create-ragen-app 0.3.0 → 0.5.0

package/README.md

@@ -9,25 +9,32 @@ npx create-ragen-app my-ragen-app
 
 It clones the repo, generates every secret it safely can, lets you paste a
 plain OpenAI or Anthropic API key instead of configuring an enterprise model
-provider, starts the backing services (Postgres, Qdrant, Temporal, LiteLLM,
-Redis, …) in Docker, and runs the app's own first-run setup (Prisma client,
-migrations, seed data). What is left is starting the two apps, in separate
-terminals:
+provider, starts the backing services (Postgres, Qdrant, Redis, …) in Docker,
+and runs the app's own first-run setup (Prisma client, migrations, seed
+data). What is left is starting the three processes, in separate terminals:
 
 ```bash
 cd my-ragen-app
-npm run api:dev   # apps/api — the web app creates threads through it
-npm run web:dev   # apps/web — http://localhost:3000
+npm run api:dev     # apps/api — the web app creates threads through it
+npm run web:dev     # apps/web — http://localhost:3000
+npm run worker:dev  # apps/worker — document ingest runs here
 ```
 
 `apps/api` is not optional: `apps/web` delegates thread creation, the thread
 sidebar and notifications to it (ADR-21), so running only the web app gets you
-a panel that loads and a chat that cannot open a thread.
+a panel that loads and a chat that cannot open a thread. Neither is the
+worker: without it an upload is accepted and never parsed — the queue fills
+and nothing drains it.
+
+The scaffold answers BullMQ, which runs on the Redis the compose file already
+starts (ADR-44). Temporal is still selectable and is no longer a service this
+install runs, so choosing it asks for the address of the server you run
+yourself.
 
 ## Node version
 
 A Ragen installation needs Node 24, and the wizard refuses to create one on
-anything older *before* it clones. Not because the CLI needs it — it does not,
+anything older _before_ it clones. Not because the CLI needs it — it does not,
 and 0.2.0 was published and verified on Node 22 by accident — but because the
 setup it runs for you (`npm install` across the monorepo, `prisma generate`,
 `migrate deploy`, the seed) runs under the caller's Node and leaves a tree
@@ -44,21 +51,23 @@ requirement".
 This package is the only thing that exercises the first-run path.
 `.github/workflows/installer.yml` runs it on pushes to `main` and on pull
 requests from this repository: it packs the package, installs the tarball,
-scaffolds from the branch under review and asserts the result is configured.
+scaffolds from the commit under review and asserts the result is configured.
 That catches a broken installer, but only for the cases the assertions cover —
 `AGENTS.md`'s Post-Task Workflow still asks for an update here in the same PR,
 and for the PR description to say so.
 
 What counts as install-affecting:
 
-| Change | What to update here |
-| --- | --- |
-| A new or renamed env var that a fresh install must set | `src/manifest.ts` (generated secret or corrected default) |
-| A default model, embedding model or `VECTOR_SIZE` change | `src/llm-provider.ts` — and the two must stay consistent, or Qdrant rejects every upsert |
-| An app the web app can no longer run without | the outro in `src/cli.ts`, which tells people what to start |
-| A new first-run step (migration, seed, generate) | `src/tasks.ts` and `maybeRunFirstTimeSetup` |
-| A `docker-compose.yml` service, port or name change | `src/tasks.ts`, and the collision check in `ragenStackVolumeExists` |
-| A gate that a brand-new install cannot pass (registration, licensing, onboarding) | usually the app, not this package — a fresh install must be able to reach a working chat without an administrator who does not exist yet |
+| Change                                                                            | What to update here                                                                                                                                                                                             |
+| --------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| A new or renamed env var that a fresh install must set                            | `src/manifest.ts` (generated secret or corrected default)                                                                                                                                                       |
+| A default model, embedding model or `VECTOR_SIZE` change                          | `src/llm-provider.ts` — and the two must stay consistent, or Qdrant rejects every upsert                                                                                                                        |
+| A new `@ragenai/llm-gateway` provider, or a change to route-table shape           | `src/llm-provider.ts` (`gatewayProvider`, `upstreamModel`) and `src/route-table.ts` — the scaffold writes `infra/llm-gateway/routes.yaml`, which is what a scaffolded install actually reads                    |
+| An app the web app can no longer run without                                      | the outro in `src/cli.ts`, which tells people what to start                                                                                                                                                     |
+| A variable a provider seam makes required                                         | `src/worker-runtime.ts`, `src/storage-provider.ts` or `src/encryption-provider.ts` — the selection writes it, and `tests/architecture/create-ragen-app-knows-the-provider-seams.test.ts` fails when it does not |
+| A new first-run step (migration, seed, generate)                                  | `src/tasks.ts` and `maybeRunFirstTimeSetup`                                                                                                                                                                     |
+| A `docker-compose.yml` service, port or name change                               | `src/tasks.ts`, and the collision check in `ragenStackVolumeExists`                                                                                                                                             |
+| A gate that a brand-new install cannot pass (registration, licensing, onboarding) | usually the app, not this package — a fresh install must be able to reach a working chat without an administrator who does not exist yet                                                                        |
 
 `tests/architecture/create-ragen-app-manifest-is-current.test.ts` catches one
 direction only: a key this package writes that the `.env.example` no longer
@@ -67,12 +76,12 @@ about — has no textual signal, which is why the rule above is a rule.
 
 ## Flags
 
-| Flag              | Effect                                             |
-| ----------------- | --------------------------------------------------- |
-| `--ref=<branch>`  | Clone a branch/tag other than `main`                 |
-| `--skip-docker`   | Write the `.env.local` files but don't start Docker  |
-| `--skip-install`  | Skip `npm install` / Prisma / seed                   |
-| `--yes`           | Accept every default without prompting               |
+| Flag                           | Effect                                                                            |
+| ------------------------------ | --------------------------------------------------------------------------------- |
+| `--ref=<ref>`                  | Clone a branch, tag or commit SHA other than `main`                               |
+| `--skip-docker`                | Write the `.env.local` files but don't start Docker                               |
+| `--skip-install`               | Skip `npm install` / Prisma / seed                                                |
+| `--yes`                        | Accept every default without prompting                                            |
 | `--provider=openai\|anthropic` | Take the API key from `OPENAI_API_KEY` / `ANTHROPIC_API_KEY` instead of prompting |
 
 Anything the wizard doesn't ask about (S3 storage, encryption at rest,
@@ -83,11 +92,11 @@ Stripe, email, MCP connectors) ships exactly as documented in the repo's own
 ## Declining to paste a key
 
 Typing a provider API key into someone else's CLI is a reasonable thing to
-refuse, so the provider step is skippable — pick *"I'll configure LiteLLM
-myself"*, or press enter on an empty key. The install still completes, and
+refuse, so the provider step is skippable — pick _"I will configure the routes
+myself"_, or press enter on an empty key. The install still completes, and
 `SETUP-LLM.md` is written into the new directory with the exact `.env.local`
-values and `model_list` entries for OpenAI and Anthropic, plus the one
-ordering constraint that matters (`VECTOR_SIZE` has to be right *before* the
+values and route-table entries for OpenAI and Anthropic, plus the one
+ordering constraint that matters (`VECTOR_SIZE` has to be right _before_ the
 first document is indexed). `src/manual-setup.ts` generates that file from
 `LLM_PROVIDERS`, so it cannot drift from what the wizard would have done.
 
@@ -95,7 +104,7 @@ first document is indexed). `src/manual-setup.ts` generates that file from
 
 `src/manifest.ts` is the single list of which env vars get a generated
 secret or a corrected local-dev default, and which files receive them. It is
-deliberately an *overrides* list — anything not in it is left exactly as the
+deliberately an _overrides_ list — anything not in it is left exactly as the
 cloned repo's own `.env.example` already has it. See the file's own comments
 for the sharing rules (some secrets are the same value in two files, most are
 independent).
@@ -117,7 +126,7 @@ npm install --prefix "$pack" "$pack"/create-ragen-app-*.tgz
 Three details, each of which this file previously got wrong:
 
 - **Install the tarball, do not hand it to `npx`.** `npx ./thing.tgz` does not
-  install and run a local package — it tries to *execute* the file, and fails
+  install and run a local package — it tries to _execute_ the file, and fails
   with `Permission denied`. `.github/workflows/installer.yml` installs it,
   which is why CI passed while the command written here never ran.
 - **Glob the filename.** `npm pack` names the tarball after the version in
@@ -127,9 +136,16 @@ Three details, each of which this file previously got wrong:
   expands to several paths, and `npm install` would be handed all of them.
 
 `--ref` is the part people forget: the CLI clones the repository from GitHub,
-so testing a change to the *app* needs that branch pushed. Without it you are
+so testing a change to the _app_ needs that branch pushed. Without it you are
 testing new installer code against old repository content.
 
+It takes anything GitHub's tarball endpoint resolves — a branch, a tag, or a
+full commit SHA. The `Installer` workflow passes the **commit**, because a
+branch can be deleted by the merge while the job is still running and the
+endpoint then 404s on a name that resolved seconds earlier. Prefer a SHA
+anywhere the ref is chosen by a machine rather than typed by hand. See
+[the lesson](../../docs/lessons/a-ci-job-that-clones-a-branch-races-the-merge.md).
+
 `prepare` runs `clean` before `build` deliberately. `files` publishes `dist`
 wholesale and `tsc` does not remove the output of a source file that no
 longer exists, so without the clean a renamed or deleted module ships as a
@@ -164,7 +180,7 @@ everyone else can see, rather than from whatever happens to be in the working
 directory.
 
 The two middle lines of the first block are there because of what `npm
-version` does *not* do for a workspace. Both have already cost this package a
+version` does _not_ do for a workspace. Both have already cost this package a
 release:
 
 - **It does not commit, and does not tag.** In a single-package repository it

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA6DA;;;;;;GAMG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAgJ1D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA+EA;;;;;;GAMG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAwO1D"}

package/dist/cli.js

@@ -40,13 +40,17 @@ const clack = __importStar(require("@clack/prompts"));
 const dotenv_1 = require("dotenv");
 const args_1 = require("./args");
 const clone_1 = require("./clone");
+const config_file_1 = require("./config-file");
+const encryption_provider_1 = require("./encryption-provider");
 const env_file_1 = require("./env-file");
-const litellm_config_1 = require("./litellm-config");
 const manual_setup_1 = require("./manual-setup");
+const route_table_1 = require("./route-table");
 const node_version_1 = require("./node-version");
 const llm_provider_1 = require("./llm-provider");
 const manifest_1 = require("./manifest");
 const secrets_1 = require("./secrets");
+const storage_provider_1 = require("./storage-provider");
+const worker_runtime_1 = require("./worker-runtime");
 const tasks_1 = require("./tasks");
 /** Written into the new install whenever a model still has to be wired by hand. */
 const MANUAL_SETUP_FILENAME = 'SETUP-LLM.md';
@@ -104,6 +108,34 @@ async function run(argv) {
     if (llmChoice) {
         Object.assign(rootOverrides, llmChoice.envUpdates);
     }
+    // Storage and encryption were skipped by every earlier version of this
+    // wizard, and both are worse to answer later than now: turning encryption on
+    // afterwards leaves everything already written in plaintext, because nothing
+    // re-encrypts history, and moving storage strands the files already uploaded.
+    const storagePrompt = await resolveStorage(args);
+    if (storagePrompt.cancelled) {
+        clack.cancel('Cancelled.');
+        return false;
+    }
+    const encryptionPrompt = await resolveEncryption(args);
+    if (encryptionPrompt.cancelled) {
+        clack.cancel('Cancelled.');
+        return false;
+    }
+    // Asked here rather than left to an env edit, because choosing BullMQ is
+    // also what configures the queue dashboard — and an install that picked the
+    // runtime but not the dashboard would have no view of its own queues, which
+    // is what the Temporal UI gave away for free.
+    const runtimePrompt = await resolveWorkerRuntime(args);
+    if (runtimePrompt.cancelled) {
+        clack.cancel('Cancelled.');
+        return false;
+    }
+    const workerRuntime = runtimePrompt.selection;
+    Object.assign(rootOverrides, workerRuntime.envUpdates);
+    const storage = storagePrompt.selection;
+    const encryption = encryptionPrompt.selection;
+    Object.assign(rootOverrides, storage.envUpdates, encryption.envUpdates);
     const rootWrite = writeEnvFile(targetDir, 'root', rootOverrides);
     const adminWrite = writeEnvFile(targetDir, 'admin', adminOverrides);
     const missingKeys = [...rootWrite.missingKeys, ...adminWrite.missingKeys];
@@ -114,8 +146,34 @@ async function run(argv) {
         ].join('\n'));
         return false;
     }
+    // After the env write, so a run that stops on drifted keys has not already
+    // rewritten a file in the clone.
+    try {
+        (0, config_file_1.writeRagenConfig)(targetDir, storage, encryption);
+    }
+    catch (error) {
+        clack.cancel(`Could not update ragen.config.ts: ${String(error)}\n` +
+            'The environment is written and correct; only the typed config is out of date. Fix its storage/encryption block by hand.');
+        return false;
+    }
+    if (encryption.generatedKey) {
+        clack.log.info([
+            'Generated an encryption key into .env.local as ENCRYPTION_MASTER_KEY.',
+            'Back it up: messages and documents encrypted with it cannot be read',
+            'without it, and nothing can re-derive it.',
+        ].join(' '));
+    }
+    if (encryption.provider === 'none') {
+        clack.log.warn([
+            'Encryption is off, so messages and documents are stored in plaintext.',
+            'Turning it on later leaves everything written before then unencrypted —',
+            'nothing re-encrypts history.',
+        ].join(' '));
+    }
     if (llmChoice) {
-        patchLiteLLMConfig(targetDir, llmChoice.liteLLMEntries);
+        // The route table is the whole of it now: B6 removed the proxy, so there
+        // is no second file to keep in step and no rollback that needs one.
+        (0, route_table_1.writeRouteTable)(targetDir, llmChoice.routes);
         if (!llmChoice.embeddingsConfigured) {
             clack.log.warn([
                 'Chat is configured, but this provider has no embeddings API — the',
@@ -133,10 +191,11 @@ async function run(argv) {
         clack.note([
             'No LLM provider configured, so chat and the knowledge base are off.',
             '',
-            'Two files to edit, then `docker compose restart litellm`:',
-            '  .env.local              — your key, DEFAULT_MODEL, REPHRASE_MODEL,',
-            '                            EMBEDDINGS_MODEL, VECTOR_SIZE',
-            '  infra/litellm/config.yaml — a model_list entry per model',
+            'Two files to edit:',
+            '  .env.local                    — your key, DEFAULT_MODEL,',
+            '                                  REPHRASE_MODEL, EMBEDDINGS_MODEL,',
+            '                                  VECTOR_SIZE',
+            `  ${route_table_1.ROUTE_TABLE_PATH} — a route per model`,
             '',
             `Exact values for OpenAI and Anthropic are written to ${guidePath}.`,
         ].join('\n'), 'Configure a model later');
@@ -157,18 +216,34 @@ async function run(argv) {
             return false;
         }
     }
+    // Printed before the outro, and printed at all because it is the only time
+    // this value is readable: it is written to .env.local and never shown again.
+    if (workerRuntime.dashboard) {
+        const { user, password, port } = workerRuntime.dashboard;
+        clack.note([
+            `http://localhost:${port}`,
+            `user:     ${user}`,
+            `password: ${password}`,
+            '',
+            'Generated for this install and written to .env.local. It is not a',
+            'shared default — every install gets its own — so save it now if you',
+            'want it somewhere other than that file.',
+        ].join('\n'), 'Queue dashboard');
+    }
     clack.outro([
         'Done. Next steps:',
         `  cd ${targetDir}`,
         '  npm run api:dev     # in one terminal',
         '  npm run web:dev     # in another',
+        '  npm run worker:dev  # in a third — document ingest runs here',
         '',
         // Both, not just web: apps/web delegates thread creation, the thread
         // sidebar and notifications to apps/api (ADR-21), so starting only the
         // web app gets you a panel that loads and a chat that cannot open a
         // thread.
         'apps/api is not optional — the web app creates threads through it,',
-        'so chat fails without it.',
+        'so chat fails without it. Without the worker an upload is accepted and',
+        'never parsed: the queue fills and nothing drains it.',
         '',
         'App:   http://localhost:3000',
         'API:   http://localhost:3001',
@@ -241,6 +316,218 @@ function writeEnvFile(targetDir, target, overrides) {
     (0, node_fs_1.writeFileSync)(localPath, content, { mode: 0o600 });
     return { content, missingKeys };
 }
+/**
+ * Whether the wizard may ask anything at all.
+ *
+ * `--yes` is the obvious one. `--provider=` is the other, and it is not
+ * obvious: that flag exists so CI can run this wizard, *because CI cannot
+ * answer a prompt*. Adding a question that `--provider` does not silence would
+ * hang every automated install — the flag's whole purpose, undone by a
+ * question about buckets.
+ *
+ * A person who would rather not type an API key into a CLI, and does want to
+ * be asked about storage, omits the flag and exports the key instead.
+ */
+function isUnattended(args) {
+    return args.yes || args.provider !== undefined;
+}
+/**
+ * Unattended installs take the shipped defaults: files on disk (ADR-27) and a
+ * generated encryption key.
+ *
+ * Encryption is *on* in that path on purpose. The alternative defaults an
+ * install to plaintext, and the only cost of the key is a line in `.env.local`
+ * the wizard writes itself — where the cost of not having it is that every
+ * message written before someone thinks to turn it on stays readable forever.
+ */
+async function resolveStorage(args) {
+    if (isUnattended(args)) {
+        return { cancelled: false, selection: (0, storage_provider_1.resolveStorageSelection)('local') };
+    }
+    return promptStorage();
+}
+async function resolveEncryption(args) {
+    if (isUnattended(args)) {
+        return { cancelled: false, selection: (0, encryption_provider_1.resolveEncryptionSelection)('local') };
+    }
+    return promptEncryption();
+}
+/**
+ * Unattended installs take BullMQ, the shipped default.
+ *
+ * The reasoning did not change when the answer did: `--yes` means "accept the
+ * defaults", not "pick an engine on the operator's behalf". It used to answer
+ * Temporal because that is what the compose file ran; ADR-44 took Temporal out
+ * of it, so answering Temporal now would scaffold an install whose worker
+ * connects to a server nobody started. An install that wants durable execution
+ * answers the prompt, and brings its own address with it.
+ */
+async function resolveWorkerRuntime(args) {
+    if (isUnattended(args)) {
+        return {
+            cancelled: false,
+            selection: (0, worker_runtime_1.resolveWorkerRuntimeSelection)('bullmq'),
+        };
+    }
+    return promptWorkerRuntime();
+}
+async function promptWorkerRuntime() {
+    const choice = await clack.select({
+        message: 'Which engine should run background jobs?',
+        // BullMQ first, because clack's first option is the one a bare Enter
+        // takes — and it is the one this install's compose file can actually run.
+        options: ['bullmq', 'temporal'].map((value) => ({
+            value,
+            label: worker_runtime_1.WORKER_RUNTIME_LABELS[value],
+        })),
+    });
+    if (clack.isCancel(choice)) {
+        return { cancelled: true };
+    }
+    if (choice !== 'temporal') {
+        return {
+            cancelled: false,
+            selection: (0, worker_runtime_1.resolveWorkerRuntimeSelection)('bullmq'),
+        };
+    }
+    // Asked rather than defaulted, because the answer stopped being local.
+    // Temporal left the compose file with ADR-44, so this address names a server
+    // the operator runs; `localhost:7233` is right on a laptop and silent
+    // everywhere else — a deployed worker pointing at its own container connects
+    // to nothing and processes nothing, with no error to read.
+    clack.log.warn([
+        'Temporal is not in this install’s docker-compose.yml (ADR-44) — it is an',
+        'adapter now, and you run the server yourself. Nothing below starts one.',
+    ].join(' '));
+    const address = await clack.text({
+        message: 'Temporal server address?',
+        initialValue: worker_runtime_1.DEFAULT_TEMPORAL_SERVER_ADDRESS,
+        placeholder: worker_runtime_1.DEFAULT_TEMPORAL_SERVER_ADDRESS,
+    });
+    if (clack.isCancel(address)) {
+        return { cancelled: true };
+    }
+    return {
+        cancelled: false,
+        selection: (0, worker_runtime_1.resolveWorkerRuntimeSelection)('temporal', {
+            temporalServerAddress: String(address),
+        }),
+    };
+}
+async function promptStorage() {
+    const choice = await clack.select({
+        message: 'Where should uploaded documents be stored?',
+        options: ['local', 's3'].map((value) => ({
+            value,
+            label: storage_provider_1.STORAGE_LABELS[value],
+        })),
+    });
+    if (clack.isCancel(choice)) {
+        return { cancelled: true };
+    }
+    if (choice === 'local') {
+        return { cancelled: false, selection: (0, storage_provider_1.resolveStorageSelection)('local') };
+    }
+    const bucket = await clack.text({
+        message: 'Bucket name',
+        validate: (value) => (value.trim() ? undefined : 'Required for S3.'),
+    });
+    if (clack.isCancel(bucket)) {
+        return { cancelled: true };
+    }
+    const region = await clack.text({
+        message: 'Region',
+        placeholder: 'fr-par, us-east-1, auto',
+        validate: (value) => (value.trim() ? undefined : 'Required for S3.'),
+    });
+    if (clack.isCancel(region)) {
+        return { cancelled: true };
+    }
+    const endpoint = await clack.text({
+        message: 'Endpoint URL (blank for AWS)',
+        placeholder: 'https://s3.fr-par.scw.cloud',
+        defaultValue: '',
+    });
+    if (clack.isCancel(endpoint)) {
+        return { cancelled: true };
+    }
+    const accessKeyId = await clack.text({
+        message: 'Access key ID',
+        validate: (value) => (value.trim() ? undefined : 'Required for S3.'),
+    });
+    if (clack.isCancel(accessKeyId)) {
+        return { cancelled: true };
+    }
+    // password, not text: this one is a secret and should not be echoed into a
+    // terminal someone may be sharing or recording.
+    const secretAccessKey = await clack.password({
+        message: 'Secret access key',
+    });
+    if (clack.isCancel(secretAccessKey)) {
+        return { cancelled: true };
+    }
+    if (!secretAccessKey.trim()) {
+        clack.log.warn('No secret key given — falling back to local storage.');
+        return { cancelled: false, selection: (0, storage_provider_1.resolveStorageSelection)('local') };
+    }
+    return {
+        cancelled: false,
+        selection: (0, storage_provider_1.resolveStorageSelection)('s3', {
+            bucket,
+            region,
+            endpoint,
+            accessKeyId,
+            secretAccessKey,
+        }),
+    };
+}
+async function promptEncryption() {
+    const choice = await clack.select({
+        message: 'Encrypt messages and documents at rest?',
+        options: ['local', 'scaleway', 'kms', 'none'].map((value) => ({
+            value,
+            label: encryption_provider_1.ENCRYPTION_LABELS[value],
+        })),
+    });
+    if (clack.isCancel(choice)) {
+        return { cancelled: true };
+    }
+    const provider = choice;
+    if (provider === 'none' || provider === 'local') {
+        return {
+            cancelled: false,
+            selection: (0, encryption_provider_1.resolveEncryptionSelection)(provider),
+        };
+    }
+    const keyId = await clack.text({
+        message: provider === 'kms' ? 'KMS key id or ARN' : 'Key Manager key id',
+        validate: (value) => (value.trim() ? undefined : 'Required.'),
+    });
+    if (clack.isCancel(keyId)) {
+        return { cancelled: true };
+    }
+    if (provider === 'kms') {
+        return {
+            cancelled: false,
+            selection: (0, encryption_provider_1.resolveEncryptionSelection)('kms', { keyId, apiKey: '' }),
+        };
+    }
+    // Validated rather than given a fallback, unlike the S3 secret: someone who
+    // chose Scaleway has no second choice to fall back to, and a blank key would
+    // write `SCW_API_KEY=` — a provider named with a credential that reads as
+    // unset, which the boot check then refuses.
+    const apiKey = await clack.password({
+        message: 'Scaleway API secret key',
+        validate: (value) => (value.trim() ? undefined : 'Required for Scaleway.'),
+    });
+    if (clack.isCancel(apiKey)) {
+        return { cancelled: true };
+    }
+    return {
+        cancelled: false,
+        selection: (0, encryption_provider_1.resolveEncryptionSelection)('scaleway', { keyId, apiKey }),
+    };
+}
 /**
  * Three ways to arrive at a provider, in precedence order: named on the
  * command line with the key in the environment, declined wholesale by
@@ -270,21 +557,41 @@ async function resolveLlmProvider(args) {
  * a typo'd variable name in a CI job.
  */
 function providerFromEnvironment(choice) {
-    const { apiKeyEnvVar, label } = llm_provider_1.LLM_PROVIDERS[choice];
+    const config = llm_provider_1.LLM_PROVIDERS[choice];
+    const { apiKeyEnvVar, label } = config;
     const apiKey = process.env[apiKeyEnvVar]?.trim();
     if (!apiKey) {
         clack.cancel(`--provider=${choice} needs the ${label} key in ${apiKeyEnvVar}, and that variable is empty. Export it and run again, or drop the flag to be asked for it.`);
         return { cancelled: true };
     }
-    return { cancelled: false, choice: (0, llm_provider_1.resolveLlmProviderChoice)(choice, apiKey) };
+    // Same rule as the key: an explicit `--provider` that cannot be configured
+    // stops the install rather than scaffolding a half-wired one.
+    // `.trim()` for the same reason the prompt does it: an exported variable
+    // carries whatever the shell had, and whitespace is not a base URL.
+    const baseUrl = config.baseUrl
+        ? process.env[config.baseUrl.envVar]?.trim()
+        : undefined;
+    if (config.baseUrl && !baseUrl) {
+        clack.cancel(`--provider=${choice} also needs ${config.baseUrl.envVar} — its endpoint is per-project, so a key alone cannot reach it. Export it and run again.`);
+        return { cancelled: true };
+    }
+    return {
+        cancelled: false,
+        choice: (0, llm_provider_1.resolveLlmProviderChoice)(choice, apiKey, baseUrl),
+    };
 }
 async function promptLlmProvider() {
     const choice = await clack.select({
         message: 'Which LLM provider should power chat?',
+        // Ordered by how far one key gets a new install, not by vendor fame. The
+        // first two configure chat *and* embeddings, so the knowledge base works
+        // rather than only the chat box.
         options: [
+            { value: 'openrouter', label: llm_provider_1.LLM_PROVIDERS.openrouter.label },
+            { value: 'scaleway', label: llm_provider_1.LLM_PROVIDERS.scaleway.label },
             { value: 'openai', label: llm_provider_1.LLM_PROVIDERS.openai.label },
             { value: 'anthropic', label: llm_provider_1.LLM_PROVIDERS.anthropic.label },
-            { value: 'skip', label: "I'll configure LiteLLM myself" },
+            { value: 'skip', label: 'I will configure the routes myself' },
         ],
     });
     if (clack.isCancel(choice)) {
@@ -293,8 +600,9 @@ async function promptLlmProvider() {
     if (choice === 'skip') {
         return { cancelled: false, choice: undefined };
     }
+    const config = llm_provider_1.LLM_PROVIDERS[choice];
     const apiKey = await clack.password({
-        message: `Paste your ${llm_provider_1.LLM_PROVIDERS[choice].label} API key`,
+        message: `Paste your ${config.label} API key`,
     });
     if (clack.isCancel(apiKey)) {
         return { cancelled: true };
@@ -302,22 +610,29 @@ async function promptLlmProvider() {
     if (!apiKey) {
         return { cancelled: false, choice: undefined };
     }
+    // A provider whose endpoint is not a constant needs a second value, and
+    // needs it before the install is written — Scaleway's base URL carries the
+    // project id, so a key on its own scaffolds something that 404s later.
+    let baseUrl;
+    if (config.baseUrl) {
+        const answer = await clack.text({ message: config.baseUrl.prompt });
+        if (clack.isCancel(answer)) {
+            return { cancelled: true };
+        }
+        // Trimmed before it is judged, not after. A pasted URL routinely carries a
+        // trailing newline or space, and a string of only whitespace is truthy —
+        // so `!answer` alone would accept "   " and write it as `SCW_API_BASE`,
+        // which is the half-wired install this prompt exists to prevent.
+        baseUrl = answer.trim();
+        if (!baseUrl) {
+            return { cancelled: false, choice: undefined };
+        }
+    }
     return {
         cancelled: false,
-        choice: (0, llm_provider_1.resolveLlmProviderChoice)(choice, apiKey),
+        choice: (0, llm_provider_1.resolveLlmProviderChoice)(choice, apiKey, baseUrl),
     };
 }
-function patchLiteLLMConfig(targetDir, entries) {
-    const configPath = (0, node_path_1.join)(targetDir, 'infra/litellm/config.yaml');
-    // Reversed because each insert goes directly under `model_list:`, so the
-    // last one applied ends up on top. Reading the file afterwards should show
-    // the chat model first and the embedding model under it, in the order the
-    // wizard asked about them.
-    const patched = [...entries]
-        .reverse()
-        .reduce((config, entry) => (0, litellm_config_1.addLiteLLMModel)(config, entry), (0, node_fs_1.readFileSync)(configPath, 'utf8'));
-    (0, node_fs_1.writeFileSync)(configPath, patched);
-}
 /**
  * Leaves the manual instructions on disk as well as on screen. A terminal
  * that has just scrolled a `docker compose` build past them is exactly the
@@ -373,18 +688,20 @@ async function maybeStartDocker(targetDir, yes) {
             `  cd ${targetDir} \\`,
             '    && RAGEN_STACK_NAME=my-ragen \\',
             '       POSTGRES_PORT=55532 QDRANT_PORT=6343 QDRANT_GRPC_PORT=6344 \\',
-            '       TEMPORAL_PORT=7243 TEMPORAL_UI_PORT=8090 \\',
-            '       LITELLM_PORT=4010 LITELLM_DB_PORT=55533 \\',
             '       DOCLING_PORT=5011 REDIS_PORT=56479 \\',
             '       PRESIDIO_ANALYZER_PORT=5012 PRESIDIO_ANONYMIZER_PORT=5013 \\',
             '       docker compose up -d',
             '',
-            'Then update .env.local to match: DATABASE_URL, QDRANT_URL,',
-            'LITELLM_PROXY_URL, REDIS_URL, DOCLING_URL, TEMPORAL_SERVER_ADDRESS and',
-            'the two PRESIDIO_* URLs all name a host port.',
+            'Then update .env.local to match: DATABASE_URL, QDRANT_URL, REDIS_URL,',
+            'DOCLING_URL and the two PRESIDIO_* URLs all name a host port.',
+            '',
+            // Not a compose port: the worker serves it itself, so two workers on
+            // one machine collide on it without docker-compose having an opinion.
+            'WORKER_ADMIN_PORT too, if both installs run a worker — the queue',
+            'dashboard is served by the worker process, not by a container.',
         ].join('\n'));
     }
-    const proceed = await confirmOrSkip('Start the backing services now? (Postgres, Qdrant, Temporal, LiteLLM, Redis, …)', yes);
+    const proceed = await confirmOrSkip('Start the backing services now? (Postgres, Qdrant, Redis, …)', yes);
     if (!proceed) {
         return true;
     }
@@ -392,7 +709,7 @@ async function maybeStartDocker(targetDir, yes) {
         clack.log.warn('Docker does not seem to be available — skipping. Install Docker and run `docker compose up -d` yourself.');
         return true;
     }
-    return runStep(clack.spinner(), 'Starting docker compose (Postgres, Qdrant, Temporal, LiteLLM, Redis, …)', 'Backing services started.', () => (0, tasks_1.startDockerServices)({ cwd: targetDir }));
+    return runStep(clack.spinner(), 'Starting docker compose (Postgres, Qdrant, Redis, …)', 'Backing services started.', () => (0, tasks_1.startDockerServices)({ cwd: targetDir }));
 }
 async function maybeRunFirstTimeSetup(targetDir, yes, env) {
     const proceed = await confirmOrSkip('Install dependencies and run first-time setup (prisma generate, migrate, seed)?', yes);