New VPC'));
+    console.log(chalk.dim('  We\'ll create a new VPC with all necessary networking components.'));
+    console.log(chalk.dim('  You can use the default values or customize them.'));
+    console.log();
+    explainField('VPC CIDR Block', 'This is the IP address range for your entire VPC (in CIDR notation).\nThe default (10.0.0.0/16) gives you 65,536 IP addresses, which is plenty for most deployments.\n\n' +
+        chalk.green('  Tip: ') + 'Press Enter to use the default unless you have specific networking requirements.', '10.0.0.0/16 (default, recommended)');
+    const vpcCidr = await input({
+        message: 'VPC CIDR Block:',
+        default: '10.0.0.0/16',
+        validate: (value) => {
+            if (!value)
+                return 'VPC CIDR is required';
+            if (!/^\d+\.\d+\.\d+\.\d+\/\d+$/.test(value)) {
+                return 'Must be a valid CIDR block (e.g., 10.0.0.0/16)';
+            }
+            return true;
+        },
+    });
+    explainField('Public Subnet CIDRs', 'IP ranges for public subnets (have internet access). Format as a JSON array.\nEach subnet will be created in a different availability zone for high availability.\n\n' +
+        chalk.green('  Tip: ') + 'Press Enter to use the defaults.', '["10.0.0.0/24","10.0.3.0/24"]');
+    const publicSubnetCidrs = await input({
+        message: 'Public Subnet CIDRs (JSON array):',
+        default: '["10.0.0.0/24","10.0.3.0/24"]',
+        validate: (value) => {
+            if (!value)
+                return 'Public subnet CIDRs are required';
+            try {
+                const parsed = JSON.parse(value);
+                if (!Array.isArray(parsed) || parsed.length === 0) {
+                    return 'Must be a non-empty JSON array';
                 }
                 return true;
-            },
-        });
-        explainField('Public Subnet CIDRs', 'IP ranges for public subnets (have internet access). Format as a JSON array.\nEach subnet will be created in a different availability zone for high availability.\n\n' +
-            chalk.green('💡 Tip: ') + 'Press Enter to use the defaults.', '["10.0.0.0/24","10.0.3.0/24"]');
-        const publicSubnetCidrs = await input({
-            message: 'Public Subnet CIDRs (JSON array):',
-            default: '["10.0.0.0/24","10.0.3.0/24"]',
-            validate: (value) => {
-                if (!value)
-                    return 'Public subnet CIDRs are required';
-                try {
-                    const parsed = JSON.parse(value);
-                    if (!Array.isArray(parsed) || parsed.length === 0) {
-                        return 'Must be a non-empty JSON array';
-                    }
-                    return true;
-                }
-                catch {
-                    return 'Must be valid JSON array (e.g., ["10.0.0.0/24","10.0.3.0/24"])';
-                }
-            },
-        });
-        explainField('Private Subnet CIDRs', 'IP ranges for private subnets (no direct internet access). Format as a JSON array.\nThese are used for databases and application servers that don\'t need public access.\n\n' +
-            chalk.green('💡 Tip: ') + 'Press Enter to use the defaults.', '["10.0.1.0/24","10.0.2.0/24"]');
-        const privateSubnetCidrs = await input({
-            message: 'Private Subnet CIDRs (JSON array):',
-            default: '["10.0.1.0/24","10.0.2.0/24"]',
-            validate: (value) => {
-                if (!value)
-                    return 'Private subnet CIDRs are required';
-                try {
-                    const parsed = JSON.parse(value);
-                    if (!Array.isArray(parsed) || parsed.length === 0) {
-                        return 'Must be a non-empty JSON array';
-                    }
-                    return true;
-                }
-                catch {
-                    return 'Must be valid JSON array (e.g., ["10.0.1.0/24","10.0.2.0/24"])';
+            }
+            catch {
+                return 'Must be valid JSON array (e.g., ["10.0.0.0/24","10.0.3.0/24"])';
+            }
+        },
+    });
+    explainField('Private Subnet CIDRs', 'IP ranges for private subnets (no direct internet access). Format as a JSON array.\nThese are used for databases and application servers that don\'t need public access.\n\n' +
+        chalk.green('  Tip: ') + 'Press Enter to use the defaults.', '["10.0.1.0/24","10.0.2.0/24"]');
+    const privateSubnetCidrs = await input({
+        message: 'Private Subnet CIDRs (JSON array):',
+        default: '["10.0.1.0/24","10.0.2.0/24"]',
+        validate: (value) => {
+            if (!value)
+                return 'Private subnet CIDRs are required';
+            try {
+                const parsed = JSON.parse(value);
+                if (!Array.isArray(parsed) || parsed.length === 0) {
+                    return 'Must be a non-empty JSON array';
                 }
-            },
-        });
-        explainField('Availability Zones', 'AWS Availability Zones are isolated locations within a region.\nUsing multiple AZs provides high availability and fault tolerance.\n\n' +
-            chalk.green('✓ Recommended: ') + '2 AZs is sufficient for most deployments.', '2 (recommended)');
-        const azCount = await select({
-            message: 'Number of Availability Zones:',
-            choices: [
-                { name: '2 (recommended - good balance of cost and availability)', value: '2' },
-                { name: '3 (maximum availability)', value: '3' },
-            ],
-            default: '2',
-        });
-        networking = {
-            enableVpcEndpoints,
-            useCustomNetworking: false,
-            vpcCidr,
-            publicSubnetCidrs,
-            privateSubnetCidrs,
-            azCount,
+                return true;
+            }
+            catch {
+                return 'Must be valid JSON array (e.g., ["10.0.1.0/24","10.0.2.0/24"])';
+            }
+        },
+    });
+    explainField('Availability Zones', 'AWS Availability Zones are isolated locations within a region.\nUsing multiple AZs provides high availability and fault tolerance.\n\n' +
+        chalk.green('  Recommended: ') + '2 AZs is sufficient for most deployments.', '2 (recommended)');
+    const azCount = await select({
+        message: 'Number of Availability Zones:',
+        choices: [
+            { name: '2 (recommended - good balance of cost and availability)', value: '2' },
+            { name: '3 (maximum availability)', value: '3' },
+        ],
+        default: '2',
+    });
+    return {
+        enableVpcEndpoints,
+        useCustomNetworking: false,
+        vpcCidr,
+        publicSubnetCidrs,
+        privateSubnetCidrs,
+        azCount,
+    };
+}
+// ============================================================
+// STEP: SECURITY & IAM
+// ============================================================
+async function promptSecurity(ctx, stepNumber) {
+    // Express mode: skip entirely
+    if (ctx.mode === 'express') {
+        ui.info('Using default Security: No custom security groups, no custom IAM roles');
+        console.log();
+        return {
+            useCustomSecurityGroups: false,
+            useCustomIamPolicies: false,
         };
     }
-    // ============================================================
-    // STEP 5: SECURITY & IAM (OPTIONAL)
-    // ============================================================
-    ui.section('Step 5: Security & IAM (Optional)');
-    console.log(chalk.dim('🔒 Configure advanced security settings.'));
-    console.log(chalk.dim('   These are optional. Most users can skip this section by pressing Enter.'));
+    // Advanced mode: prompt
+    ui.stepHeader(stepNumber, getStepCount(ctx.mode), 'Security & IAM (Optional)');
+    console.log(chalk.dim('  Configure advanced security settings.'));
+    console.log(chalk.dim('  These are optional. Most users can skip this section by pressing Enter.'));
     console.log();
     // KMS Key
     explainField('Workflow Runs KMS Key (Optional)', 'AWS KMS (Key Management Service) key for encrypting workflow execution data.\nLeave blank to use AWS-managed encryption (recommended for most users).\n\n' +
-        chalk.green('💡 Tip: ') + 'Press Enter to skip unless you have specific compliance requirements.', 'alias/my-kms-key or leave blank');
+        chalk.green('  Tip: ') + 'Press Enter to skip unless you have specific compliance requirements.', 'alias/my-kms-key or leave blank');
     const workflowRunsKeyAlias = await input({
         message: 'Workflow Runs KMS Key Alias (press Enter to skip):',
         default: '',
     });
     // Custom Security Groups
     console.log();
-    console.log(chalk.cyan('❓ ' + chalk.bold('Custom Security Groups')));
+    console.log(chalk.cyan('  ' + chalk.bold('Custom Security Groups')));
     console.log(chalk.dim('   Security groups control network traffic to/from AWS resources.'));
-    console.log(chalk.dim('   • ' + chalk.white('No') + ' - We\'ll create new security groups with proper rules (recommended)'));
-    console.log(chalk.dim('   • ' + chalk.white('Yes') + ' - You provide existing security group IDs (for advanced users)'));
+    console.log(chalk.dim('   - ' + chalk.white('No') + ' - We\'ll create new security groups with proper rules (recommended)'));
+    console.log(chalk.dim('   - ' + chalk.white('Yes') + ' - You provide existing security group IDs (for advanced users)'));
+    ui.costSignal('Selecting Yes will ask for 8 security group IDs');
     console.log();
     const useCustomSecurityGroups = await confirm({
         message: 'Use custom security groups?',
@@ -417,8 +485,8 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
     let customSecurityGroups = undefined;
     if (useCustomSecurityGroups) {
         console.log();
-        console.log(chalk.yellow('📝 Custom Security Groups'));
-        console.log(chalk.dim('   Provide the security group IDs from AWS Console.'));
+        console.log(chalk.yellow('  Custom Security Groups'));
+        console.log(chalk.dim('  Provide the security group IDs from AWS Console.'));
         console.log();
         customSecurityGroups = {
             workflowEngine: await input({
@@ -457,10 +525,11 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
     }
     // Custom IAM Roles
     console.log();
-    console.log(chalk.cyan('❓ ' + chalk.bold('Custom IAM Roles')));
+    console.log(chalk.cyan('  ' + chalk.bold('Custom IAM Roles')));
     console.log(chalk.dim('   IAM roles define permissions for AWS resources.'));
-    console.log(chalk.dim('   • ' + chalk.white('No') + ' - We\'ll create new IAM roles with proper permissions (recommended)'));
-    console.log(chalk.dim('   • ' + chalk.white('Yes') + ' - You provide existing IAM role ARNs (for advanced users)'));
+    console.log(chalk.dim('   - ' + chalk.white('No') + ' - We\'ll create new IAM roles with proper permissions (recommended)'));
+    console.log(chalk.dim('   - ' + chalk.white('Yes') + ' - You provide existing IAM role ARNs (for advanced users)'));
+    ui.costSignal('Selecting Yes will ask for 10 IAM role ARNs');
     console.log();
     const useCustomIamPolicies = await confirm({
         message: 'Use custom IAM roles?',
@@ -469,8 +538,8 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
     let customIamRoles = undefined;
     if (useCustomIamPolicies) {
         console.log();
-        console.log(chalk.yellow('📝 Custom IAM Roles'));
-        console.log(chalk.dim('   Provide the IAM role ARNs from AWS Console.'));
+        console.log(chalk.yellow('  Custom IAM Roles'));
+        console.log(chalk.dim('  Provide the IAM role ARNs from AWS Console.'));
         console.log();
         const validateRoleArn = (v) => !v || /^arn:aws:iam::\d{12}:role\/.+$/.test(v) || 'Must be valid IAM role ARN';
         customIamRoles = {
@@ -516,25 +585,38 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
             }),
         };
     }
-    // ============================================================
-    // STEP 6: DNS & TLS CONFIGURATION
-    // ============================================================
-    ui.section('Step 6: DNS & TLS Configuration');
-    console.log(chalk.dim('🔐 Configure custom domains and SSL/TLS certificates for secure HTTPS access.'));
-    console.log();
-    console.log(chalk.dim('📌 ' + chalk.bold('Architecture Overview:')));
-    console.log(chalk.dim('   Sembix Studio uses a certificate hierarchy for TLS:'));
-    console.log(chalk.dim('   1. Primary Certificate → Wildcard certificate used by all components'));
-    console.log(chalk.dim('   2. Component Overrides → CloudFront, Public ALB, Internal ALB can use specific certificates'));
-    console.log(chalk.dim('   If no override is provided, the component uses the primary certificate.'));
+    return {
+        workflowRunsKeyAlias: workflowRunsKeyAlias || undefined,
+        useCustomSecurityGroups,
+        customSecurityGroups,
+        useCustomIamPolicies,
+        customIamRoles,
+    };
+}
+// ============================================================
+// STEP: DNS & TLS CONFIGURATION
+// ============================================================
+async function promptTls(ctx, stepNumber, awsRegion) {
+    ui.stepHeader(stepNumber, getStepCount(ctx.mode), 'DNS & TLS Configuration');
+    console.log(chalk.dim('  Configure custom domains and SSL/TLS certificates for secure HTTPS access.'));
     console.log();
-    // Primary Certificate
-    const certificateArn = await promptIfMissing(partialConfig?.tls?.certificateArn, async () => {
-        explainField('Primary Certificate (Optional)', 'A wildcard ACM certificate used as the default for all TLS components.\nComponent-specific certificates below can override this for individual components.\n\n' +
-            chalk.red('⚠️  IMPORTANT: ') + 'This certificate ' + chalk.bold('MUST') + ' be in the ' + chalk.bold('us-east-1') + ' region.\n' +
-            '   (CloudFront may use this certificate as a fallback, which requires us-east-1)\n\n' +
-            chalk.green('💡 Tip: ') + 'If you have a wildcard certificate (*.example.com), provide it here.\n' +
-            '   Individual components can still use their own certificates.', 'arn:aws:acm:us-east-1:123456789012:certificate/wildcard-123... (or leave blank)');
+    const { partialConfig, mode } = ctx;
+    // Certificate hierarchy diagram (Advanced only — shows override options)
+    if (mode === 'advanced') {
+        console.log(chalk.dim('  Certificate Hierarchy:'));
+        console.log(chalk.dim('     Primary Cert (used for all components)'));
+        console.log(chalk.dim('       |-- CloudFront    (can override, must be us-east-1)'));
+        console.log(chalk.dim('       |-- Public ALB    (can override)'));
+        console.log(chalk.dim('       +-- Private ALB   (can override)'));
+        console.log();
+    }
+    // ─── Primary Certificate ───
+    let certificateArn = await promptIfMissing(partialConfig?.tls?.certificateArn, async () => {
+        explainField('Primary Certificate (Optional)', 'An ACM certificate used for all TLS components (CloudFront, public ALB, private ALB).\n' +
+            (mode === 'advanced' ? 'Component-specific certificates can override this in the sections below.\n\n' : '\n') +
+            chalk.red('  IMPORTANT: ') + 'This certificate ' + chalk.bold('MUST') + ' be in the ' + chalk.bold('us-east-1') + ' region.\n' +
+            '   (CloudFront requires us-east-1, so a single cert here must be in that region)\n\n' +
+            chalk.green('  Tip: ') + 'If you have a wildcard certificate (*.example.com), provide it here.', 'arn:aws:acm:us-east-1:123456789012:certificate/wildcard-123... (or leave blank)');
         return input({
             message: 'Primary Certificate ARN (must be in us-east-1, press Enter to skip):',
             default: '',
@@ -550,16 +632,21 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
                 return true;
             },
         });
-    }, 'Primary Certificate ARN');
-    // CloudFront Domain
+    }, 'Primary Certificate ARN') || undefined;
+    const hasPrimaryCert = !!certificateArn;
+    // ─── CloudFront ───
+    ui.subsectionHeader('CloudFront');
+    // ─── CloudFront ───
+    ui.subsectionHeader('CloudFront');
     const cloudfrontDomain = await promptIfMissing(partialConfig?.tls?.cloudfrontDomain, async () => {
-        explainField('CloudFront Domain', 'The custom domain name for your Studio UI (the website users will visit).\nThis domain must match the SSL certificate you provide below.\n\n' +
-            chalk.green('💡 Example: ') + 'If your company is Acme Corp, you might use: studio.acme.com', 'studio.example.com or studio.acme.com');
+        explainField('CloudFront Domain (Optional)', 'A custom domain name for your Studio UI (the website users will visit).\nThis domain must match the SSL certificate you provide.\nLeave blank to use the default CloudFront domain (e.g. d1234abcdef.cloudfront.net).\n\n' +
+            chalk.green('  Example: ') + 'If your company is Acme Corp, you might use: studio.acme.com', 'studio.example.com or studio.acme.com (or leave blank for default CloudFront domain)');
         return input({
-            message: 'CloudFront Domain:',
+            message: 'CloudFront Domain (press Enter to skip):',
+            default: '',
             validate: (value) => {
                 if (!value)
-                    return 'CloudFront domain is required';
+                    return true;
                 if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/.test(value)) {
                     return 'Must be a valid domain name';
                 }
@@ -567,129 +654,171 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
             },
         });
     }, 'CloudFront Domain');
-    const hasPrimaryCert = !!certificateArn;
-    // CloudFront Certificate
-    const cloudfrontCertArn = await promptIfMissing(partialConfig?.tls?.cloudfrontCertArn, async () => {
-        explainField(hasPrimaryCert ? 'CloudFront Certificate (Optional)' : 'CloudFront Certificate', 'The ACM certificate ARN for CloudFront.' + (hasPrimaryCert ? ' Overrides the primary certificate for CloudFront.' : '') + '\n\n' +
-            chalk.red('⚠️  IMPORTANT: ') + 'This certificate ' + chalk.bold('MUST') + ' be in the ' + chalk.bold('us-east-1') + ' region.\n' +
-            '   (This is a CloudFront requirement, even if your infrastructure is in a different region)\n\n' +
-            chalk.green('💡 Tip: ') + (hasPrimaryCert
-            ? 'Leave blank to use the primary certificate for CloudFront.'
-            : 'Create the certificate in ACM in us-east-1, then copy the ARN here.'), 'arn:aws:acm:us-east-1:123456789012:certificate/abc123...' + (hasPrimaryCert ? ' (or leave blank)' : ''));
-        return input({
-            message: 'CloudFront Certificate ARN (must be in us-east-1' + (hasPrimaryCert ? ', press Enter to skip' : '') + '):',
-            default: hasPrimaryCert ? '' : undefined,
-            validate: (value) => {
-                if (!value) {
-                    if (hasPrimaryCert)
-                        return true;
-                    return 'CloudFront certificate ARN is required (no primary certificate provided)';
-                }
-                const result = acmCertArnSchema.safeParse(value);
-                if (!result.success)
-                    return 'Must be a valid ACM certificate ARN';
-                if (!value.includes('us-east-1')) {
-                    return chalk.red('ERROR: ') + 'CloudFront certificate MUST be in us-east-1 region (CloudFront requirement)';
-                }
-                return true;
-            },
-        });
-    }, 'CloudFront Certificate ARN');
-    // Public ALB Certificate
-    const bffAlbCertificateArn = await promptIfMissing(partialConfig?.tls?.bffAlbCertificateArn, async () => {
-        explainField(hasPrimaryCert ? 'Public ALB Certificate (Optional)' : 'Public ALB Certificate', 'The ACM certificate ARN for the public-facing BFF API load balancer.' + (hasPrimaryCert ? '\nOverrides the primary certificate for the public ALB.' : '') + '\n\n' +
-            chalk.green('💡 Tip: ') + (hasPrimaryCert
-            ? 'Leave blank to use the primary certificate for the public ALB.'
-            : 'This certificate should be in the same region as your infrastructure.'), 'arn:aws:acm:' + awsRegion + ':123456789012:certificate/def456...' + (hasPrimaryCert ? ' (or leave blank)' : ''));
-        return input({
-            message: 'Public ALB Certificate ARN' + (hasPrimaryCert ? ' (press Enter to skip):' : ':'),
-            default: hasPrimaryCert ? '' : undefined,
-            validate: (value) => {
-                if (!value) {
-                    if (hasPrimaryCert)
+    // ─── Component certificate overrides (Advanced only) ───
+    // In express mode, the primary certificate is used for all components.
+    let cloudfrontCertArn;
+    let bffAlbCertificateArn;
+    if (mode === 'advanced') {
+        // CloudFront certificate override — only if a custom domain was provided
+        // (the default CloudFront domain uses its own built-in certificate)
+        if (cloudfrontDomain || partialConfig?.tls?.cloudfrontCertArn) {
+            cloudfrontCertArn = await promptIfMissing(partialConfig?.tls?.cloudfrontCertArn, async () => {
+                explainField(hasPrimaryCert ? 'CloudFront Certificate (Optional)' : 'CloudFront Certificate', 'The ACM certificate ARN for CloudFront.' + (hasPrimaryCert ? ' Overrides the primary certificate for CloudFront.' : '') + '\n\n' +
+                    chalk.red('  IMPORTANT: ') + 'This certificate ' + chalk.bold('MUST') + ' be in the ' + chalk.bold('us-east-1') + ' region.\n' +
+                    '   (This is a CloudFront requirement, even if your infrastructure is in a different region)\n\n' +
+                    chalk.green('  Tip: ') + (hasPrimaryCert
+                    ? 'Leave blank to use the primary certificate for CloudFront.'
+                    : 'Create the certificate in ACM in us-east-1, then copy the ARN here.'), 'arn:aws:acm:us-east-1:123456789012:certificate/abc123...' + (hasPrimaryCert ? ' (or leave blank)' : ''));
+                return input({
+                    message: 'CloudFront Certificate ARN (must be in us-east-1' + (hasPrimaryCert ? ', press Enter to skip' : '') + '):',
+                    default: hasPrimaryCert ? '' : undefined,
+                    validate: (value) => {
+                        if (!value) {
+                            if (hasPrimaryCert)
+                                return true;
+                            return 'CloudFront certificate ARN is required (no primary certificate provided)';
+                        }
+                        const result = acmCertArnSchema.safeParse(value);
+                        if (!result.success)
+                            return 'Must be a valid ACM certificate ARN';
+                        if (!value.includes('us-east-1')) {
+                            return chalk.red('ERROR: ') + 'CloudFront certificate MUST be in us-east-1 region (CloudFront requirement)';
+                        }
                         return true;
-                    return 'Public ALB certificate ARN is required (no primary certificate provided)';
-                }
-                const result = acmCertArnSchema.safeParse(value);
-                if (!result.success)
-                    return 'Must be a valid ACM certificate ARN';
-                return true;
-            },
-        });
-    }, 'Public ALB Certificate ARN');
-    // BFF ALB Internal - only prompt when a BFF ALB certificate is available
-    const hasBffAlbCert = !!(bffAlbCertificateArn || certificateArn);
-    let bffAlbInternal;
-    if (hasBffAlbCert) {
-        bffAlbInternal = partialConfig?.tls?.bffAlbInternal ?? await (async () => {
-            console.log();
-            console.log(chalk.cyan('❓ ' + chalk.bold('Force BFF ALB Internal')));
-            console.log(chalk.dim('   When enabled, the BFF ALB will be internal even though a certificate is provided.'));
-            console.log(chalk.dim('   Use this for private DNS with ACM Private CA configurations.'));
-            console.log();
-            return confirm({
-                message: 'Force BFF ALB to be internal? (for private DNS with ACM Private CA)',
-                default: false,
+                    },
+                });
+            }, 'CloudFront Certificate ARN');
+        }
+        // Public ALB certificate override
+        ui.subsectionHeader('Public ALB');
+        bffAlbCertificateArn = await promptIfMissing(partialConfig?.tls?.bffAlbCertificateArn, async () => {
+            explainField(hasPrimaryCert ? 'Public ALB Certificate (Optional)' : 'Public ALB Certificate', 'The ACM certificate ARN for the public-facing BFF API load balancer.' + (hasPrimaryCert ? '\nOverrides the primary certificate for the public ALB.' : '') + '\n\n' +
+                chalk.green('  Tip: ') + (hasPrimaryCert
+                ? 'Leave blank to use the primary certificate for the public ALB.'
+                : 'This certificate should be in the same region as your infrastructure.'), 'arn:aws:acm:' + awsRegion + ':123456789012:certificate/def456...' + (hasPrimaryCert ? ' (or leave blank)' : ''));
+            return input({
+                message: 'Public ALB Certificate ARN' + (hasPrimaryCert ? ' (press Enter to skip):' : ':'),
+                default: hasPrimaryCert ? '' : undefined,
+                validate: (value) => {
+                    if (!value) {
+                        if (hasPrimaryCert)
+                            return true;
+                        return 'Public ALB certificate ARN is required (no primary certificate provided)';
+                    }
+                    const result = acmCertArnSchema.safeParse(value);
+                    if (!result.success)
+                        return 'Must be a valid ACM certificate ARN';
+                    return true;
+                },
             });
-        })();
+        }, 'Public ALB Certificate ARN');
+    }
+    else {
+        // Express: use config overrides if present, otherwise primary cert covers everything
+        cloudfrontCertArn = partialConfig?.tls?.cloudfrontCertArn;
+        bffAlbCertificateArn = partialConfig?.tls?.bffAlbCertificateArn;
     }
-    // BFF ALB Ingress CIDR Blocks - only prompt if bffAlbInternal is true
+    // BFF ALB Internal + Ingress CIDRs (Advanced only)
+    let bffAlbInternal;
     let bffAlbIngressCidrBlocks;
-    if (bffAlbInternal) {
-        if (partialConfig?.tls?.bffAlbIngressCidrBlocks?.length) {
-            bffAlbIngressCidrBlocks = partialConfig.tls.bffAlbIngressCidrBlocks;
-            ui.info(`Using BFF ALB Ingress CIDRs: ${ui.highlight(bffAlbIngressCidrBlocks.join(', '))} (from config)`);
-            console.log();
+    if (mode === 'advanced') {
+        const hasBffAlbCert = !!(bffAlbCertificateArn || certificateArn);
+        if (hasBffAlbCert) {
+            bffAlbInternal = partialConfig?.tls?.bffAlbInternal ?? await (async () => {
+                console.log();
+                console.log(chalk.cyan('  ' + chalk.bold('Force BFF ALB Internal')));
+                console.log(chalk.dim('   When enabled, the BFF ALB will be internal even though a certificate is provided.'));
+                console.log(chalk.dim('   Use this for private DNS with ACM Private CA configurations.'));
+                console.log();
+                return confirm({
+                    message: 'Force BFF ALB to be internal? (for private DNS with ACM Private CA)',
+                    default: false,
+                });
+            })();
         }
-        else {
-            explainField('BFF ALB Ingress CIDR Blocks (Optional)', 'Restrict which CIDR blocks can reach the internal BFF ALB.\nLeave blank to fall back to VPC CIDR (Terraform default).', '10.0.0.0/8,172.16.0.0/12');
-            const cidrInput = await input({
-                message: 'CIDR blocks for internal BFF ALB ingress (comma-separated, press Enter to skip):',
+        if (bffAlbInternal) {
+            if (partialConfig?.tls?.bffAlbIngressCidrBlocks?.length) {
+                bffAlbIngressCidrBlocks = partialConfig.tls.bffAlbIngressCidrBlocks;
+                ui.info(`Using BFF ALB Ingress CIDRs: ${ui.highlight(bffAlbIngressCidrBlocks.join(', '))} (from config)`);
+                console.log();
+            }
+            else {
+                explainField('BFF ALB Ingress CIDR Blocks (Optional)', 'Restrict which CIDR blocks can reach the internal BFF ALB.\nLeave blank to fall back to VPC CIDR (Terraform default).', '10.0.0.0/8,172.16.0.0/12');
+                const cidrInput = await input({
+                    message: 'CIDR blocks for internal BFF ALB ingress (comma-separated, press Enter to skip):',
+                    default: '',
+                    validate: (value) => {
+                        if (!value)
+                            return true;
+                        const cidrs = value.split(',').map(c => c.trim());
+                        const cidrRegex = /^\d+\.\d+\.\d+\.\d+\/\d+$/;
+                        for (const cidr of cidrs) {
+                            if (!cidrRegex.test(cidr)) {
+                                return `Invalid CIDR block: ${cidr}`;
+                            }
+                        }
+                        return true;
+                    },
+                });
+                if (cidrInput) {
+                    bffAlbIngressCidrBlocks = cidrInput.split(',').map(c => c.trim());
+                }
+            }
+        }
+    }
+    // ─── Private Services ALB ─── (Advanced only)
+    let bffInternalAlbCertificateArn;
+    let privateCaCertSecretArn;
+    if (mode === 'advanced') {
+        ui.subsectionHeader('Private Services ALB');
+        bffInternalAlbCertificateArn = await promptIfMissing(partialConfig?.tls?.bffInternalAlbCertificateArn, async () => {
+            explainField('Private Services ALB Certificate (Optional)', 'The ACM certificate ARN for the private services load balancer.\nThis ALB handles internal service-to-service traffic (e.g. workspace runtime, websockets).\nOverrides the primary certificate for this ALB.\n\n' +
+                chalk.green('  Tip: ') + 'Leave blank to use the primary certificate.', 'arn:aws:acm:' + awsRegion + ':123456789012:certificate/ghi789... (or leave blank)');
+            return input({
+                message: 'Private Services ALB Certificate ARN (press Enter to skip):',
                 default: '',
                 validate: (value) => {
                     if (!value)
                         return true;
-                    const cidrs = value.split(',').map(c => c.trim());
-                    const cidrRegex = /^\d+\.\d+\.\d+\.\d+\/\d+$/;
-                    for (const cidr of cidrs) {
-                        if (!cidrRegex.test(cidr)) {
-                            return `Invalid CIDR block: ${cidr}`;
-                        }
-                    }
+                    const result = acmCertArnSchema.safeParse(value);
+                    if (!result.success)
+                        return 'Must be a valid ACM certificate ARN';
                     return true;
                 },
             });
-            if (cidrInput) {
-                bffAlbIngressCidrBlocks = cidrInput.split(',').map(c => c.trim());
-            }
-        }
+        }, 'Private Services ALB Certificate ARN') || undefined;
+        privateCaCertSecretArn = await promptIfMissing(partialConfig?.tls?.privateCaCertSecretArn, async () => {
+            explainField('Private CA Certificate Secret (Optional)', 'If either load balancer uses an ACM Private CA certificate, services need the CA\nroot certificate to trust it. Provide the Secrets Manager ARN that holds the PEM file.', 'arn:aws:secretsmanager:' + awsRegion + ':123456789012:secret:my-private-ca-pem-AbCdEf');
+            return input({
+                message: 'Private CA Cert Secret ARN (press Enter to skip):',
+                default: '',
+                validate: (value) => {
+                    if (!value)
+                        return true;
+                    const result = secretsManagerArnSchema.safeParse(value);
+                    if (!result.success)
+                        return 'Must be a valid AWS Secrets Manager ARN';
+                    return true;
+                },
+            });
+        }, 'Private CA Cert Secret ARN') || undefined;
+    }
+    else {
+        // Express: use config values if present
+        bffInternalAlbCertificateArn = partialConfig?.tls?.bffInternalAlbCertificateArn;
+        privateCaCertSecretArn = partialConfig?.tls?.privateCaCertSecretArn;
     }
-    // Internal ALB Certificate
-    const bffInternalAlbCertificateArn = await promptIfMissing(partialConfig?.tls?.bffInternalAlbCertificateArn, async () => {
-        explainField('Internal ALB Certificate (Optional)', 'The ACM certificate ARN for the internal BFF API load balancer.\nOverrides the primary certificate for internal communication.\n\n' +
-            chalk.green('💡 Tip: ') + 'Leave blank to use the primary certificate for internal ALB.', 'arn:aws:acm:' + awsRegion + ':123456789012:certificate/ghi789... (or leave blank)');
+    // ─── DNS ───
+    ui.subsectionHeader('DNS');
+    const hostedZoneId = await promptIfMissing(partialConfig?.tls?.hostedZoneId, async () => {
+        explainField('Route53 Hosted Zone ID (Optional)', 'The ID of your Route53 hosted zone where DNS records will be automatically created.\nYou can find this in the AWS Console under Route53 > Hosted zones.\nLeave blank if not using public DNS (e.g. internal ALB with ACM Private CA).\n\n' +
+            chalk.green('  Tip: ') + 'The hosted zone should manage the domain you\'re using (e.g., example.com).', 'Z1234567890ABC (or leave blank)');
         return input({
-            message: 'Internal ALB Certificate ARN (press Enter to skip):',
+            message: 'Route53 Hosted Zone ID (press Enter to skip):',
             default: '',
             validate: (value) => {
                 if (!value)
                     return true;
-                const result = acmCertArnSchema.safeParse(value);
-                if (!result.success)
-                    return 'Must be a valid ACM certificate ARN';
-                return true;
-            },
-        });
-    }, 'Internal ALB Certificate ARN');
-    // Hosted Zone ID
-    const hostedZoneId = await promptIfMissing(partialConfig?.tls?.hostedZoneId, async () => {
-        explainField('Route53 Hosted Zone ID', 'The ID of your Route53 hosted zone where DNS records will be automatically created.\nYou can find this in the AWS Console under Route53 → Hosted zones.\n\n' +
-            chalk.green('💡 Tip: ') + 'The hosted zone should manage the domain you\'re using (e.g., example.com).', 'Z1234567890ABC');
-        return input({
-            message: 'Route53 Hosted Zone ID:',
-            validate: (value) => {
-                if (!value)
-                    return 'Hosted Zone ID is required';
                 const result = route53ZoneIdSchema.safeParse(value);
                 if (!result.success)
                     return 'Must be a valid Route53 hosted zone ID (starts with Z)';
@@ -697,37 +826,52 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
             },
         });
     }, 'Route53 Hosted Zone ID');
-    // ============================================================
-    // STEP 7: FEATURE CONFIGURATION
-    // ============================================================
-    ui.section('Step 7: Feature Configuration');
-    console.log(chalk.dim('🎛️  Enable or disable optional Sembix Studio services.'));
-    console.log(chalk.dim('   Configure notifications and web application firewall settings.'));
+    return {
+        certificateArn: certificateArn || undefined,
+        cloudfrontDomain: cloudfrontDomain || undefined,
+        cloudfrontCertArn: cloudfrontCertArn || undefined,
+        bffAlbCertificateArn: bffAlbCertificateArn || undefined,
+        bffAlbInternal: bffAlbInternal || undefined,
+        bffAlbIngressCidrBlocks: bffAlbIngressCidrBlocks?.length ? bffAlbIngressCidrBlocks : undefined,
+        bffInternalAlbCertificateArn: bffInternalAlbCertificateArn || undefined,
+        privateCaCertSecretArn: privateCaCertSecretArn || undefined,
+        hostedZoneId: hostedZoneId || undefined,
+    };
+}
+// ============================================================
+// STEP: FEATURE CONFIGURATION
+// ============================================================
+async function promptFeatures(ctx, stepNumber) {
+    // Express mode: auto-enable WAF
+    if (ctx.mode === 'express') {
+        ui.info('Using default Features: WAF enabled');
+        console.log();
+        return { enableBffWaf: true };
+    }
+    // Advanced mode: prompt
+    ui.stepHeader(stepNumber, getStepCount(ctx.mode), 'Feature Configuration');
+    console.log(chalk.dim('  Enable or disable optional Sembix Studio services.'));
+    console.log(chalk.dim('  Configure web application firewall settings.'));
     console.log();
-    // Sembix Studio Notifications
-    explainField('Sembix Studio Notifications Service', 'The Notifications service handles alerts, messaging, and event notifications.\n\n' +
-        chalk.green('✓ Recommended: ') + 'Enable this feature for user notifications and alerts.', 'Choose Yes (recommended)');
-    const deploySembixStudioNotifications = await confirm({
-        message: 'Deploy Sembix Studio Notifications service?',
-        default: true,
-    });
-    // WAF
     explainField('Web Application Firewall (WAF)', 'AWS WAF protects your BFF API from common web exploits and attacks.\nIt provides an additional layer of security at the application level.\n\n' +
-        chalk.green('✓ Recommended: ') + 'Enable this for production environments.', 'Choose Yes (recommended for production)');
+        chalk.green('  Recommended: ') + 'Enable this for production environments.', 'Choose Yes (recommended for production)');
     const enableBffWaf = await confirm({
         message: 'Enable Web Application Firewall (WAF) for BFF?',
         default: true,
     });
-    // ============================================================
-    // STEP 8: FRONTEND CONFIGURATION
-    // ============================================================
-    ui.section('Step 8: Frontend Configuration');
-    console.log(chalk.dim('⚛️  Configure integrations for the Sembix Studio frontend (React UI).'));
+    return { enableBffWaf };
+}
+// ============================================================
+// STEP: FRONTEND CONFIGURATION
+// ============================================================
+async function promptFrontend(ctx, stepNumber) {
+    ui.stepHeader(stepNumber, getStepCount(ctx.mode), 'Frontend Configuration');
+    console.log(chalk.dim('  Configure integrations for the Sembix Studio frontend (React UI).'));
     console.log();
-    // GitHub App Client ID
+    const { partialConfig } = ctx;
     const githubAppClientId = await promptIfMissing(partialConfig?.frontend?.githubAppClientId, async () => {
         explainField('GitHub App Client ID', 'The OAuth Client ID from your GitHub App.\nThis allows users to authenticate with GitHub and access repositories.\n\n' +
-            chalk.green('💡 Tip: ') + 'Create a GitHub App in your organization settings, then copy the Client ID.', 'Iv1.0123456789abcdef');
+            chalk.green('  Tip: ') + 'Create a GitHub App in your organization settings, then copy the Client ID.', 'Iv1.0123456789abcdef');
         return input({
             message: 'GitHub App Client ID:',
             validate: (value) => {
@@ -737,7 +881,6 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
             },
         });
     }, 'GitHub App Client ID');
-    // GitHub App Name
     const githubAppName = await promptIfMissing(partialConfig?.frontend?.githubAppName, async () => {
         explainField('GitHub App Name', 'The name of your GitHub App (as it appears in GitHub).\nThis is shown to users during the OAuth flow.', 'sembix-studio-app or acme-studio');
         return input({
@@ -749,10 +892,9 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
             },
         });
     }, 'GitHub App Name');
-    // Jira Client ID
     const jiraClientId = await promptIfMissing(partialConfig?.frontend?.jiraClientId, async () => {
         explainField('Jira Client ID', 'The OAuth Client ID from your Atlassian/Jira app.\nThis enables Jira integration for issue tracking and project management.\n\n' +
-            chalk.green('💡 Tip: ') + 'Create an OAuth app in your Atlassian Developer Console.', 'abc123def456ghi789');
+            chalk.green('  Tip: ') + 'Create an OAuth app in your Atlassian Developer Console.', 'abc123def456ghi789');
         return input({
             message: 'Jira Client ID:',
             validate: (value) => {
@@ -762,44 +904,103 @@ export async function promptEnvironmentSetup(githubClient, providedEnvironmentNa
             },
         });
     }, 'Jira Client ID');
+    return { githubAppClientId, githubAppName, jiraClientId };
+}
+// ============================================================
+// ORCHESTRATOR
+// ============================================================
+export async function promptEnvironmentSetup(githubClient, providedEnvironmentName, providedRepo, partialConfig, isUpdate = false) {
+    // We need an initial mode to set up step numbering for the first step.
+    // Mode selection happens after repo, so use a preliminary context.
+    const preliminaryCtx = {
+        mode: 'express', // temporary — will be updated after mode selection
+        githubClient,
+        partialConfig,
+        isUpdate,
+    };
+    // Step 1: Repository Selection (always step 1)
+    const repository = await promptRepository(preliminaryCtx, 1, providedRepo);
+    // Mode Selection (between repo and basic config)
+    const mode = await promptModeSelection(partialConfig);
+    const ctx = { mode, githubClient, partialConfig, isUpdate };
+    // Step 2: Basic Configuration
+    const basicConfig = await promptBasicConfig(ctx, 2, repository.owner, repository.repo, providedEnvironmentName);
+    // Steps 3-5: Database, Networking, Security (Advanced only as visible steps)
+    let database;
+    let networking;
+    let security;
+    if (mode === 'advanced') {
+        database = await promptDatabase(ctx, 3);
+        networking = await promptNetworking(ctx, 4);
+        // Checkpoint: Infrastructure
+        ui.checkpoint('Infrastructure Basics', {
+            'Environment': basicConfig.environmentName,
+            'AWS Account': basicConfig.awsAccountId,
+            'Region': basicConfig.awsRegion,
+            'Database': database.name,
+            'Networking': networking.useCustomNetworking ? `Custom VPC (${networking.customVpcId})` : 'New VPC (default)',
+        });
+        security = await promptSecurity(ctx, 5);
+    }
+    else {
+        // Express mode: auto-default DB, Networking, Security
+        database = await promptDatabase(ctx, 0); // step number unused in express
+        networking = await promptNetworking(ctx, 0);
+        security = await promptSecurity(ctx, 0);
+    }
+    // TLS step
+    const tlsStepNumber = mode === 'advanced' ? 6 : 3;
+    const tls = await promptTls(ctx, tlsStepNumber, basicConfig.awsRegion);
+    // Checkpoint: TLS & DNS
+    const tlsCheckpointData = {};
+    if (tls.cloudfrontDomain)
+        tlsCheckpointData['CloudFront Domain'] = tls.cloudfrontDomain;
+    if (tls.cloudfrontCertArn)
+        tlsCheckpointData['CloudFront Cert'] = tls.cloudfrontCertArn;
+    if (tls.bffAlbCertificateArn) {
+        tlsCheckpointData['Public ALB Cert'] = tls.bffAlbCertificateArn;
+    }
+    else if (tls.certificateArn) {
+        tlsCheckpointData['Public ALB Cert'] = '(using primary)';
+    }
+    if (tls.hostedZoneId)
+        tlsCheckpointData['Hosted Zone'] = tls.hostedZoneId;
+    if (Object.keys(tlsCheckpointData).length > 0) {
+        ui.checkpoint('TLS & DNS', tlsCheckpointData);
+    }
+    // Features step (Advanced only as visible step)
+    let features;
+    if (mode === 'advanced') {
+        features = await promptFeatures(ctx, 7);
+    }
+    else {
+        features = await promptFeatures(ctx, 0);
+    }
+    // Frontend step
+    const frontendStepNumber = mode === 'advanced' ? 8 : 4;
+    const frontend = await promptFrontend(ctx, frontendStepNumber);
     return {
-        repository: { owner, repo },
-        environmentName,
-        awsAccountId,
-        awsRegion,
-        customerRoleArn,
-        terraformStateBucket,
+        repository: { owner: repository.owner, repo: repository.repo },
+        environmentName: basicConfig.environmentName,
+        awsAccountId: basicConfig.awsAccountId,
+        awsRegion: basicConfig.awsRegion,
+        customerRoleArn: basicConfig.customerRoleArn,
+        terraformStateBucket: basicConfig.terraformStateBucket,
         database: {
-            name: databaseName,
-            user: databaseUser,
+            name: database.name,
+            user: database.user,
         },
         networking,
         security: {
-            workflowRunsKeyAlias: workflowRunsKeyAlias || undefined,
-            useCustomSecurityGroups,
-            customSecurityGroups,
-            useCustomIamPolicies,
-            customIamRoles,
-        },
-        tls: {
-            certificateArn: certificateArn || undefined,
-            cloudfrontDomain,
-            cloudfrontCertArn: cloudfrontCertArn || undefined,
-            bffAlbCertificateArn: bffAlbCertificateArn || undefined,
-            bffAlbInternal: bffAlbInternal || undefined,
-            bffAlbIngressCidrBlocks: bffAlbIngressCidrBlocks?.length ? bffAlbIngressCidrBlocks : undefined,
-            bffInternalAlbCertificateArn: bffInternalAlbCertificateArn || undefined,
-            hostedZoneId,
-        },
-        features: {
-            deploySembixStudioNotifications,
-            enableBffWaf,
-        },
-        frontend: {
-            githubAppClientId,
-            githubAppName,
-            jiraClientId,
+            workflowRunsKeyAlias: security.workflowRunsKeyAlias,
+            useCustomSecurityGroups: security.useCustomSecurityGroups,
+            customSecurityGroups: security.customSecurityGroups,
+            useCustomIamPolicies: security.useCustomIamPolicies,
+            customIamRoles: security.customIamRoles,
         },
+        tls,
+        features,
+        frontend,
     };
 }
 //# sourceMappingURL=environment-setup.js.map