@elmohq/cli 0.3.0 → 0.4.0

package/dist/index.js

@@ -1,23 +1,249 @@
 #!/usr/bin/env node
-import { spawn, spawnSync } from "node:child_process";
-import crypto, { randomBytes } from "node:crypto";
+import { Command } from "commander";
+import pc from "picocolors";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { spawn, spawnSync } from "node:child_process";
+import crypto, { randomBytes } from "node:crypto";
 import * as p from "@clack/prompts";
-import { Command } from "commander";
 import { parse } from "dotenv";
-import pc from "picocolors";
-import semver from "semver";
 import { PostHog } from "posthog-node";
-//#region ../../packages/config/src/constants.ts
-/**
-* Provider setup guide, linked from SCRAPE_TARGETS errors and the LLMs page.
-* Per-provider anchors are appended to it, so it has to stay the page itself
-* rather than the docs index.
-*/
-const PROVIDERS_DOCS_URL = "https://www.elmohq.com/docs/user-guide/providers";
+import semver from "semver";
+import { fileURLToPath } from "node:url";
+//#region src/compose-pin.ts
+function renderedByHeader(version) {
+	return [`# Rendered by elmo ${version} on ${(/* @__PURE__ */ new Date()).toISOString()}`, "# Run `elmo upgrade` after upgrading the CLI to refresh this file."].join("\n");
+}
+function parseRenderedVersion(contents) {
+	const match = contents.match(/^# Rendered by elmo (\S+) on /m);
+	return match ? match[1] : null;
+}
+function refreshHeaderVersion(contents, version) {
+	if (!/^# Rendered by elmo \S+ on /m.test(contents)) return `${renderedByHeader(version)}\n${contents}`;
+	return contents.replace(/^# Rendered by elmo \S+ on .*$/m, `# Rendered by elmo ${version} on ${(/* @__PURE__ */ new Date()).toISOString()}`);
+}
+function repinImages(contents, version) {
+	return contents.replace(/(image:\s*elmohq\/elmo-[a-z-]+):\S+/g, `$1:${version}`);
+}
+//#endregion
+//#region src/config.ts
+const CONFIG_HOME = path.join(os.homedir(), ".elmo");
+async function resolveConfigDir(explicitDir) {
+	const resolved = explicitDir ? path.resolve(process.cwd(), explicitDir) : CONFIG_HOME;
+	if (!await fileExists(path.join(resolved, "elmo.yaml"))) {
+		if (explicitDir) throw new Error(`Config directory does not contain elmo.yaml: ${resolved}\nRun \`elmo init --dir ${explicitDir}\` to create it.`);
+		throw new Error(`No config found at ${resolved}. Run \`elmo init\` to create one, or specify --dir.`);
+	}
+	return resolved;
+}
+async function writeConfigFiles(configDir, initConfig) {
+	const envPath = path.join(configDir, ".env");
+	const composePath = path.join(configDir, "elmo.yaml");
+	await ensureDir(configDir);
+	await fs.writeFile(envPath, buildEnvFile(initConfig.env, initConfig.version), "utf8");
+	await fs.writeFile(composePath, initConfig.composeYaml, "utf8");
+}
+function buildEnvFile(env, version) {
+	const lines = [
+		renderedByHeader(version),
+		"# WARNING: contains secrets. Do not commit.",
+		""
+	];
+	for (const [key, rawValue] of Object.entries(env)) {
+		if (rawValue === void 0) continue;
+		lines.push(`${key}=${formatEnvValue(rawValue)}`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+function formatEnvValue(value) {
+	if (value === "") return "\"\"";
+	if (/[\s#"']/u.test(value)) return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+	return value;
+}
+async function readRenderedVersion(filePath) {
+	try {
+		return parseRenderedVersion(await fs.readFile(filePath, "utf8"));
+	} catch {
+		return null;
+	}
+}
+async function fileExists(target) {
+	try {
+		await fs.access(target);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function ensureDir(dir) {
+	await fs.mkdir(dir, { recursive: true });
+}
+//#endregion
+//#region src/util.ts
+const ELMO_ASCII = [
+	"",
+	"      ▄▄                ",
+	"      ██                ",
+	"▄█▀█▄ ██ ███▄███▄ ▄███▄ ",
+	"██▄█▀ ██ ██ ██ ██ ██ ██ ",
+	"▀█▄▄▄ ██ ██ ██ ██ ▀███▀ ",
+	""
+].join("\n");
+function printBanner() {
+	console.log(`${ELMO_ASCII}`);
+}
+const log = {
+	info: (msg) => p.log.info(msg),
+	warn: (msg) => p.log.warn(msg),
+	error: (msg) => p.log.error(msg),
+	success: (msg) => p.log.success(msg),
+	step: (msg) => p.log.step(msg)
+};
+function assertNotCancelled(value) {
+	if (p.isCancel(value)) {
+		p.cancel("Setup cancelled.");
+		process.exit(0);
+	}
+}
+function generateSecret(bytes = 32, encoding = "base64url") {
+	return crypto.randomBytes(bytes).toString(encoding);
+}
+function link(text, url) {
+	return `\x1b]8;;${url}\x07${text}\x1b]8;;\x07`;
+}
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function indentBlock(block, spaces) {
+	const indent = " ".repeat(spaces);
+	return block.split("\n").map((line) => `${indent}${line}`).join("\n");
+}
+//#endregion
+//#region src/docker.ts
+async function getComposeServices(configDir) {
+	const output = await runDockerComposeCapture(configDir, [
+		"ps",
+		"--format",
+		"json"
+	]);
+	if (!output.trim()) return [];
+	try {
+		const trimmed = output.trim();
+		const parsed = JSON.parse(trimmed);
+		if (Array.isArray(parsed)) return parsed;
+		if (typeof parsed === "object" && parsed !== null) return [parsed];
+		return [];
+	} catch {
+		try {
+			return output.trim().split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
+		} catch {
+			log.warn("Unable to parse docker compose status.");
+			return [];
+		}
+	}
+}
+function isServiceReady(service) {
+	if (service.Health) return service.Health === "healthy";
+	if (service.State?.startsWith("running")) return true;
+	return false;
+}
+async function waitForHealthy(configDir, timeoutMs) {
+	const start = Date.now();
+	while (Date.now() - start < timeoutMs) {
+		const services = await getComposeServices(configDir);
+		if (services.length > 0 && services.every(isServiceReady)) return true;
+		await sleep(3e3);
+	}
+	return false;
+}
+async function stackHasRunningServices(configDir) {
+	try {
+		return (await getComposeServices(configDir)).some((s) => s.State?.startsWith("running") ?? false);
+	} catch {
+		return false;
+	}
+}
+async function composeUsesBuild(composePath) {
+	try {
+		const contents = await fs.readFile(composePath, "utf8");
+		return /^\s*build:/m.test(contents);
+	} catch {
+		return false;
+	}
+}
+function runDockerCompose(configDir, args) {
+	return new Promise((resolve, reject) => {
+		const commandArgs = [
+			"compose",
+			"-f",
+			path.join(configDir, "elmo.yaml"),
+			...args
+		];
+		spawn("docker", commandArgs, { stdio: "inherit" }).on("close", (code) => {
+			if (code === 0) resolve();
+			else reject(/* @__PURE__ */ new Error(`docker compose exited with code ${code}`));
+		});
+	});
+}
+function runDockerComposeCapture(configDir, args) {
+	return new Promise((resolve, reject) => {
+		const commandArgs = [
+			"compose",
+			"-f",
+			path.join(configDir, "elmo.yaml"),
+			...args
+		];
+		const child = spawn("docker", commandArgs);
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (data) => {
+			stdout += data.toString();
+		});
+		child.stderr.on("data", (data) => {
+			stderr += data.toString();
+		});
+		child.on("close", (code) => {
+			if (code === 0) resolve(stdout);
+			else reject(new Error(stderr || `docker compose exited with code ${code}`));
+		});
+	});
+}
+function assertDockerRunning() {
+	const result = spawnSync("docker", ["info"], { stdio: "ignore" });
+	if (result.error?.code === "ENOENT") throw new Error("Docker does not appear to be installed. Install Docker Desktop or Docker Engine and try again: https://docs.docker.com/get-docker/");
+	if (result.error) throw new Error(`Could not run Docker: ${result.error.message}`);
+	if (result.status !== 0) throw new Error("Docker does not appear to be running. Start Docker and try again.");
+}
+//#endregion
+//#region src/commands/compose.ts
+async function runCompose(args, options) {
+	const configDir = await resolveConfigDir(options.dir);
+	assertDockerRunning();
+	await runDockerCompose(configDir, args);
+}
+//#endregion
+//#region src/commands/edit.ts
+async function runEdit(target, options) {
+	const configDir = await resolveConfigDir(options.dir);
+	let filePath;
+	if (target === "env") filePath = path.join(configDir, ".env");
+	else if (target === "compose") filePath = path.join(configDir, "elmo.yaml");
+	else throw new Error(`Unknown edit target: ${target}. Use \`env\` or \`compose\`.`);
+	if (!await fileExists(filePath)) throw new Error(`File not found: ${filePath}`);
+	const parts = (process.env.VISUAL || process.env.EDITOR || "nano").split(/\s+/).filter(Boolean);
+	const cmd = parts[0] ?? "nano";
+	const args = [...parts.slice(1), filePath];
+	await new Promise((resolve, reject) => {
+		const child = spawn(cmd, args, { stdio: "inherit" });
+		child.on("close", (code) => {
+			if (code === 0) resolve();
+			else reject(/* @__PURE__ */ new Error(`${cmd} exited with code ${code}`));
+		});
+		child.on("error", (err) => reject(err));
+	});
+	log.info("Restart the stack with `elmo compose up -d` to apply changes.");
+}
 //#endregion
 //#region ../../packages/config/src/referrals.ts
 /**
@@ -121,6 +347,14 @@ const PLAN_KEYS = Object.keys(PLANS);
 /** Lowest self-serve monthly price among all plans. */
 const CLOUD_ENTRY_PRICE_USD = Math.min(...PLAN_KEYS.map((key) => PLANS[key].monthlyPriceUsd));
 //#endregion
+//#region ../../packages/config/src/constants.ts
+/**
+* Provider setup guide, linked from SCRAPE_TARGETS errors and the LLMs page.
+* Per-provider anchors are appended to it, so it has to stay the page itself
+* rather than the docs index.
+*/
+const PROVIDERS_DOCS_URL = "https://www.elmohq.com/docs/user-guide/providers";
+//#endregion
 //#region ../../packages/config/src/scrape-targets.ts
 /**
 * The single module that parses and formats the SCRAPE_TARGETS env var.
@@ -170,364 +404,130 @@ function formatScrapeTarget(config) {
 	return parts.join(":");
 }
 //#endregion
-//#region src/compose-pin.ts
-function renderedByHeader(version) {
-	return [`# Rendered by elmo ${version} on ${(/* @__PURE__ */ new Date()).toISOString()}`, "# Run `elmo upgrade` after upgrading the CLI to refresh this file."].join("\n");
-}
-function parseRenderedVersion(contents) {
-	const match = contents.match(/^# Rendered by elmo (\S+) on /m);
-	return match ? match[1] : null;
-}
-function refreshHeaderVersion(contents, version) {
-	if (!/^# Rendered by elmo \S+ on /m.test(contents)) return `${renderedByHeader(version)}\n${contents}`;
-	return contents.replace(/^# Rendered by elmo \S+ on .*$/m, `# Rendered by elmo ${version} on ${(/* @__PURE__ */ new Date()).toISOString()}`);
+//#region src/compose.ts
+async function repinComposeImages(composePath, version) {
+	const contents = await fs.readFile(composePath, "utf8");
+	await fs.writeFile(composePath, refreshHeaderVersion(repinImages(contents, version), version), "utf8");
 }
-function repinImages(contents, version) {
-	return contents.replace(/(image:\s*elmohq\/elmo-[a-z-]+):\S+/g, `$1:${version}`);
+async function refreshRenderedVersion(filePath, version) {
+	try {
+		const contents = await fs.readFile(filePath, "utf8");
+		await fs.writeFile(filePath, refreshHeaderVersion(contents, version), "utf8");
+	} catch {}
 }
-//#endregion
-//#region src/migrations/planner.ts
-function planMigrations(from, to, all) {
-	if (!semver.valid(from)) throw new Error(`Invalid from version: ${from}`);
-	if (!semver.valid(to)) throw new Error(`Invalid to version: ${to}`);
-	if (semver.gt(from, to)) throw new Error(`Downgrade not supported: ${from} -> ${to}`);
-	if (semver.eq(from, to)) return [];
-	for (const m of all) {
-		if (!semver.valid(m.from)) throw new Error(`Migration has invalid from: ${m.from}`);
-		if (!semver.valid(m.to)) throw new Error(`Migration has invalid to: ${m.to}`);
-		if (!semver.gt(m.to, m.from)) throw new Error(`Migration ${m.from} -> ${m.to}: 'to' must be greater than 'from'`);
+function buildComposeYaml(options) {
+	const services = [];
+	const volumes = /* @__PURE__ */ new Set();
+	const dependsOnWeb = [];
+	const dependsOnWorker = [];
+	const dependencyConditions = {
+		postgres: "service_healthy",
+		"db-migrate": "service_completed_successfully"
+	};
+	const dockerfilePath = options.dockerDir ? path.relative(options.repoRoot, path.join(options.dockerDir, "Dockerfile")) : "docker/Dockerfile";
+	if (options.postgresMode === "docker") {
+		services.push(buildPostgresService());
+		services.push(buildDbMigrateService({
+			dev: options.dev,
+			dockerfilePath,
+			repoRoot: options.repoRoot,
+			version: options.version
+		}));
+		dependsOnWeb.push("db-migrate");
+		dependsOnWorker.push("db-migrate");
+		volumes.add("postgres_data");
 	}
-	const applicable = all.filter((m) => semver.gte(m.from, from) && semver.lt(m.from, to)).slice().sort((a, b) => semver.compare(a.from, b.from));
-	const seen = /* @__PURE__ */ new Set();
-	for (const m of applicable) {
-		if (seen.has(m.from)) throw new Error(`Multiple migrations registered with from=${m.from}`);
-		seen.add(m.from);
+	services.push(buildWebService({
+		dev: options.dev,
+		dependsOn: dependsOnWeb,
+		dependencyConditions,
+		repoRoot: options.repoRoot,
+		dockerfilePath,
+		port: options.port,
+		version: options.version
+	}));
+	services.push(buildWorkerService({
+		dev: options.dev,
+		dependsOn: dependsOnWorker,
+		dependencyConditions,
+		repoRoot: options.repoRoot,
+		dockerfilePath,
+		version: options.version
+	}));
+	const lines = [
+		renderedByHeader(options.version),
+		"",
+		"name: elmo",
+		"",
+		"services:"
+	];
+	lines.push(...services.map((service) => indentBlock(service, 2)));
+	if (volumes.size > 0) {
+		lines.push("", "volumes:");
+		for (const volume of volumes) lines.push(`  ${volume}:`);
 	}
-	return applicable;
+	return `${lines.join("\n")}\n`;
 }
-async function runMigrations(plan, ctx) {
-	for (const migration of plan) {
-		ctx.log.step(`Migrating ${migration.from} → ${migration.to}: ${migration.description}`);
-		await migration.run(ctx);
-	}
+function buildPostgresService() {
+	return [
+		"postgres:",
+		"  image: postgres:18-alpine",
+		"  environment:",
+		"    POSTGRES_USER: postgres",
+		"    POSTGRES_PASSWORD: postgres",
+		"    POSTGRES_DB: elmo",
+		"  volumes:",
+		"    - postgres_data:/var/lib/postgresql",
+		"  ports:",
+		"    - \"5432:5432\"",
+		"  healthcheck:",
+		"    test: [\"CMD-SHELL\", \"pg_isready -U postgres\"]",
+		"    interval: 5s",
+		"    timeout: 5s",
+		"    retries: 5",
+		"    start_period: 30s"
+	].join("\n");
 }
-//#endregion
-//#region src/migrations/index.ts
-const MIGRATIONS = [{
-	from: "0.2.17",
-	to: "0.2.18",
-	description: "add ELMO_ENCRYPTION_KEY for encrypted in-app provider credentials",
-	async run(ctx) {
-		const env = await ctx.readEnv();
-		if (env.ELMO_ENCRYPTION_KEY !== void 0) return;
-		env.ELMO_ENCRYPTION_KEY = randomBytes(32).toString("base64");
-		await ctx.writeEnv(env);
-		ctx.log.info("Added ELMO_ENCRYPTION_KEY — lets you store provider credentials encrypted in the app.");
-	}
-}];
-//#endregion
-//#region src/telemetry.ts
-const POSTHOG_PUBLIC_KEY = "phc_Jhx9LnI9cTDFHpQmpOzJSDTW127qD9pFU65KRnYym6z";
-const POSTHOG_HOST = "https://us.i.posthog.com";
-function envDisabled() {
-	return Boolean(process.env.DISABLE_TELEMETRY);
+function buildDbMigrateService(options) {
+	const lines = ["db-migrate:"];
+	if (options.dev) lines.push("  build:", `    context: ${options.repoRoot}`, `    dockerfile: ${options.dockerfilePath}`, "    target: migrate");
+	else lines.push(`  image: elmohq/elmo-db-migrate:${options.version}`);
+	lines.push("  environment:", "    - DATABASE_URL=postgres://postgres:postgres@postgres:5432/elmo", "  depends_on:", "    postgres:", "      condition: service_healthy");
+	return lines.join("\n");
 }
-async function readEnvKey(configDir, key) {
-	try {
-		const contents = await fs.readFile(path.join(configDir, ".env"), "utf8");
-		return parse(contents)[key];
-	} catch {
-		return;
+function buildWebService(options) {
+	const lines = ["web:"];
+	if (options.dev) lines.push("  build:", `    context: ${options.repoRoot}`, `    dockerfile: ${options.dockerfilePath}`, "    target: web", "    args:", "      DEPLOYMENT_MODE: local");
+	else lines.push(`  image: elmohq/elmo-web:${options.version}`);
+	lines.push("  env_file:", "    - path: .env", "      required: true", "  ports:", `    - "${options.port}:3000"`);
+	if (options.dependsOn.length > 0) {
+		lines.push("  depends_on:");
+		for (const service of options.dependsOn) {
+			const condition = options.dependencyConditions[service] ?? "service_started";
+			lines.push(`    ${service}:`, `      condition: ${condition}`);
+		}
 	}
+	return lines.join("\n");
 }
-async function isTelemetryDisabled(configDir) {
-	if (envDisabled()) return true;
-	return Boolean(await readEnvKey(configDir, "DISABLE_TELEMETRY"));
-}
-async function trackCliEvent(configDir, eventName, properties, personProperties) {
-	if (await isTelemetryDisabled(configDir)) return;
-	const distinctId = await readEnvKey(configDir, "DEPLOYMENT_ID");
-	if (!distinctId) return;
-	try {
-		const client = new PostHog(POSTHOG_PUBLIC_KEY, { host: POSTHOG_HOST });
-		client.capture({
-			distinctId,
-			event: eventName,
-			properties: {
-				...properties,
-				...personProperties ? { $set: personProperties } : {}
-			}
-		});
-		await client.shutdown();
-	} catch {}
-}
-async function submitNewsletterSignup(configDir, email) {
-	try {
-		const distinctId = (await isTelemetryDisabled(configDir) ? null : await readEnvKey(configDir, "DEPLOYMENT_ID")) ?? email;
-		const client = new PostHog(POSTHOG_PUBLIC_KEY, { host: POSTHOG_HOST });
-		client.capture({
-			distinctId,
-			event: "newsletter_signup",
-			properties: {
-				source: "cli_init",
-				$set: {
-					email,
-					wants_updates: true
-				}
-			}
-		});
-		await client.shutdown();
-	} catch {}
-}
-//#endregion
-//#region src/index.ts
-const CONFIG_HOME = path.join(os.homedir(), ".elmo");
-const DEFAULT_APP_NAME = "Elmo";
-const DEFAULT_APP_ICON = "/icons/elmo-icon.svg";
-const DEFAULT_APP_PORT = 1515;
-const LOCAL_DATABASE_URL = "postgres://postgres:postgres@postgres:5432/elmo";
-const TELEMETRY_DOC_URL = "https://elmohq.com/docs/developer-guide/telemetry";
-const CLOUD_PRICING_URL = cloudPricingUrl("cli");
-const ELMO_ASCII = [
-	"",
-	"      ▄▄                ",
-	"      ██                ",
-	"▄█▀█▄ ██ ███▄███▄ ▄███▄ ",
-	"██▄█▀ ██ ██ ██ ██ ██ ██ ",
-	"▀█▄▄▄ ██ ██ ██ ██ ▀███▀ ",
-	""
-].join("\n");
-function printBanner() {
-	console.log(`${ELMO_ASCII}`);
-}
-const log = {
-	info: (msg) => p.log.info(msg),
-	warn: (msg) => p.log.warn(msg),
-	error: (msg) => p.log.error(msg),
-	success: (msg) => p.log.success(msg),
-	step: (msg) => p.log.step(msg)
-};
-function assertNotCancelled(value) {
-	if (p.isCancel(value)) {
-		p.cancel("Setup cancelled.");
-		process.exit(0);
+function buildWorkerService(options) {
+	const lines = ["worker:"];
+	if (options.dev) lines.push("  build:", `    context: ${options.repoRoot}`, `    dockerfile: ${options.dockerfilePath}`, "    target: worker", "    args:", "      DEPLOYMENT_MODE: local");
+	else lines.push(`  image: elmohq/elmo-worker:${options.version}`);
+	lines.push("  env_file:", "    - path: .env", "      required: true");
+	lines.push("  stop_grace_period: 35s");
+	if (options.dependsOn.length > 0) {
+		lines.push("  depends_on:");
+		for (const service of options.dependsOn) {
+			const condition = options.dependencyConditions[service] ?? "service_started";
+			lines.push(`    ${service}:`, `      condition: ${condition}`);
+		}
 	}
+	return lines.join("\n");
 }
-function generateSecret(bytes = 32, encoding = "base64url") {
-	return crypto.randomBytes(bytes).toString(encoding);
-}
-function link(text, url) {
-	return `\x1b]8;;${url}\x07${text}\x1b]8;;\x07`;
-}
-async function main() {
-	const version = await getPackageVersion();
-	const program = new Command();
-	program.name("elmo").version(version).option("--dir <path>", "Config directory").configureHelp({ showGlobalOptions: true }).action(() => {
-		printBanner();
-		program.outputHelp();
-	});
-	program.command("init").description("set up local Elmo instance").option("--dev", "Use local build context (repo only)").option("--docker-dir <path>", "Path to Docker build context (dev mode)").action(async (_opts, cmd) => {
-		await withVersionCheck(version, () => runInit(cmd.optsWithGlobals(), version));
-	});
-	program.command("compose").description("run Docker Compose commands using your Elmo config").allowUnknownOption(true).argument("[args...]", "Arguments passed to Docker Compose").action(async (args, _opts, cmd) => {
-		await withVersionCheck(version, () => runCompose(args, cmd.optsWithGlobals()));
-	});
-	program.command("edit").description("change API keys, scrape targets, or the Docker Compose YAML").argument("<env|compose>", "which config file to edit").action(async (target, _opts, cmd) => {
-		await runEdit(target, cmd.optsWithGlobals());
-	});
-	program.command("upgrade").description("upgrade your Elmo deployment to this CLI's version").option("--yes", "skip confirmation prompts").action(async (_opts, cmd) => {
-		await runUpgrade(cmd.optsWithGlobals(), version);
-	});
-	await program.parseAsync(process.argv);
-}
-async function withVersionCheck(version, fn) {
-	const notifyPromise = maybeNotifyNewVersion(version);
-	await fn();
-	await notifyPromise.catch(() => void 0);
-}
-/**
-* Guard an existing config from being replaced by accident. Returns the
-* deployment id to carry over, so a re-run keeps reporting as the same install.
-*/
-async function confirmEnvOverwrite(configDir) {
-	const existingEnvPath = path.join(configDir, ".env");
-	if (!await fileExists(existingEnvPath)) return void 0;
-	const contents = await fs.readFile(existingEnvPath, "utf8");
-	const isElmoEnv = contents.startsWith("# Rendered by elmo") || contents.startsWith("# Generated by elmo");
-	p.log.warn(isElmoEnv ? `An existing Elmo config was found at ${configDir}.` : `A .env file already exists in ${configDir} and was NOT created by Elmo.`);
-	const overwrite = await p.confirm({
-		message: isElmoEnv ? "Overwrite it with new values? Existing secrets (DATABASE_URL, API keys, etc.) will be replaced." : "Overwrite the existing .env file? This cannot be undone.",
-		initialValue: false
-	});
-	assertNotCancelled(overwrite);
-	if (!overwrite) {
-		p.cancel(isElmoEnv ? "Setup cancelled. Use `elmo edit env` to change individual values." : "Setup cancelled. Choose a different directory with --dir.");
-		process.exit(0);
-	}
-	return isElmoEnv ? parse(contents).DEPLOYMENT_ID : void 0;
-}
-async function resolveDockerLocation(options, cwd) {
-	if (!options.dev) return {
-		dockerDir: void 0,
-		repoRoot: cwd
-	};
-	if (!options.dockerDir) {
-		const dockerDir = await resolveDockerDirInteractive(cwd);
-		return {
-			dockerDir,
-			repoRoot: path.resolve(dockerDir, "..")
-		};
-	}
-	const dockerDir = path.resolve(cwd, options.dockerDir);
-	if (!await fileExists(path.join(dockerDir, "Dockerfile"))) {
-		p.log.error(`Dockerfile not found in ${dockerDir}`);
-		process.exit(1);
-	}
-	return {
-		dockerDir,
-		repoRoot: path.resolve(dockerDir, "..")
-	};
-}
-function validatePort(value) {
-	if (!value) return void 0;
-	const port = Number(value);
-	return Number.isInteger(port) && port >= 1 && port <= 65535 ? void 0 : "Must be an integer between 1 and 65535";
-}
-async function runInit(options, version) {
-	printBanner();
-	p.intro(pc.bold("Setting up Elmo"));
-	p.note([
-		"Self-hosting Elmo is free, and always will be. But it does mean",
-		"running Postgres and a worker, and opening your own scraper and",
-		"model provider accounts.",
-		"",
-		`Elmo Cloud is the same open-source product, hosted by us, from`,
-		`${pc.bold(`$${CLOUD_ENTRY_PRICE_USD}/month`)} — scraper and model access included, nothing to`,
-		"keep running.",
-		"",
-		`  ${link(pc.cyan(CLOUD_PRICING_URL), CLOUD_PRICING_URL)}`
-	].join("\n"), "Prefer not to self-host?");
-	const cwd = process.cwd();
-	const configDir = options.dir ? path.resolve(cwd, options.dir) : CONFIG_HOME;
-	const preservedDeploymentId = await confirmEnvOverwrite(configDir);
-	const { dockerDir, repoRoot } = await resolveDockerLocation(options, cwd);
-	const postgresMode = await p.select({
-		message: "PostgreSQL connection",
-		options: [{
-			value: "docker",
-			label: "Run Postgres in Docker"
-		}, {
-			value: "external",
-			label: "Use existing Postgres (provide DATABASE_URL)"
-		}],
-		initialValue: "docker"
-	});
-	assertNotCancelled(postgresMode);
-	const env = {};
-	env.DEPLOYMENT_MODE = "local";
-	env.VITE_DEPLOYMENT_MODE = "local";
-	env.DEPLOYMENT_ID = preservedDeploymentId ?? crypto.randomUUID();
-	env.BETTER_AUTH_SECRET = generateSecret();
-	env.ELMO_ENCRYPTION_KEY = generateSecret(32, "base64");
-	env.APP_NAME = DEFAULT_APP_NAME;
-	env.APP_ICON = DEFAULT_APP_ICON;
-	env.VITE_APP_NAME = DEFAULT_APP_NAME;
-	env.VITE_APP_ICON = DEFAULT_APP_ICON;
-	if (postgresMode === "external") {
-		p.note("Must be an IPv4-compatible direct connection or database pooler.", "DATABASE_URL");
-		const url = await p.password({
-			message: "DATABASE_URL",
-			validate: (v) => !v ? "Required" : void 0
-		});
-		assertNotCancelled(url);
-		env.DATABASE_URL = url;
-	} else env.DATABASE_URL = LOCAL_DATABASE_URL;
-	const setupMode = await configureProvidersInteractive(env);
-	p.note([
-		"Elmo is open source and maintained by a small team. Telemetry",
-		"from both the CLI and your local deployment (web + worker)",
-		"tells us things like which CLI versions are still in use, where",
-		"`elmo init` drops off, which providers people pick, and whether",
-		"new features actually get used. Without it we are flying blind",
-		"on what to fix or build next.",
-		"",
-		pc.bold("What we send:"),
-		"  • deployment ID (random UUID stored as DEPLOYMENT_ID in your .env)",
-		"  • CLI/app version, OS, arch, Node version, deployment mode",
-		"  • command/event names + non-secret options (e.g. postgres mode)",
-		"  • feature counts (prompts edited, brands created — never the names or text)",
-		"  • IP address (recorded on each event by PostHog, used for geolocation)",
-		"",
-		pc.bold("What we never send:"),
-		"  API keys, .env contents, brand names, prompt text, and scraped responses.",
-		"",
-		`Full breakdown: ${link(pc.cyan(TELEMETRY_DOC_URL), TELEMETRY_DOC_URL)}`,
-		"Toggle later by editing DISABLE_TELEMETRY in .env (`elmo edit env`)."
-	].join("\n"), "Telemetry");
-	const telemetryEnabled = await p.confirm({
-		message: "Share telemetry?",
-		initialValue: true
-	});
-	assertNotCancelled(telemetryEnabled);
-	if (!telemetryEnabled) env.DISABLE_TELEMETRY = "1";
-	const updatesEmail = await p.text({
-		message: "Enter your work email to receive product updates (optional)",
-		placeholder: "you@example.com"
-	});
-	const email = p.isCancel(updatesEmail) ? void 0 : updatesEmail || void 0;
-	const portInput = await p.text({
-		message: "Web app port",
-		placeholder: String(DEFAULT_APP_PORT),
-		defaultValue: String(DEFAULT_APP_PORT),
-		validate: validatePort
-	});
-	assertNotCancelled(portInput);
-	const port = Number(portInput);
-	env.APP_URL = `http://localhost:${port}`;
-	env.VITE_APP_URL = env.APP_URL;
-	const composeYaml = buildComposeYaml({
-		dev: Boolean(options.dev),
-		postgresMode,
-		repoRoot,
-		dockerDir,
-		port,
-		version
-	});
-	await ensureDir(configDir);
-	await writeConfigFiles(configDir, {
-		env,
-		composeYaml,
-		postgresMode,
-		dev: Boolean(options.dev),
-		version
-	});
-	p.log.success(`Config written to ${configDir}`);
-	p.log.warn("Your generated .env file contains secrets — do not commit it to version control.");
-	if (options.dev) p.log.info("Dev mode enabled. Run `elmo compose build` before starting.");
-	const shouldStart = await p.confirm({
-		message: "Start the stack now?",
-		initialValue: true
-	});
-	assertNotCancelled(shouldStart);
-	if (shouldStart) await doStart(configDir);
-	else p.log.info("You can start later with `elmo compose up -d`.");
-	await trackCliEvent(configDir, "cli_init", {
-		version,
-		os: process.platform,
-		arch: process.arch,
-		node_version: process.version,
-		postgres_mode: postgresMode,
-		dev_mode: Boolean(options.dev),
-		setup_mode: setupMode,
-		has_scraper: Boolean(env.BRIGHTDATA_API_TOKEN || env.OLOSTEP_API_KEY || env.OXYLABS_USERNAME || env.CLORO_API_KEY),
-		has_direct_api: hasDirectApiConfigured(env)
-	});
-	if (email) await submitNewsletterSignup(configDir, email);
-	p.log.message(`If you find Elmo useful, star us on GitHub!\n  ${link(pc.cyan("https://github.com/elmohq/elmo"), "https://github.com/elmohq/elmo")}`);
-	p.outro(pc.green("Setup complete!"));
-}
-const CLORO_AFFILIATE = "https://cloro.dev?fpr=elmo";
-const BRIGHTDATA_AFFILIATE = "https://get.brightdata.com/67h1b7h0shcn";
+//#endregion
+//#region src/providers.ts
+const CLORO_AFFILIATE = "https://affiliate.cloro.dev/elmo?sid=cli";
+const BRIGHTDATA_AFFILIATE = "https://get.brightdata.com/elmo?sid=cli";
 const OXYLABS_AFFILIATE = "https://oxylabs.go2cloud.org/aff_c?offer_id=7&aff_id=2263&url_id=32";
 const OLOSTEP_AFFILIATE = "https://olostep.com/?ref=elmo";
 const DATAFORSEO_AFFILIATE = "https://dataforseo.com/?aff=184966";
@@ -588,482 +588,298 @@ const DEFAULT_OPENAI_MODEL = "gpt-5-mini";
 const DEFAULT_ANTHROPIC_MODEL = "claude-sonnet-5";
 const DEFAULT_OPENROUTER_MODEL = "anthropic/claude-sonnet-5";
 const DEFAULT_MISTRAL_MODEL = "mistral-medium-latest";
-async function configureProvidersInteractive(env) {
-	p.note([
-		"Elmo needs two kinds of providers:",
-		"",
-		pc.bold("1. A scraper") + " — to track ChatGPT and Google AI Mode (no public APIs):",
-		`     • ${pc.cyan("Cloro")}      — most reliable, every surface, ~$0.65/mo per prompt ($30/mo min)`,
-		`     • ${pc.cyan("BrightData")} — pay-as-you-go and cheaper, but slower, ~$0.45/mo per prompt`,
-		`     • ${pc.cyan("Oxylabs")}    — cheapest per run, no Gemini/Copilot, $49/mo min`,
-		`     • ${pc.cyan("Olostep")}    — premium, built for high volume, ~$2.25/mo per prompt`,
-		`     • ${pc.cyan("DataForSEO")} — pay-as-you-go, scrapers + direct APIs, ~$1.20/mo per prompt`,
-		"",
-		pc.bold("2. A direct LLM API") + " — for low-latency tasks (onboarding analysis, sentiment scoring,",
-		"   ad-hoc LLM calls). Required:",
-		`     • ${pc.cyan("OpenRouter")} — one key, all major models (recommended)`,
-		`     • ${pc.cyan("Anthropic / OpenAI / Mistral")} — direct provider keys`,
-		"",
-		"Pricing assumes Elmo's default cadence (5 runs/day × 2 surfaces)."
-	].join("\n"), "AI providers");
-	const mode = await p.select({
-		message: "Setup mode",
-		options: [{
-			value: "recommended",
-			label: "Recommended — one scraper + one direct API"
-		}, {
-			value: "custom",
-			label: "Custom — pick each provider individually"
-		}],
-		initialValue: "recommended"
-	});
-	assertNotCancelled(mode);
-	if (mode === "recommended") await configureProvidersRecommended(env);
-	else await configureProvidersCustom(env);
-	return mode;
+const required = (v) => !v ? "Required" : void 0;
+function scraperPicker(label, provider, models) {
+	return {
+		message: `LLM Providers to track via ${label}`,
+		options: models.map((model) => ({
+			value: formatScrapeTarget({
+				model,
+				provider,
+				webSearch: true
+			}),
+			label: model
+		})),
+		initialValues: DEFAULT_SCRAPER_MODELS.map((model) => formatScrapeTarget({
+			model,
+			provider,
+			webSearch: true
+		})),
+		required: true
+	};
 }
-async function configureProvidersRecommended(env) {
-	const targets = [];
-	const scraper = await p.select({
-		message: "Scraper (tracks ChatGPT + Google AI Mode)",
-		options: [
-			{
-				value: "cloro",
-				label: "Cloro — most reliable, every surface (~$0.65/mo per prompt, $30/mo min)"
-			},
-			{
-				value: "brightdata",
-				label: "BrightData — pay-as-you-go, cheaper but slower (~$0.45/mo per prompt)"
-			},
-			{
-				value: "oxylabs",
-				label: "Oxylabs — cheapest per run, no Gemini/Copilot ($49/mo min)"
-			},
-			{
-				value: "olostep",
-				label: "Olostep — premium, built for high volume (~$2.25/mo per prompt)"
-			},
-			{
-				value: "dataforseo",
-				label: "DataForSEO — pay-as-you-go, scrapers + direct APIs (~$1.20/mo per prompt)"
-			}
-		],
-		initialValue: "cloro"
-	});
-	assertNotCancelled(scraper);
-	await collectScraperKey(scraper, env);
-	for (const model of DEFAULT_SCRAPER_MODELS) targets.push(formatScrapeTarget({
-		model,
-		provider: scraper,
-		webSearch: true
-	}));
-	const direct = await p.select({
-		message: "Direct LLM API (powers onboarding analysis + sentiment scoring)",
-		options: [
-			{
-				value: "openrouter",
-				label: "OpenRouter — one key, all major models (recommended)"
-			},
-			{
-				value: "anthropic",
-				label: "Anthropic — direct Claude"
-			},
-			{
-				value: "openai",
-				label: "OpenAI — direct GPT-* models"
-			},
-			{
-				value: "mistral",
-				label: "Mistral — direct Mistral models"
-			}
-		],
-		initialValue: "openrouter"
-	});
-	assertNotCancelled(direct);
-	await collectDirectApiQuick(direct, env);
-	await finalizeScrapeTargets(env, targets, { skipEdit: true });
-}
-async function configureProvidersCustom(env) {
-	const targets = [];
-	p.log.step(pc.bold("Step 1 of 2 — Direct LLM API (at least one is required)"));
-	while (!hasDirectApiConfigured(env)) {
-		await collectOpenRouter(env, targets);
-		await collectAnthropic(env, targets);
-		await collectOpenAI(env, targets);
-		await collectMistral(env, targets);
-		if (!hasDirectApiConfigured(env)) p.log.warn("Onboarding analysis and other low-latency LLM tasks require a direct API. Configure at least one before continuing.");
-	}
-	p.log.step(pc.bold("Step 2 of 2 — Scrapers (optional, but needed to track ChatGPT / Google AI Mode)"));
-	await collectCloro(env, targets);
-	await collectBrightData(env, targets);
-	await collectOxylabs(env, targets);
-	await collectOlostep(env, targets);
-	await collectDataForSEO(env, targets);
-	await finalizeScrapeTargets(env, targets);
-}
-function hasDirectApiConfigured(env) {
-	return Boolean(env.ANTHROPIC_API_KEY || env.OPENAI_API_KEY || env.MISTRAL_API_KEY || env.OPENROUTER_API_KEY);
-}
-async function collectScraperKey(scraper, env) {
-	if (scraper === "cloro") {
-		p.log.info(`Sign up: ${link(pc.cyan(CLORO_AFFILIATE), CLORO_AFFILIATE)}`);
-		const key = await p.password({
+const PROVIDER_PROMPTS = [
+	{
+		id: "openrouter",
+		kind: "direct",
+		label: "OpenRouter",
+		costHint: "one key, many hosted models",
+		confirmDefault: false,
+		credentials: [{
+			envKey: "OPENROUTER_API_KEY",
+			message: "OpenRouter API key",
+			secret: true,
+			validate: required
+		}],
+		model: {
+			message: "OpenRouter model slug",
+			default: DEFAULT_OPENROUTER_MODEL
+		},
+		webSearch: true,
+		target: {
+			model: "claude",
+			provider: "openrouter"
+		}
+	},
+	{
+		id: "anthropic",
+		kind: "direct",
+		label: "Anthropic API",
+		costHint: "direct Claude — ~$4–5/mo per prompt per model",
+		confirmDefault: false,
+		credentials: [{
+			envKey: "ANTHROPIC_API_KEY",
+			message: "Anthropic API key",
+			secret: true,
+			validate: required
+		}],
+		model: {
+			message: "Claude model",
+			default: DEFAULT_ANTHROPIC_MODEL
+		},
+		webSearch: true,
+		target: {
+			model: "claude",
+			provider: "anthropic-api"
+		}
+	},
+	{
+		id: "openai",
+		kind: "direct",
+		label: "OpenAI API",
+		costHint: "gpt-* with web search — not the real ChatGPT UI",
+		confirmDefault: false,
+		credentials: [{
+			envKey: "OPENAI_API_KEY",
+			message: "OpenAI API key",
+			secret: true,
+			validate: required
+		}],
+		model: {
+			message: "OpenAI model",
+			default: DEFAULT_OPENAI_MODEL
+		},
+		webSearch: true,
+		target: {
+			model: "chatgpt",
+			provider: "openai-api"
+		}
+	},
+	{
+		id: "mistral",
+		kind: "direct",
+		label: "Mistral API",
+		costHint: "direct Mistral models",
+		confirmDefault: false,
+		credentials: [{
+			envKey: "MISTRAL_API_KEY",
+			message: "Mistral API key",
+			secret: true,
+			validate: required
+		}],
+		model: {
+			message: "Mistral model",
+			default: DEFAULT_MISTRAL_MODEL
+		},
+		webSearch: true,
+		target: {
+			model: "mistral",
+			provider: "mistral-api"
+		}
+	},
+	{
+		id: "cloro",
+		kind: "scraper",
+		label: "Cloro",
+		costHint: "most reliable, every surface — ~$0.65/mo per prompt, $30/mo min",
+		confirmDefault: true,
+		signup: {
+			message: "Sign up and create an API key",
+			url: CLORO_AFFILIATE
+		},
+		credentials: [{
+			envKey: "CLORO_API_KEY",
 			message: "Cloro API key",
-			validate: (v) => !v ? "Required" : void 0
-		});
-		assertNotCancelled(key);
-		env.CLORO_API_KEY = key;
-	} else if (scraper === "brightdata") {
-		p.log.info(`Sign up: ${link(pc.cyan(BRIGHTDATA_AFFILIATE), BRIGHTDATA_AFFILIATE)}`);
-		const key = await p.password({
+			secret: true,
+			validate: required
+		}],
+		picker: scraperPicker("Cloro", "cloro", CLORO_MODELS)
+	},
+	{
+		id: "brightdata",
+		kind: "scraper",
+		label: "BrightData",
+		costHint: "pay-as-you-go, cheaper but slower — ~$0.45/mo per prompt",
+		confirmDefault: false,
+		signup: {
+			message: "Sign up and generate an API token",
+			url: BRIGHTDATA_AFFILIATE
+		},
+		credentials: [{
+			envKey: "BRIGHTDATA_API_TOKEN",
 			message: "BrightData API token",
-			validate: (v) => !v ? "Required" : void 0
-		});
-		assertNotCancelled(key);
-		env.BRIGHTDATA_API_TOKEN = key;
-	} else if (scraper === "oxylabs") {
-		p.log.info(`Sign up: ${link(pc.cyan(OXYLABS_AFFILIATE), OXYLABS_AFFILIATE)}`);
-		const username = await p.text({
+			secret: true,
+			validate: required
+		}],
+		picker: scraperPicker("BrightData", "brightdata", BRIGHTDATA_MODELS)
+	},
+	{
+		id: "oxylabs",
+		kind: "scraper",
+		label: "Oxylabs",
+		costHint: "cheapest per run, no Gemini/Copilot — $49/mo min",
+		confirmDefault: false,
+		signup: {
+			message: "Sign up and create Web Scraper API credentials",
+			url: OXYLABS_AFFILIATE
+		},
+		credentials: [{
+			envKey: "OXYLABS_USERNAME",
 			message: "Oxylabs username",
-			validate: (v) => !v ? "Required" : void 0
-		});
-		assertNotCancelled(username);
-		env.OXYLABS_USERNAME = username;
-		const password = await p.password({
+			secret: false,
+			validate: required
+		}, {
+			envKey: "OXYLABS_PASSWORD",
 			message: "Oxylabs password",
-			validate: (v) => !v ? "Required" : void 0
-		});
-		assertNotCancelled(password);
-		env.OXYLABS_PASSWORD = password;
-	} else if (scraper === "olostep") {
-		p.log.info(`Sign up: ${link(pc.cyan(OLOSTEP_AFFILIATE), OLOSTEP_AFFILIATE)}`);
-		const key = await p.password({
+			secret: true,
+			validate: required
+		}],
+		picker: scraperPicker("Oxylabs", "oxylabs", OXYLABS_MODELS)
+	},
+	{
+		id: "olostep",
+		kind: "scraper",
+		label: "Olostep",
+		costHint: "premium, built for high volume — ~$2.25/mo per prompt",
+		confirmDefault: false,
+		signup: {
+			message: "Grab an API key",
+			url: OLOSTEP_AFFILIATE
+		},
+		credentials: [{
+			envKey: "OLOSTEP_API_KEY",
 			message: "Olostep API key",
-			validate: (v) => !v ? "Required" : void 0
-		});
-		assertNotCancelled(key);
-		env.OLOSTEP_API_KEY = key;
-	} else {
-		p.log.info(`Sign up: ${link(pc.cyan(DATAFORSEO_AFFILIATE), DATAFORSEO_AFFILIATE)}`);
-		const login = await p.text({
+			secret: true,
+			validate: required
+		}],
+		picker: scraperPicker("Olostep", "olostep", OLOSTEP_MODELS)
+	},
+	{
+		id: "dataforseo",
+		kind: "scraper",
+		label: "DataForSEO",
+		costHint: "pay-as-you-go, scrapers + direct APIs — ~$1.20/mo per prompt",
+		confirmDefault: false,
+		signup: {
+			message: "Sign up",
+			url: DATAFORSEO_AFFILIATE
+		},
+		credentials: [{
+			envKey: "DATAFORSEO_LOGIN",
 			message: "DataForSEO login",
-			validate: (v) => !v ? "Required" : void 0
-		});
-		assertNotCancelled(login);
-		env.DATAFORSEO_LOGIN = login;
-		const password = await p.password({
+			secret: false,
+			validate: required
+		}, {
+			envKey: "DATAFORSEO_PASSWORD",
 			message: "DataForSEO password",
-			validate: (v) => !v ? "Required" : void 0
-		});
-		assertNotCancelled(password);
-		env.DATAFORSEO_PASSWORD = password;
+			secret: true,
+			validate: required
+		}],
+		picker: {
+			message: "LLM Providers to track via DataForSEO",
+			options: DATAFORSEO_TARGETS.map((t) => ({
+				value: formatScrapeTarget({
+					model: t.model,
+					provider: "dataforseo",
+					webSearch: true
+				}),
+				label: `${t.model} (${t.kind})`
+			})),
+			initialValues: [formatScrapeTarget({
+				model: "google-ai-mode",
+				provider: "dataforseo",
+				webSearch: true
+			})],
+			required: false
+		}
 	}
-}
-async function collectDirectApiQuick(kind, env) {
-	if (kind === "openrouter") {
-		const key = await p.password({
-			message: "OpenRouter API key",
-			validate: (v) => !v ? "Required" : void 0
-		});
-		assertNotCancelled(key);
-		env.OPENROUTER_API_KEY = key;
-	} else if (kind === "anthropic") {
-		const key = await p.password({
-			message: "Anthropic API key",
-			validate: (v) => !v ? "Required" : void 0
-		});
-		assertNotCancelled(key);
-		env.ANTHROPIC_API_KEY = key;
-	} else if (kind === "openai") {
-		const key = await p.password({
-			message: "OpenAI API key",
-			validate: (v) => !v ? "Required" : void 0
-		});
-		assertNotCancelled(key);
-		env.OPENAI_API_KEY = key;
-	} else {
-		const key = await p.password({
-			message: "Mistral API key",
-			validate: (v) => !v ? "Required" : void 0
-		});
-		assertNotCancelled(key);
-		env.MISTRAL_API_KEY = key;
+];
+function providerSpec(id) {
+	const spec = PROVIDER_PROMPTS.find((candidate) => candidate.id === id);
+	if (!spec) throw new Error(`Unknown provider: ${id}`);
+	return spec;
+}
+async function collectCredentials(spec, env) {
+	for (const credential of spec.credentials) {
+		const options = {
+			message: credential.message,
+			validate: credential.validate
+		};
+		const value = credential.secret ? await p.password(options) : await p.text(options);
+		assertNotCancelled(value);
+		env[credential.envKey] = value;
 	}
 }
-async function collectBrightData(env, targets) {
-	const enable = await p.confirm({
-		message: `Configure ${pc.bold("BrightData")}? (pay-as-you-go, cheaper but slower — ~$0.45/mo per prompt)`,
-		initialValue: false
-	});
-	assertNotCancelled(enable);
-	if (!enable) return;
-	p.log.info(`Sign up and generate an API token: ${link(pc.cyan(BRIGHTDATA_AFFILIATE), BRIGHTDATA_AFFILIATE)}`);
-	const key = await p.password({
-		message: "BrightData API token",
-		validate: (v) => !v ? "Required" : void 0
-	});
-	assertNotCancelled(key);
-	env.BRIGHTDATA_API_TOKEN = key;
-	await pickScraperTargets({
-		providerLabel: "BrightData",
-		providerId: "brightdata",
-		allModels: BRIGHTDATA_MODELS,
-		targets
-	});
-}
-async function collectOlostep(env, targets) {
-	const enable = await p.confirm({
-		message: `Configure ${pc.bold("Olostep")}? (premium, built for high volume — ~$2.25/mo per prompt)`,
-		initialValue: false
-	});
-	assertNotCancelled(enable);
-	if (!enable) return;
-	p.log.info(`Grab an API key: ${link(pc.cyan(OLOSTEP_AFFILIATE), OLOSTEP_AFFILIATE)}`);
-	const key = await p.password({
-		message: "Olostep API key",
-		validate: (v) => !v ? "Required" : void 0
-	});
-	assertNotCancelled(key);
-	env.OLOSTEP_API_KEY = key;
-	await pickScraperTargets({
-		providerLabel: "Olostep",
-		providerId: "olostep",
-		allModels: OLOSTEP_MODELS,
-		targets
-	});
-}
-async function collectOxylabs(env, targets) {
-	const enable = await p.confirm({
-		message: `Configure ${pc.bold("Oxylabs")}? (cheapest per run, no Gemini/Copilot — $49/mo min)`,
-		initialValue: false
-	});
-	assertNotCancelled(enable);
-	if (!enable) return;
-	p.log.info(`Sign up and create Web Scraper API credentials: ${link(pc.cyan(OXYLABS_AFFILIATE), OXYLABS_AFFILIATE)}`);
-	const username = await p.text({
-		message: "Oxylabs username",
-		validate: (v) => !v ? "Required" : void 0
-	});
-	assertNotCancelled(username);
-	env.OXYLABS_USERNAME = username;
-	const password = await p.password({
-		message: "Oxylabs password",
-		validate: (v) => !v ? "Required" : void 0
-	});
-	assertNotCancelled(password);
-	env.OXYLABS_PASSWORD = password;
-	await pickScraperTargets({
-		providerLabel: "Oxylabs",
-		providerId: "oxylabs",
-		allModels: OXYLABS_MODELS,
-		targets
-	});
-}
-async function collectCloro(env, targets) {
-	const enable = await p.confirm({
-		message: `Configure ${pc.bold("Cloro")}? (most reliable, every surface — ~$0.65/mo per prompt, $30/mo min)`,
-		initialValue: true
-	});
-	assertNotCancelled(enable);
-	if (!enable) return;
-	p.log.info(`Sign up and create an API key: ${link(pc.cyan(CLORO_AFFILIATE), CLORO_AFFILIATE)}`);
-	const key = await p.password({
-		message: "Cloro API key",
-		validate: (v) => !v ? "Required" : void 0
-	});
-	assertNotCancelled(key);
-	env.CLORO_API_KEY = key;
-	await pickScraperTargets({
-		providerLabel: "Cloro",
-		providerId: "cloro",
-		allModels: CLORO_MODELS,
-		targets
-	});
-}
-async function pickScraperTargets(args) {
-	const selected = await p.multiselect({
-		message: `LLM Providers to track via ${args.providerLabel}`,
-		options: args.allModels.map((model) => ({
-			value: model,
-			label: model
-		})),
-		required: true,
-		initialValues: [...DEFAULT_SCRAPER_MODELS]
-	});
-	assertNotCancelled(selected);
-	for (const model of selected) args.targets.push(formatScrapeTarget({
-		model,
-		provider: args.providerId,
-		webSearch: true
-	}));
-}
-async function collectAnthropic(env, targets) {
-	const enable = await p.confirm({
-		message: `Configure ${pc.bold("Anthropic API")}? (direct Claude — ~$4–5/mo per prompt per model)`,
-		initialValue: false
-	});
-	assertNotCancelled(enable);
-	if (!enable) return;
-	const key = await p.password({
-		message: "Anthropic API key",
-		validate: (v) => !v ? "Required" : void 0
-	});
-	assertNotCancelled(key);
-	env.ANTHROPIC_API_KEY = key;
-	const model = await p.text({
-		message: "Claude model",
-		placeholder: DEFAULT_ANTHROPIC_MODEL,
-		defaultValue: DEFAULT_ANTHROPIC_MODEL
-	});
-	assertNotCancelled(model);
-	const slug = model || DEFAULT_ANTHROPIC_MODEL;
-	const webSearch = await p.confirm({
-		message: "Enable web search? (recommended, but more expensive)",
-		initialValue: true
-	});
-	assertNotCancelled(webSearch);
-	targets.push(formatScrapeTarget({
-		model: "claude",
-		provider: "anthropic-api",
-		version: slug,
-		webSearch
-	}));
-}
-async function collectOpenAI(env, targets) {
-	const enable = await p.confirm({
-		message: `Configure ${pc.bold("OpenAI API")}? (gpt-* with web search — not the real ChatGPT UI)`,
-		initialValue: false
-	});
-	assertNotCancelled(enable);
-	if (!enable) return;
-	const key = await p.password({
-		message: "OpenAI API key",
-		validate: (v) => !v ? "Required" : void 0
-	});
-	assertNotCancelled(key);
-	env.OPENAI_API_KEY = key;
-	const model = await p.text({
-		message: "OpenAI model",
-		placeholder: DEFAULT_OPENAI_MODEL,
-		defaultValue: DEFAULT_OPENAI_MODEL
-	});
-	assertNotCancelled(model);
-	const slug = model || DEFAULT_OPENAI_MODEL;
-	const webSearch = await p.confirm({
-		message: "Enable web search? (recommended, but more expensive)",
-		initialValue: true
-	});
-	assertNotCancelled(webSearch);
-	targets.push(formatScrapeTarget({
-		model: "chatgpt",
-		provider: "openai-api",
-		version: slug,
-		webSearch
-	}));
-}
-async function collectMistral(env, targets) {
-	const enable = await p.confirm({
-		message: `Configure ${pc.bold("Mistral API")}? (direct Mistral models)`,
-		initialValue: false
-	});
-	assertNotCancelled(enable);
-	if (!enable) return;
-	const key = await p.password({
-		message: "Mistral API key",
-		validate: (v) => !v ? "Required" : void 0
-	});
-	assertNotCancelled(key);
-	env.MISTRAL_API_KEY = key;
-	const model = await p.text({
-		message: "Mistral model",
-		placeholder: DEFAULT_MISTRAL_MODEL,
-		defaultValue: DEFAULT_MISTRAL_MODEL
-	});
-	assertNotCancelled(model);
-	const slug = model || DEFAULT_MISTRAL_MODEL;
-	const webSearch = await p.confirm({
-		message: "Enable web search? (recommended, but more expensive)",
-		initialValue: true
-	});
-	assertNotCancelled(webSearch);
-	targets.push(formatScrapeTarget({
-		model: "mistral",
-		provider: "mistral-api",
-		version: slug,
-		webSearch
-	}));
-}
-async function collectOpenRouter(env, targets) {
+/**
+* Offer one provider: confirm → credentials → optional model + web search →
+* scrape targets. Declining leaves `env` and `targets` untouched.
+*/
+async function collectProvider(spec, env, targets) {
 	const enable = await p.confirm({
-		message: `Configure ${pc.bold("OpenRouter")}? (one key, many hosted models)`,
-		initialValue: false
+		message: `Configure ${pc.bold(spec.label)}? (${spec.costHint})`,
+		initialValue: spec.confirmDefault
 	});
 	assertNotCancelled(enable);
 	if (!enable) return;
-	const key = await p.password({
-		message: "OpenRouter API key",
-		validate: (v) => !v ? "Required" : void 0
-	});
-	assertNotCancelled(key);
-	env.OPENROUTER_API_KEY = key;
-	const model = await p.text({
-		message: "OpenRouter model slug",
-		placeholder: DEFAULT_OPENROUTER_MODEL,
-		defaultValue: DEFAULT_OPENROUTER_MODEL
-	});
-	assertNotCancelled(model);
-	const slug = model || DEFAULT_OPENROUTER_MODEL;
-	const webSearch = await p.confirm({
-		message: "Enable web search? (recommended, but more expensive)",
-		initialValue: true
-	});
-	assertNotCancelled(webSearch);
-	targets.push(formatScrapeTarget({
-		model: "claude",
-		provider: "openrouter",
-		version: slug,
+	if (spec.signup) p.log.info(`${spec.signup.message}: ${link(pc.cyan(spec.signup.url), spec.signup.url)}`);
+	await collectCredentials(spec, env);
+	let version;
+	if (spec.model) {
+		const model = await p.text({
+			message: spec.model.message,
+			placeholder: spec.model.default,
+			defaultValue: spec.model.default
+		});
+		assertNotCancelled(model);
+		version = model || spec.model.default;
+	}
+	let webSearch = true;
+	if (spec.webSearch) {
+		const answer = await p.confirm({
+			message: "Enable web search? (recommended, but more expensive)",
+			initialValue: true
+		});
+		assertNotCancelled(answer);
+		webSearch = answer;
+	}
+	if (spec.target) targets.push(formatScrapeTarget({
+		...spec.target,
+		version,
 		webSearch
 	}));
+	if (spec.picker) {
+		const selected = await p.multiselect({
+			message: spec.picker.message,
+			options: spec.picker.options,
+			required: spec.picker.required,
+			initialValues: [...spec.picker.initialValues]
+		});
+		assertNotCancelled(selected);
+		targets.push(...selected);
+	}
 }
-async function collectDataForSEO(env, targets) {
-	const enable = await p.confirm({
-		message: `Configure ${pc.bold("DataForSEO")}? (pay-as-you-go, scrapers + direct APIs — ~$1.20/mo per prompt)`,
-		initialValue: false
-	});
-	assertNotCancelled(enable);
-	if (!enable) return;
-	p.log.info(`Sign up: ${link(pc.cyan(DATAFORSEO_AFFILIATE), DATAFORSEO_AFFILIATE)}`);
-	const login = await p.text({
-		message: "DataForSEO login",
-		validate: (v) => !v ? "Required" : void 0
-	});
-	assertNotCancelled(login);
-	env.DATAFORSEO_LOGIN = login;
-	const pwd = await p.password({
-		message: "DataForSEO password",
-		validate: (v) => !v ? "Required" : void 0
-	});
-	assertNotCancelled(pwd);
-	env.DATAFORSEO_PASSWORD = pwd;
-	const selected = await p.multiselect({
-		message: "LLM Providers to track via DataForSEO",
-		options: DATAFORSEO_TARGETS.map((t) => ({
-			value: formatScrapeTarget({
-				model: t.model,
-				provider: "dataforseo",
-				webSearch: true
-			}),
-			label: `${t.model} (${t.kind})`
-		})),
-		required: false,
-		initialValues: [formatScrapeTarget({
-			model: "google-ai-mode",
-			provider: "dataforseo",
-			webSearch: true
-		})]
-	});
-	assertNotCancelled(selected);
-	targets.push(...selected);
+function hasDirectApiConfigured(env) {
+	return Boolean(env.ANTHROPIC_API_KEY || env.OPENAI_API_KEY || env.MISTRAL_API_KEY || env.OPENROUTER_API_KEY);
 }
 async function finalizeScrapeTargets(env, targets, options = {}) {
 	const deduped = dedupeTargets(targets);
@@ -1125,485 +941,440 @@ function dedupeTargets(targets) {
 	}
 	return out.join(",");
 }
-async function doStart(configDir) {
-	assertDockerRunning();
-	log.step("Starting Docker Compose stack...");
-	await runDockerCompose(configDir, ["up", "-d"]);
-	const s = p.spinner();
-	s.start("Waiting for services to become healthy...");
-	if (await waitForHealthy(configDir, 18e4)) s.stop("All services healthy!");
-	else {
-		s.stop("Health check timed out.");
-		p.log.warn("Some services did not report healthy status.");
-	}
-	log.info("Examples:");
-	console.log(`  ${pc.bold("elmo compose logs -f")}`);
-	console.log(`  ${pc.bold("elmo compose logs -f web")}`);
-	console.log(`  ${pc.bold("elmo compose ps")}`);
-	console.log(`  ${pc.bold("elmo compose down")}`);
+//#endregion
+//#region src/telemetry.ts
+const POSTHOG_PUBLIC_KEY = "phc_Jhx9LnI9cTDFHpQmpOzJSDTW127qD9pFU65KRnYym6z";
+const POSTHOG_HOST = "https://us.i.posthog.com";
+function envDisabled() {
+	return Boolean(process.env.DISABLE_TELEMETRY);
 }
-async function runCompose(args, options) {
-	const configDir = await resolveConfigDir(options.dir);
-	assertDockerRunning();
-	await runDockerCompose(configDir, args);
+async function readEnvKey(configDir, key) {
+	try {
+		const contents = await fs.readFile(path.join(configDir, ".env"), "utf8");
+		return parse(contents)[key];
+	} catch {
+		return;
+	}
 }
-async function runEdit(target, options) {
-	const configDir = await resolveConfigDir(options.dir);
-	let filePath;
-	if (target === "env") filePath = path.join(configDir, ".env");
-	else if (target === "compose") filePath = path.join(configDir, "elmo.yaml");
-	else throw new Error(`Unknown edit target: ${target}. Use \`env\` or \`compose\`.`);
-	if (!await fileExists(filePath)) throw new Error(`File not found: ${filePath}`);
-	const parts = (process.env.VISUAL || process.env.EDITOR || "nano").split(/\s+/).filter(Boolean);
-	const cmd = parts[0] ?? "nano";
-	const args = [...parts.slice(1), filePath];
-	await new Promise((resolve, reject) => {
-		const child = spawn(cmd, args, { stdio: "inherit" });
-		child.on("close", (code) => {
-			if (code === 0) resolve();
-			else reject(/* @__PURE__ */ new Error(`${cmd} exited with code ${code}`));
+async function isTelemetryDisabled(configDir) {
+	if (envDisabled()) return true;
+	return Boolean(await readEnvKey(configDir, "DISABLE_TELEMETRY"));
+}
+async function trackCliEvent(configDir, eventName, properties, personProperties) {
+	if (await isTelemetryDisabled(configDir)) return;
+	const distinctId = await readEnvKey(configDir, "DEPLOYMENT_ID");
+	if (!distinctId) return;
+	try {
+		const client = new PostHog(POSTHOG_PUBLIC_KEY, { host: POSTHOG_HOST });
+		client.capture({
+			distinctId,
+			event: eventName,
+			properties: {
+				...properties,
+				...personProperties ? { $set: personProperties } : {}
+			}
 		});
-		child.on("error", (err) => reject(err));
-	});
-	log.info("Restart the stack with `elmo compose up -d` to apply changes.");
+		await client.shutdown();
+	} catch {}
 }
-async function confirmStaleCli(cliVersion, assumeYes) {
-	const latestCli = await fetchLatestCliVersion();
-	if (!latestCli || !semver.valid(cliVersion) || !semver.lt(cliVersion, latestCli)) return;
-	log.warn(`Your CLI (${cliVersion}) is behind the latest published version (${latestCli}).`);
-	log.info("Recommended: upgrade the CLI first, then rerun this command:");
-	console.log(`  ${pc.bold("npm install -g @elmohq/cli@latest")}`);
-	const proceed = assumeYes ? true : await p.confirm({
-		message: `Continue upgrading the stack with CLI ${cliVersion} anyway?`,
+async function submitNewsletterSignup(configDir, email) {
+	try {
+		const distinctId = (await isTelemetryDisabled(configDir) ? null : await readEnvKey(configDir, "DEPLOYMENT_ID")) ?? email;
+		const client = new PostHog(POSTHOG_PUBLIC_KEY, { host: POSTHOG_HOST });
+		client.capture({
+			distinctId,
+			event: "newsletter_signup",
+			properties: {
+				source: "cli_init",
+				$set: {
+					email,
+					wants_updates: true
+				}
+			}
+		});
+		await client.shutdown();
+	} catch {}
+}
+//#endregion
+//#region src/commands/init.ts
+const DEFAULT_APP_NAME = "Elmo";
+const DEFAULT_APP_ICON = "/icons/elmo-icon.svg";
+const DEFAULT_APP_PORT = 1515;
+const LOCAL_DATABASE_URL = "postgres://postgres:postgres@postgres:5432/elmo";
+const TELEMETRY_DOC_URL = "https://elmohq.com/docs/developer-guide/telemetry";
+const CLOUD_PRICING_URL = cloudPricingUrl("cli");
+/**
+* Guard an existing config from being replaced by accident. Returns the
+* deployment id to carry over, so a re-run keeps reporting as the same install.
+*/
+async function confirmEnvOverwrite(configDir) {
+	const existingEnvPath = path.join(configDir, ".env");
+	if (!await fileExists(existingEnvPath)) return void 0;
+	const contents = await fs.readFile(existingEnvPath, "utf8");
+	const isElmoEnv = contents.startsWith("# Rendered by elmo") || contents.startsWith("# Generated by elmo");
+	p.log.warn(isElmoEnv ? `An existing Elmo config was found at ${configDir}.` : `A .env file already exists in ${configDir} and was NOT created by Elmo.`);
+	const overwrite = await p.confirm({
+		message: isElmoEnv ? "Overwrite it with new values? Existing secrets (DATABASE_URL, API keys, etc.) will be replaced." : "Overwrite the existing .env file? This cannot be undone.",
 		initialValue: false
 	});
-	assertNotCancelled(proceed);
-	if (!proceed) {
-		p.cancel("Upgrade cancelled. Upgrade the CLI and rerun `elmo upgrade`.");
+	assertNotCancelled(overwrite);
+	if (!overwrite) {
+		p.cancel(isElmoEnv ? "Setup cancelled. Use `elmo edit env` to change individual values." : "Setup cancelled. Choose a different directory with --dir.");
 		process.exit(0);
 	}
+	return isElmoEnv ? parse(contents).DEPLOYMENT_ID : void 0;
 }
-async function pullAtCurrentVersion(configDir, cliVersion, assumeYes) {
-	log.success(`Already at ${cliVersion}.`);
-	const pull = assumeYes ? true : await p.confirm({
-		message: "Pull images for this version anyway?",
-		initialValue: false
+async function resolveDockerDirInteractive(cwd) {
+	const inCwd = await fileExists(path.join(cwd, "Dockerfile"));
+	const inDockerDir = await fileExists(path.join(cwd, "docker", "Dockerfile"));
+	const defaultDir = inCwd ? "." : inDockerDir ? "docker" : ".";
+	const dir = await p.text({
+		message: "Path to docker directory (contains Dockerfile)",
+		defaultValue: defaultDir
 	});
-	assertNotCancelled(pull);
-	if (pull) {
-		assertDockerRunning();
-		const wasRunning = await stackHasRunningServices(configDir);
-		log.step("Pulling images...");
-		await runDockerCompose(configDir, ["pull"]);
-		if (wasRunning) {
-			log.step("Restarting services...");
-			await runDockerCompose(configDir, ["up", "-d"]);
-		}
-	}
-	p.outro(pc.green("Nothing to upgrade."));
-}
-/**
-* With no detected version we can't tell which migrations apply, so we skip
-* them and just re-pin + pull. (planMigrations would also return [] here since
-* from === to, but it is special-cased for a clearer message.)
-*/
-function planUpgradeMigrations(detectedVersion, fromVersion, cliVersion) {
-	const plan = detectedVersion === null ? [] : planMigrations(fromVersion, cliVersion, MIGRATIONS);
-	if (detectedVersion === null) log.warn(`Couldn't detect the deployment's version — re-pinning images to ${pc.cyan(cliVersion)}.`);
-	else log.info(`Upgrading from ${pc.cyan(fromVersion)} → ${pc.cyan(cliVersion)}`);
-	if (plan.length === 0) {
-		log.step("No migrations to run (docker images will be re-pinned and pulled).");
-		return plan;
-	}
-	log.step(`Migrations to apply: ${plan.length}`);
-	for (const migration of plan) console.log(`  • ${pc.bold(`${migration.from} → ${migration.to}`)} ${migration.description}`);
-	return plan;
-}
-async function applyUpgradeMigrations(plan, ctx, wasRunning) {
-	try {
-		await runMigrations(plan, ctx);
-	} catch (error) {
-		log.error(`Migration failed: ${error instanceof Error ? error.message : String(error)}`);
-		log.info("Your config version was left unchanged. Fix the issue and rerun `elmo upgrade`.");
-		if (wasRunning) log.info("The stack was stopped for the upgrade. Restart with `elmo compose up -d` after fixing.");
+	assertNotCancelled(dir);
+	const resolved = path.resolve(cwd, dir);
+	if (!await fileExists(path.join(resolved, "Dockerfile"))) {
+		p.log.error(`Dockerfile not found in ${resolved}. Provide the directory that contains Dockerfile.`);
 		process.exit(1);
 	}
+	return resolved;
 }
-async function restartAfterUpgrade(configDir, wasRunning) {
-	if (!wasRunning) {
-		log.info("Stack was stopped before upgrade — leaving it stopped. Start with `elmo compose up -d`.");
-		return;
-	}
-	log.step("Starting services...");
-	await runDockerCompose(configDir, ["up", "-d"]);
-	const spinner = p.spinner();
-	spinner.start("Waiting for services to become healthy...");
-	if (await waitForHealthy(configDir, 18e4)) {
-		spinner.stop("All services healthy!");
-		return;
+async function resolveDockerLocation(options, cwd) {
+	if (!options.dev) return {
+		dockerDir: void 0,
+		repoRoot: cwd
+	};
+	if (!options.dockerDir) {
+		const dockerDir = await resolveDockerDirInteractive(cwd);
+		return {
+			dockerDir,
+			repoRoot: path.resolve(dockerDir, "..")
+		};
 	}
-	spinner.stop("Health check timed out.");
-	log.warn("Some services did not report healthy status.");
-}
-async function runUpgrade(options, cliVersion) {
-	printBanner();
-	p.intro(pc.bold("Upgrading Elmo"));
-	await confirmStaleCli(cliVersion, options.yes);
-	const configDir = await resolveConfigDir(options.dir);
-	const composePath = path.join(configDir, "elmo.yaml");
-	const detectedVersion = await readRenderedVersion(composePath);
-	const fromVersion = detectedVersion ?? cliVersion;
-	if (!semver.valid(fromVersion)) throw new Error(`Could not determine the installed version from ${composePath}.`);
-	if (semver.gt(fromVersion, cliVersion)) {
-		log.warn(`Your deployment (${fromVersion}) is newer than this CLI (${cliVersion}).`);
-		log.info("Upgrade the CLI to match, then rerun:");
-		console.log(`  ${pc.bold("npm install -g @elmohq/cli@latest")}`);
+	const dockerDir = path.resolve(cwd, options.dockerDir);
+	if (!await fileExists(path.join(dockerDir, "Dockerfile"))) {
+		p.log.error(`Dockerfile not found in ${dockerDir}`);
 		process.exit(1);
 	}
-	if (detectedVersion !== null && semver.eq(detectedVersion, cliVersion)) {
-		await pullAtCurrentVersion(configDir, cliVersion, options.yes);
-		return;
-	}
-	const plan = planUpgradeMigrations(detectedVersion, fromVersion, cliVersion);
-	const confirm = options.yes ? true : await p.confirm({
-		message: "Proceed with upgrade?",
-		initialValue: true
-	});
-	assertNotCancelled(confirm);
-	if (!confirm) {
-		p.cancel("Upgrade cancelled.");
-		process.exit(0);
-	}
-	assertDockerRunning();
-	const wasRunning = await stackHasRunningServices(configDir);
-	if (wasRunning) {
-		log.step("Stopping services...");
-		await runDockerCompose(configDir, ["down"]);
-	}
-	await applyUpgradeMigrations(plan, buildMigrationContext(configDir, cliVersion), wasRunning);
-	const isDev = await composeUsesBuild(composePath);
-	await repinComposeImages(composePath, cliVersion);
-	await refreshRenderedVersion(path.join(configDir, ".env"), cliVersion);
-	log.success(`Pinned config to ${cliVersion}.`);
-	if (isDev) log.info("Dev mode detected — rebuild with `elmo compose build` to apply the new version.");
-	else {
-		log.step("Pulling images...");
-		await runDockerCompose(configDir, ["pull"]);
-	}
-	await restartAfterUpgrade(configDir, wasRunning);
-	await trackCliEvent(configDir, "cli_upgrade", {
-		from_version: fromVersion,
-		to_version: cliVersion,
-		migrations_run: plan.length,
-		was_running: wasRunning,
-		dev_mode: isDev
-	});
-	p.outro(pc.green(`Upgraded to ${cliVersion}.`));
-}
-async function stackHasRunningServices(configDir) {
-	try {
-		return (await getComposeServices(configDir)).some((s) => s.State?.startsWith("running") ?? false);
-	} catch {
-		return false;
-	}
-}
-async function readRenderedVersion(filePath) {
-	try {
-		return parseRenderedVersion(await fs.readFile(filePath, "utf8"));
-	} catch {
-		return null;
-	}
-}
-async function composeUsesBuild(composePath) {
-	try {
-		const contents = await fs.readFile(composePath, "utf8");
-		return /^\s*build:/m.test(contents);
-	} catch {
-		return false;
-	}
-}
-async function repinComposeImages(composePath, version) {
-	const contents = await fs.readFile(composePath, "utf8");
-	await fs.writeFile(composePath, refreshHeaderVersion(repinImages(contents, version), version), "utf8");
-}
-async function refreshRenderedVersion(filePath, version) {
-	try {
-		const contents = await fs.readFile(filePath, "utf8");
-		await fs.writeFile(filePath, refreshHeaderVersion(contents, version), "utf8");
-	} catch {}
-}
-function buildMigrationContext(configDir, version) {
-	const envPath = path.join(configDir, ".env");
 	return {
-		configDir,
-		log: {
-			info: (msg) => log.info(msg),
-			warn: (msg) => log.warn(msg),
-			step: (msg) => log.step(msg)
-		},
-		readEnv: async () => {
-			try {
-				return parse(await fs.readFile(envPath, "utf8"));
-			} catch {
-				return {};
-			}
-		},
-		writeEnv: async (env) => {
-			await fs.writeFile(envPath, buildEnvFile(env, version), "utf8");
-		}
+		dockerDir,
+		repoRoot: path.resolve(dockerDir, "..")
 	};
 }
-function buildComposeYaml(options) {
-	const services = [];
-	const volumes = /* @__PURE__ */ new Set();
-	const dependsOnWeb = [];
-	const dependsOnWorker = [];
-	const dependencyConditions = {
-		postgres: "service_healthy",
-		"db-migrate": "service_completed_successfully"
-	};
-	const dockerfilePath = options.dockerDir ? path.relative(options.repoRoot, path.join(options.dockerDir, "Dockerfile")) : "docker/Dockerfile";
-	if (options.postgresMode === "docker") {
-		services.push(buildPostgresService());
-		services.push(buildDbMigrateService({
-			dev: options.dev,
-			dockerfilePath,
-			repoRoot: options.repoRoot,
-			version: options.version
-		}));
-		dependsOnWeb.push("db-migrate");
-		dependsOnWorker.push("db-migrate");
-		volumes.add("postgres_data");
-	}
-	services.push(buildWebService({
-		dev: options.dev,
-		dependsOn: dependsOnWeb,
-		dependencyConditions,
-		repoRoot: options.repoRoot,
-		dockerfilePath,
-		port: options.port,
-		version: options.version
-	}));
-	services.push(buildWorkerService({
-		dev: options.dev,
-		dependsOn: dependsOnWorker,
-		dependencyConditions,
-		repoRoot: options.repoRoot,
-		dockerfilePath,
-		version: options.version
-	}));
-	const lines = [
-		renderedByHeader(options.version),
+function validatePort(value) {
+	if (!value) return void 0;
+	const port = Number(value);
+	return Number.isInteger(port) && port >= 1 && port <= 65535 ? void 0 : "Must be an integer between 1 and 65535";
+}
+async function configureProvidersInteractive(env) {
+	p.note([
+		"Elmo needs two kinds of providers:",
 		"",
-		"name: elmo",
+		pc.bold("1. A scraper") + " — to track ChatGPT and Google AI Mode (no public APIs):",
+		`     • ${pc.cyan("Cloro")}      — most reliable, every surface, ~$0.65/mo per prompt ($30/mo min)`,
+		`     • ${pc.cyan("BrightData")} — pay-as-you-go and cheaper, but slower, ~$0.45/mo per prompt`,
+		`     • ${pc.cyan("Oxylabs")}    — cheapest per run, no Gemini/Copilot, $49/mo min`,
+		`     • ${pc.cyan("Olostep")}    — premium, built for high volume, ~$2.25/mo per prompt`,
+		`     • ${pc.cyan("DataForSEO")} — pay-as-you-go, scrapers + direct APIs, ~$1.20/mo per prompt`,
 		"",
-		"services:"
-	];
-	lines.push(...services.map((service) => indentBlock(service, 2)));
-	if (volumes.size > 0) {
-		lines.push("", "volumes:");
-		for (const volume of volumes) lines.push(`  ${volume}:`);
-	}
-	return `${lines.join("\n")}\n`;
-}
-function buildPostgresService() {
-	return [
-		"postgres:",
-		"  image: postgres:18-alpine",
-		"  environment:",
-		"    POSTGRES_USER: postgres",
-		"    POSTGRES_PASSWORD: postgres",
-		"    POSTGRES_DB: elmo",
-		"  volumes:",
-		"    - postgres_data:/var/lib/postgresql",
-		"  ports:",
-		"    - \"5432:5432\"",
-		"  healthcheck:",
-		"    test: [\"CMD-SHELL\", \"pg_isready -U postgres\"]",
-		"    interval: 5s",
-		"    timeout: 5s",
-		"    retries: 5",
-		"    start_period: 30s"
-	].join("\n");
-}
-function buildDbMigrateService(options) {
-	const lines = ["db-migrate:"];
-	if (options.dev) lines.push("  build:", `    context: ${options.repoRoot}`, `    dockerfile: ${options.dockerfilePath}`, "    target: migrate");
-	else lines.push(`  image: elmohq/elmo-db-migrate:${options.version}`);
-	lines.push("  environment:", "    - DATABASE_URL=postgres://postgres:postgres@postgres:5432/elmo", "  depends_on:", "    postgres:", "      condition: service_healthy");
-	return lines.join("\n");
+		pc.bold("2. A direct LLM API") + " — for low-latency tasks (onboarding analysis, sentiment scoring,",
+		"   ad-hoc LLM calls). Required:",
+		`     • ${pc.cyan("OpenRouter")} — one key, all major models (recommended)`,
+		`     • ${pc.cyan("Anthropic / OpenAI / Mistral")} — direct provider keys`,
+		"",
+		"Pricing assumes Elmo's default cadence (5 runs/day × 2 surfaces)."
+	].join("\n"), "AI providers");
+	const mode = await p.select({
+		message: "Setup mode",
+		options: [{
+			value: "recommended",
+			label: "Recommended — one scraper + one direct API"
+		}, {
+			value: "custom",
+			label: "Custom — pick each provider individually"
+		}],
+		initialValue: "recommended"
+	});
+	assertNotCancelled(mode);
+	if (mode === "recommended") await configureProvidersRecommended(env);
+	else await configureProvidersCustom(env);
+	return mode;
 }
-function buildWebService(options) {
-	const lines = ["web:"];
-	if (options.dev) lines.push("  build:", `    context: ${options.repoRoot}`, `    dockerfile: ${options.dockerfilePath}`, "    target: web", "    args:", "      DEPLOYMENT_MODE: local");
-	else lines.push(`  image: elmohq/elmo-web:${options.version}`);
-	lines.push("  env_file:", "    - path: .env", "      required: true", "  ports:", `    - "${options.port}:3000"`);
-	if (options.dependsOn.length > 0) {
-		lines.push("  depends_on:");
-		for (const service of options.dependsOn) {
-			const condition = options.dependencyConditions[service] ?? "service_started";
-			lines.push(`    ${service}:`, `      condition: ${condition}`);
-		}
-	}
-	return lines.join("\n");
+async function configureProvidersRecommended(env) {
+	const targets = [];
+	const scraper = await p.select({
+		message: "Scraper (tracks ChatGPT + Google AI Mode)",
+		options: [
+			{
+				value: "cloro",
+				label: "Cloro — most reliable, every surface (~$0.65/mo per prompt, $30/mo min)"
+			},
+			{
+				value: "brightdata",
+				label: "BrightData — pay-as-you-go, cheaper but slower (~$0.45/mo per prompt)"
+			},
+			{
+				value: "oxylabs",
+				label: "Oxylabs — cheapest per run, no Gemini/Copilot ($49/mo min)"
+			},
+			{
+				value: "olostep",
+				label: "Olostep — premium, built for high volume (~$2.25/mo per prompt)"
+			},
+			{
+				value: "dataforseo",
+				label: "DataForSEO — pay-as-you-go, scrapers + direct APIs (~$1.20/mo per prompt)"
+			}
+		],
+		initialValue: "cloro"
+	});
+	assertNotCancelled(scraper);
+	await collectScraperKey(scraper, env);
+	for (const model of DEFAULT_SCRAPER_MODELS) targets.push(formatScrapeTarget({
+		model,
+		provider: scraper,
+		webSearch: true
+	}));
+	const direct = await p.select({
+		message: "Direct LLM API (powers onboarding analysis + sentiment scoring)",
+		options: [
+			{
+				value: "openrouter",
+				label: "OpenRouter — one key, all major models (recommended)"
+			},
+			{
+				value: "anthropic",
+				label: "Anthropic — direct Claude"
+			},
+			{
+				value: "openai",
+				label: "OpenAI — direct GPT-* models"
+			},
+			{
+				value: "mistral",
+				label: "Mistral — direct Mistral models"
+			}
+		],
+		initialValue: "openrouter"
+	});
+	assertNotCancelled(direct);
+	await collectDirectApiQuick(direct, env);
+	await finalizeScrapeTargets(env, targets, { skipEdit: true });
 }
-function buildWorkerService(options) {
-	const lines = ["worker:"];
-	if (options.dev) lines.push("  build:", `    context: ${options.repoRoot}`, `    dockerfile: ${options.dockerfilePath}`, "    target: worker", "    args:", "      DEPLOYMENT_MODE: local");
-	else lines.push(`  image: elmohq/elmo-worker:${options.version}`);
-	lines.push("  env_file:", "    - path: .env", "      required: true");
-	lines.push("  stop_grace_period: 35s");
-	if (options.dependsOn.length > 0) {
-		lines.push("  depends_on:");
-		for (const service of options.dependsOn) {
-			const condition = options.dependencyConditions[service] ?? "service_started";
-			lines.push(`    ${service}:`, `      condition: ${condition}`);
-		}
-	}
-	return lines.join("\n");
+async function collectScraperKey(scraper, env) {
+	const spec = providerSpec(scraper);
+	const url = spec.signup?.url;
+	if (url) p.log.info(`Sign up: ${link(pc.cyan(url), url)}`);
+	await collectCredentials(spec, env);
 }
-function indentBlock(block, spaces) {
-	const indent = " ".repeat(spaces);
-	return block.split("\n").map((line) => `${indent}${line}`).join("\n");
+async function collectDirectApiQuick(kind, env) {
+	await collectCredentials(providerSpec(kind), env);
 }
-async function getComposeServices(configDir) {
-	const output = await runDockerComposeCapture(configDir, [
-		"ps",
-		"--format",
-		"json"
-	]);
-	if (!output.trim()) return [];
-	try {
-		const trimmed = output.trim();
-		const parsed = JSON.parse(trimmed);
-		if (Array.isArray(parsed)) return parsed;
-		if (typeof parsed === "object" && parsed !== null) return [parsed];
-		return [];
-	} catch {
-		try {
-			return output.trim().split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
-		} catch {
-			log.warn("Unable to parse docker compose status.");
-			return [];
-		}
+async function configureProvidersCustom(env) {
+	const targets = [];
+	p.log.step(pc.bold("Step 1 of 2 — Direct LLM API (at least one is required)"));
+	while (!hasDirectApiConfigured(env)) {
+		for (const spec of PROVIDER_PROMPTS.filter((candidate) => candidate.kind === "direct")) await collectProvider(spec, env, targets);
+		if (!hasDirectApiConfigured(env)) p.log.warn("Onboarding analysis and other low-latency LLM tasks require a direct API. Configure at least one before continuing.");
 	}
+	p.log.step(pc.bold("Step 2 of 2 — Scrapers (optional, but needed to track ChatGPT / Google AI Mode)"));
+	for (const spec of PROVIDER_PROMPTS.filter((candidate) => candidate.kind === "scraper")) await collectProvider(spec, env, targets);
+	await finalizeScrapeTargets(env, targets);
 }
-function isServiceReady(service) {
-	if (service.Health) return service.Health === "healthy";
-	if (service.State?.startsWith("running")) return true;
-	return false;
-}
-async function waitForHealthy(configDir, timeoutMs) {
-	const start = Date.now();
-	while (Date.now() - start < timeoutMs) {
-		const services = await getComposeServices(configDir);
-		if (services.length > 0 && services.every(isServiceReady)) return true;
-		await sleep(3e3);
+async function doStart(configDir) {
+	assertDockerRunning();
+	log.step("Starting Docker Compose stack...");
+	await runDockerCompose(configDir, ["up", "-d"]);
+	const s = p.spinner();
+	s.start("Waiting for services to become healthy...");
+	if (await waitForHealthy(configDir, 18e4)) s.stop("All services healthy!");
+	else {
+		s.stop("Health check timed out.");
+		p.log.warn("Some services did not report healthy status.");
 	}
-	return false;
-}
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
+	log.info("Examples:");
+	console.log(`  ${pc.bold("elmo compose logs -f")}`);
+	console.log(`  ${pc.bold("elmo compose logs -f web")}`);
+	console.log(`  ${pc.bold("elmo compose ps")}`);
+	console.log(`  ${pc.bold("elmo compose down")}`);
 }
-function runDockerCompose(configDir, args) {
-	return new Promise((resolve, reject) => {
-		const commandArgs = [
-			"compose",
-			"-f",
-			path.join(configDir, "elmo.yaml"),
-			...args
-		];
-		spawn("docker", commandArgs, { stdio: "inherit" }).on("close", (code) => {
-			if (code === 0) resolve();
-			else reject(/* @__PURE__ */ new Error(`docker compose exited with code ${code}`));
-		});
+async function runInit(options, version) {
+	printBanner();
+	p.intro(pc.bold("Setting up Elmo"));
+	p.note([
+		"Self-hosting Elmo is free, and always will be. But it does mean",
+		"running Postgres and a worker, and opening your own scraper and",
+		"model provider accounts.",
+		"",
+		`Elmo Cloud is the same open-source product, hosted by us, from`,
+		`${pc.bold(`$${CLOUD_ENTRY_PRICE_USD}/month`)} — scraper and model access included, nothing to`,
+		"keep running.",
+		"",
+		`  ${link(pc.cyan(CLOUD_PRICING_URL), CLOUD_PRICING_URL)}`
+	].join("\n"), "Prefer not to self-host?");
+	assertDockerRunning();
+	const cwd = process.cwd();
+	const configDir = options.dir ? path.resolve(cwd, options.dir) : CONFIG_HOME;
+	const preservedDeploymentId = await confirmEnvOverwrite(configDir);
+	const { dockerDir, repoRoot } = await resolveDockerLocation(options, cwd);
+	const postgresMode = await p.select({
+		message: "PostgreSQL connection",
+		options: [{
+			value: "docker",
+			label: "Run Postgres in Docker"
+		}, {
+			value: "external",
+			label: "Use existing Postgres (provide DATABASE_URL)"
+		}],
+		initialValue: "docker"
 	});
-}
-function runDockerComposeCapture(configDir, args) {
-	return new Promise((resolve, reject) => {
-		const commandArgs = [
-			"compose",
-			"-f",
-			path.join(configDir, "elmo.yaml"),
-			...args
-		];
-		const child = spawn("docker", commandArgs);
-		let stdout = "";
-		let stderr = "";
-		child.stdout.on("data", (data) => {
-			stdout += data.toString();
-		});
-		child.stderr.on("data", (data) => {
-			stderr += data.toString();
-		});
-		child.on("close", (code) => {
-			if (code === 0) resolve(stdout);
-			else reject(new Error(stderr || `docker compose exited with code ${code}`));
+	assertNotCancelled(postgresMode);
+	const env = {};
+	env.DEPLOYMENT_MODE = "local";
+	env.VITE_DEPLOYMENT_MODE = "local";
+	env.DEPLOYMENT_ID = preservedDeploymentId ?? crypto.randomUUID();
+	env.BETTER_AUTH_SECRET = generateSecret();
+	env.ELMO_ENCRYPTION_KEY = generateSecret(32, "base64");
+	env.APP_NAME = DEFAULT_APP_NAME;
+	env.APP_ICON = DEFAULT_APP_ICON;
+	env.VITE_APP_NAME = DEFAULT_APP_NAME;
+	env.VITE_APP_ICON = DEFAULT_APP_ICON;
+	if (postgresMode === "external") {
+		p.note("Must be an IPv4-compatible direct connection or database pooler.", "DATABASE_URL");
+		const url = await p.password({
+			message: "DATABASE_URL",
+			validate: (v) => !v ? "Required" : void 0
 		});
+		assertNotCancelled(url);
+		env.DATABASE_URL = url;
+	} else env.DATABASE_URL = LOCAL_DATABASE_URL;
+	const setupMode = await configureProvidersInteractive(env);
+	p.note([
+		"Elmo is open source and maintained by a small team. Telemetry",
+		"from both the CLI and your local deployment (web + worker)",
+		"tells us things like which CLI versions are still in use, where",
+		"`elmo init` drops off, which providers people pick, and whether",
+		"new features actually get used. Without it we are flying blind",
+		"on what to fix or build next.",
+		"",
+		pc.bold("What we send:"),
+		"  • deployment ID (random UUID stored as DEPLOYMENT_ID in your .env)",
+		"  • CLI/app version, OS, arch, Node version, deployment mode",
+		"  • command/event names + non-secret options (e.g. postgres mode)",
+		"  • feature counts (prompts edited, brands created — never the names or text)",
+		"  • IP address (recorded on each event by PostHog, used for geolocation)",
+		"",
+		pc.bold("What we never send:"),
+		"  API keys, .env contents, brand names, prompt text, and scraped responses.",
+		"",
+		`Full breakdown: ${link(pc.cyan(TELEMETRY_DOC_URL), TELEMETRY_DOC_URL)}`,
+		"Toggle later by editing DISABLE_TELEMETRY in .env (`elmo edit env`)."
+	].join("\n"), "Telemetry");
+	const telemetryEnabled = await p.confirm({
+		message: "Share telemetry?",
+		initialValue: true
 	});
-}
-function assertDockerRunning() {
-	if (spawnSync("docker", ["info"], { stdio: "ignore" }).status !== 0) throw new Error("Docker does not appear to be running. Start Docker and try again.");
-}
-async function resolveDockerDirInteractive(cwd) {
-	const inCwd = await fileExists(path.join(cwd, "Dockerfile"));
-	const inDockerDir = await fileExists(path.join(cwd, "docker", "Dockerfile"));
-	const defaultDir = inCwd ? "." : inDockerDir ? "docker" : ".";
-	const dir = await p.text({
-		message: "Path to docker directory (contains Dockerfile)",
-		defaultValue: defaultDir
+	assertNotCancelled(telemetryEnabled);
+	if (!telemetryEnabled) env.DISABLE_TELEMETRY = "1";
+	const updatesEmail = await p.text({
+		message: "Enter your work email to receive product updates (optional)",
+		placeholder: "you@example.com"
 	});
-	assertNotCancelled(dir);
-	const resolved = path.resolve(cwd, dir);
-	if (!await fileExists(path.join(resolved, "Dockerfile"))) {
-		p.log.error(`Dockerfile not found in ${resolved}. Provide the directory that contains Dockerfile.`);
-		process.exit(1);
+	const email = p.isCancel(updatesEmail) ? void 0 : updatesEmail || void 0;
+	const portInput = await p.text({
+		message: "Web app port",
+		placeholder: String(DEFAULT_APP_PORT),
+		defaultValue: String(DEFAULT_APP_PORT),
+		validate: validatePort
+	});
+	assertNotCancelled(portInput);
+	const port = Number(portInput);
+	env.APP_URL = `http://localhost:${port}`;
+	env.VITE_APP_URL = env.APP_URL;
+	const composeYaml = buildComposeYaml({
+		dev: Boolean(options.dev),
+		postgresMode,
+		repoRoot,
+		dockerDir,
+		port,
+		version
+	});
+	await ensureDir(configDir);
+	await writeConfigFiles(configDir, {
+		env,
+		composeYaml,
+		postgresMode,
+		dev: Boolean(options.dev),
+		version
+	});
+	p.log.success(`Config written to ${configDir}`);
+	p.log.warn("Your generated .env file contains secrets — do not commit it to version control.");
+	if (options.dev) p.log.info("Dev mode enabled. Run `elmo compose build` before starting.");
+	const shouldStart = await p.confirm({
+		message: "Start the stack now?",
+		initialValue: true
+	});
+	assertNotCancelled(shouldStart);
+	if (shouldStart) await doStart(configDir);
+	else p.log.info("You can start later with `elmo compose up -d`.");
+	await trackCliEvent(configDir, "cli_init", {
+		version,
+		os: process.platform,
+		arch: process.arch,
+		node_version: process.version,
+		postgres_mode: postgresMode,
+		dev_mode: Boolean(options.dev),
+		setup_mode: setupMode,
+		has_scraper: Boolean(env.BRIGHTDATA_API_TOKEN || env.OLOSTEP_API_KEY || env.OXYLABS_USERNAME || env.CLORO_API_KEY),
+		has_direct_api: hasDirectApiConfigured(env)
+	});
+	if (email) await submitNewsletterSignup(configDir, email);
+	p.log.message(`If you find Elmo useful, star us on GitHub!\n  ${link(pc.cyan("https://github.com/elmohq/elmo"), "https://github.com/elmohq/elmo")}`);
+	p.outro(pc.green("Setup complete!"));
+}
+//#endregion
+//#region src/migrations/planner.ts
+function planMigrations(from, to, all) {
+	if (!semver.valid(from)) throw new Error(`Invalid from version: ${from}`);
+	if (!semver.valid(to)) throw new Error(`Invalid to version: ${to}`);
+	if (semver.gt(from, to)) throw new Error(`Downgrade not supported: ${from} -> ${to}`);
+	if (semver.eq(from, to)) return [];
+	for (const m of all) {
+		if (!semver.valid(m.from)) throw new Error(`Migration has invalid from: ${m.from}`);
+		if (!semver.valid(m.to)) throw new Error(`Migration has invalid to: ${m.to}`);
+		if (!semver.gt(m.to, m.from)) throw new Error(`Migration ${m.from} -> ${m.to}: 'to' must be greater than 'from'`);
 	}
-	return resolved;
-}
-async function resolveConfigDir(explicitDir) {
-	const resolved = explicitDir ? path.resolve(process.cwd(), explicitDir) : CONFIG_HOME;
-	if (!await fileExists(path.join(resolved, "elmo.yaml"))) {
-		if (explicitDir) throw new Error(`Config directory does not contain elmo.yaml: ${resolved}\nRun \`elmo init --dir ${explicitDir}\` to create it.`);
-		throw new Error(`No config found at ${resolved}. Run \`elmo init\` to create one, or specify --dir.`);
+	const applicable = all.filter((m) => semver.gte(m.from, from) && semver.lt(m.from, to)).slice().sort((a, b) => semver.compare(a.from, b.from));
+	const seen = /* @__PURE__ */ new Set();
+	for (const m of applicable) {
+		if (seen.has(m.from)) throw new Error(`Multiple migrations registered with from=${m.from}`);
+		seen.add(m.from);
 	}
-	return resolved;
-}
-async function writeConfigFiles(configDir, initConfig) {
-	const envPath = path.join(configDir, ".env");
-	const composePath = path.join(configDir, "elmo.yaml");
-	await ensureDir(configDir);
-	await fs.writeFile(envPath, buildEnvFile(initConfig.env, initConfig.version), "utf8");
-	await fs.writeFile(composePath, initConfig.composeYaml, "utf8");
+	return applicable;
 }
-function buildEnvFile(env, version) {
-	const lines = [
-		renderedByHeader(version),
-		"# WARNING: contains secrets. Do not commit.",
-		""
-	];
-	for (const [key, rawValue] of Object.entries(env)) {
-		if (rawValue === void 0) continue;
-		lines.push(`${key}=${formatEnvValue(rawValue)}`);
+async function runMigrations(plan, ctx) {
+	for (const migration of plan) {
+		ctx.log.step(`Migrating ${migration.from} → ${migration.to}: ${migration.description}`);
+		await migration.run(ctx);
 	}
-	return `${lines.join("\n")}\n`;
-}
-function formatEnvValue(value) {
-	if (value === "") return "\"\"";
-	if (/[\s#"']/u.test(value)) return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
-	return value;
 }
-async function fileExists(target) {
-	try {
-		await fs.access(target);
-		return true;
-	} catch {
-		return false;
+//#endregion
+//#region src/migrations/index.ts
+const MIGRATIONS = [{
+	from: "0.2.17",
+	to: "0.2.18",
+	description: "add ELMO_ENCRYPTION_KEY for encrypted in-app provider credentials",
+	async run(ctx) {
+		const env = await ctx.readEnv();
+		if (env.ELMO_ENCRYPTION_KEY !== void 0) return;
+		env.ELMO_ENCRYPTION_KEY = randomBytes(32).toString("base64");
+		await ctx.writeEnv(env);
+		ctx.log.info("Added ELMO_ENCRYPTION_KEY — lets you store provider credentials encrypted in the app.");
 	}
-}
-async function ensureDir(dir) {
-	await fs.mkdir(dir, { recursive: true });
-}
+}];
+//#endregion
+//#region src/version.ts
 async function getPackageVersion() {
 	const selfDir = path.dirname(fileURLToPath(import.meta.url));
 	const packagePath = path.resolve(selfDir, "..", "package.json");
@@ -1624,6 +1395,190 @@ async function maybeNotifyNewVersion(currentVersion) {
 	if (!latest) return;
 	if (semver.valid(currentVersion) && semver.lt(currentVersion, latest)) log.warn(`New CLI version available (${latest}). Run: npm install -g @elmohq/cli@latest`);
 }
+//#endregion
+//#region src/commands/upgrade.ts
+async function confirmStaleCli(cliVersion, assumeYes) {
+	const latestCli = await fetchLatestCliVersion();
+	if (!latestCli || !semver.valid(cliVersion) || !semver.lt(cliVersion, latestCli)) return;
+	log.warn(`Your CLI (${cliVersion}) is behind the latest published version (${latestCli}).`);
+	log.info("Recommended: upgrade the CLI first, then rerun this command:");
+	console.log(`  ${pc.bold("npm install -g @elmohq/cli@latest")}`);
+	const proceed = assumeYes ? true : await p.confirm({
+		message: `Continue upgrading the stack with CLI ${cliVersion} anyway?`,
+		initialValue: false
+	});
+	assertNotCancelled(proceed);
+	if (!proceed) {
+		p.cancel("Upgrade cancelled. Upgrade the CLI and rerun `elmo upgrade`.");
+		process.exit(0);
+	}
+}
+async function pullAtCurrentVersion(configDir, cliVersion, assumeYes) {
+	log.success(`Already at ${cliVersion}.`);
+	const pull = assumeYes ? true : await p.confirm({
+		message: "Pull images for this version anyway?",
+		initialValue: false
+	});
+	assertNotCancelled(pull);
+	if (pull) {
+		assertDockerRunning();
+		const wasRunning = await stackHasRunningServices(configDir);
+		log.step("Pulling images...");
+		await runDockerCompose(configDir, ["pull"]);
+		if (wasRunning) {
+			log.step("Restarting services...");
+			await runDockerCompose(configDir, ["up", "-d"]);
+		}
+	}
+	p.outro(pc.green("Nothing to upgrade."));
+}
+/**
+* With no detected version we can't tell which migrations apply, so we skip
+* them and just re-pin + pull. (planMigrations would also return [] here since
+* from === to, but it is special-cased for a clearer message.)
+*/
+function planUpgradeMigrations(detectedVersion, fromVersion, cliVersion) {
+	const plan = detectedVersion === null ? [] : planMigrations(fromVersion, cliVersion, MIGRATIONS);
+	if (detectedVersion === null) log.warn(`Couldn't detect the deployment's version — re-pinning images to ${pc.cyan(cliVersion)}.`);
+	else log.info(`Upgrading from ${pc.cyan(fromVersion)} → ${pc.cyan(cliVersion)}`);
+	if (plan.length === 0) {
+		log.step("No migrations to run (docker images will be re-pinned and pulled).");
+		return plan;
+	}
+	log.step(`Migrations to apply: ${plan.length}`);
+	for (const migration of plan) console.log(`  • ${pc.bold(`${migration.from} → ${migration.to}`)} ${migration.description}`);
+	return plan;
+}
+async function applyUpgradeMigrations(plan, ctx, wasRunning) {
+	try {
+		await runMigrations(plan, ctx);
+	} catch (error) {
+		log.error(`Migration failed: ${error instanceof Error ? error.message : String(error)}`);
+		log.info("Your config version was left unchanged. Fix the issue and rerun `elmo upgrade`.");
+		if (wasRunning) log.info("The stack was stopped for the upgrade. Restart with `elmo compose up -d` after fixing.");
+		process.exit(1);
+	}
+}
+async function restartAfterUpgrade(configDir, wasRunning) {
+	if (!wasRunning) {
+		log.info("Stack was stopped before upgrade — leaving it stopped. Start with `elmo compose up -d`.");
+		return;
+	}
+	log.step("Starting services...");
+	await runDockerCompose(configDir, ["up", "-d"]);
+	const spinner = p.spinner();
+	spinner.start("Waiting for services to become healthy...");
+	if (await waitForHealthy(configDir, 18e4)) {
+		spinner.stop("All services healthy!");
+		return;
+	}
+	spinner.stop("Health check timed out.");
+	log.warn("Some services did not report healthy status.");
+}
+async function runUpgrade(options, cliVersion) {
+	printBanner();
+	p.intro(pc.bold("Upgrading Elmo"));
+	await confirmStaleCli(cliVersion, options.yes);
+	const configDir = await resolveConfigDir(options.dir);
+	const composePath = path.join(configDir, "elmo.yaml");
+	const detectedVersion = await readRenderedVersion(composePath);
+	const fromVersion = detectedVersion ?? cliVersion;
+	if (!semver.valid(fromVersion)) throw new Error(`Could not determine the installed version from ${composePath}.`);
+	if (semver.gt(fromVersion, cliVersion)) {
+		log.warn(`Your deployment (${fromVersion}) is newer than this CLI (${cliVersion}).`);
+		log.info("Upgrade the CLI to match, then rerun:");
+		console.log(`  ${pc.bold("npm install -g @elmohq/cli@latest")}`);
+		process.exit(1);
+	}
+	if (detectedVersion !== null && semver.eq(detectedVersion, cliVersion)) {
+		await pullAtCurrentVersion(configDir, cliVersion, options.yes);
+		return;
+	}
+	const plan = planUpgradeMigrations(detectedVersion, fromVersion, cliVersion);
+	const confirm = options.yes ? true : await p.confirm({
+		message: "Proceed with upgrade?",
+		initialValue: true
+	});
+	assertNotCancelled(confirm);
+	if (!confirm) {
+		p.cancel("Upgrade cancelled.");
+		process.exit(0);
+	}
+	assertDockerRunning();
+	const wasRunning = await stackHasRunningServices(configDir);
+	if (wasRunning) {
+		log.step("Stopping services...");
+		await runDockerCompose(configDir, ["down"]);
+	}
+	await applyUpgradeMigrations(plan, buildMigrationContext(configDir, cliVersion), wasRunning);
+	const isDev = await composeUsesBuild(composePath);
+	await repinComposeImages(composePath, cliVersion);
+	await refreshRenderedVersion(path.join(configDir, ".env"), cliVersion);
+	log.success(`Pinned config to ${cliVersion}.`);
+	if (isDev) log.info("Dev mode detected — rebuild with `elmo compose build` to apply the new version.");
+	else {
+		log.step("Pulling images...");
+		await runDockerCompose(configDir, ["pull"]);
+	}
+	await restartAfterUpgrade(configDir, wasRunning);
+	await trackCliEvent(configDir, "cli_upgrade", {
+		from_version: fromVersion,
+		to_version: cliVersion,
+		migrations_run: plan.length,
+		was_running: wasRunning,
+		dev_mode: isDev
+	});
+	p.outro(pc.green(`Upgraded to ${cliVersion}.`));
+}
+function buildMigrationContext(configDir, version) {
+	const envPath = path.join(configDir, ".env");
+	return {
+		configDir,
+		log: {
+			info: (msg) => log.info(msg),
+			warn: (msg) => log.warn(msg),
+			step: (msg) => log.step(msg)
+		},
+		readEnv: async () => {
+			try {
+				return parse(await fs.readFile(envPath, "utf8"));
+			} catch {
+				return {};
+			}
+		},
+		writeEnv: async (env) => {
+			await fs.writeFile(envPath, buildEnvFile(env, version), "utf8");
+		}
+	};
+}
+//#endregion
+//#region src/index.ts
+async function main() {
+	const version = await getPackageVersion();
+	const program = new Command();
+	program.name("elmo").version(version).option("--dir <path>", "Config directory").configureHelp({ showGlobalOptions: true }).action(() => {
+		printBanner();
+		program.outputHelp();
+	});
+	program.command("init").description("set up local Elmo instance").option("--dev", "Use local build context (repo only)").option("--docker-dir <path>", "Path to Docker build context (dev mode)").action(async (_opts, cmd) => {
+		await withVersionCheck(version, () => runInit(cmd.optsWithGlobals(), version));
+	});
+	program.command("compose").description("run Docker Compose commands using your Elmo config").allowUnknownOption(true).argument("[args...]", "Arguments passed to Docker Compose").action(async (args, _opts, cmd) => {
+		await withVersionCheck(version, () => runCompose(args, cmd.optsWithGlobals()));
+	});
+	program.command("edit").description("change API keys, scrape targets, or the Docker Compose YAML").argument("<env|compose>", "which config file to edit").action(async (target, _opts, cmd) => {
+		await runEdit(target, cmd.optsWithGlobals());
+	});
+	program.command("upgrade").description("upgrade your Elmo deployment to this CLI's version").option("--yes", "skip confirmation prompts").action(async (_opts, cmd) => {
+		await runUpgrade(cmd.optsWithGlobals(), version);
+	});
+	await program.parseAsync(process.argv);
+}
+async function withVersionCheck(version, fn) {
+	const notifyPromise = maybeNotifyNewVersion(version);
+	await fn();
+	await notifyPromise.catch(() => void 0);
+}
 main().catch((error) => {
 	const msg = error instanceof Error ? error.message : String(error);
 	console.error(`\n${pc.red("Error:")} ${msg}`);