@useatlas/create 0.0.1

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@useatlas/create",
+  "version": "0.0.1",
+  "description": "Create a new Atlas text-to-SQL agent project",
+  "bin": {
+    "create-useatlas": "./index.ts"
+  },
+  "scripts": {
+    "prepublishOnly": "bash scripts/prepare-templates.sh"
+  },
+  "keywords": [
+    "atlas",
+    "text-to-sql",
+    "data-analyst",
+    "agent",
+    "semantic-layer",
+    "bun",
+    "hono"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AtlasDevHQ/atlas",
+    "directory": "create-atlas"
+  },
+  "homepage": "https://useatlas.dev",
+  "bugs": {
+    "url": "https://github.com/AtlasDevHQ/atlas/issues"
+  },
+  "engines": {
+    "bun": ">=1.3.10"
+  },
+  "dependencies": {
+    "@clack/prompts": "^0.10.0",
+    "picocolors": "^1.1.0"
+  },
+  "files": ["index.ts", "templates/", "README.md"],
+  "license": "MIT"
+}

package/templates/docker/.env.example

@@ -0,0 +1,67 @@
+# === Atlas Internal Database ===
+# Atlas's own Postgres for auth, audit logs, and settings.
+# Auto-provisioned by most platforms. For local dev, docker compose provides it.
+# DATABASE_URL=postgresql://atlas:atlas@localhost:5432/atlas
+
+# === Analytics Datasource (your data) ===
+# The database Atlas queries on your behalf. Optional — Atlas starts without it.
+# ATLAS_DATASOURCE_URL=postgresql://atlas:atlas@localhost:5432/atlas_demo
+# ATLAS_DATASOURCE_URL=mysql://user:pass@localhost:3306/mydb
+
+# === LLM Provider (pick one) ===
+# ATLAS_PROVIDER=anthropic
+# ANTHROPIC_API_KEY=sk-ant-...
+
+# ATLAS_PROVIDER=openai
+# OPENAI_API_KEY=sk-...
+
+# ATLAS_PROVIDER=bedrock
+# AWS_REGION=us-east-1
+# AWS_ACCESS_KEY_ID=...
+# AWS_SECRET_ACCESS_KEY=...
+
+# ATLAS_PROVIDER=ollama
+# OLLAMA_BASE_URL=http://localhost:11434
+
+# ATLAS_PROVIDER=gateway
+# AI_GATEWAY_API_KEY=...
+
+# === Model (optional, provider-specific default used if omitted) ===
+# ATLAS_MODEL=claude-opus-4-6
+
+# === Authentication (optional — Atlas is public by default) ===
+# ATLAS_API_KEY=your-secret-key            # Simple API key mode — requires Authorization: Bearer <key>
+# BETTER_AUTH_SECRET=                      # Managed auth (Better Auth) — min 32 chars. Generate: openssl rand -base64 32
+# BETTER_AUTH_URL=                         # Base URL for Better Auth (auto-detected from request if omitted)
+# BETTER_AUTH_TRUSTED_ORIGINS=             # Comma-separated origins for CSRF (e.g. https://app.example.com)
+# ATLAS_AUTH_JWKS_URL=                     # BYOT mode — JWKS endpoint URL
+# ATLAS_AUTH_ISSUER=                       # BYOT mode — expected JWT issuer
+# ATLAS_AUTH_AUDIENCE=                     # BYOT mode — expected JWT audience (optional)
+# ATLAS_RATE_LIMIT_RPM=30                 # Max requests per minute per user (0 = disabled)
+
+# === Security ===
+# Non-SELECT SQL (INSERT, UPDATE, DELETE, DROP, etc.) is always rejected — no toggle.
+# ATLAS_TABLE_WHITELIST=true   # Default: true — only allow tables in semantic layer
+# ATLAS_ROW_LIMIT=1000         # Default: 1000
+# ATLAS_QUERY_TIMEOUT=30000    # Default: 30s in milliseconds
+
+# === Production Deployment ===
+# Required for production (Railway, Render, etc.):
+#   ATLAS_PROVIDER + its API key (e.g. ANTHROPIC_API_KEY)
+#   ATLAS_DATASOURCE_URL=postgresql://user:pass@host:5432/dbname
+#
+# Optional (defaults are fine for most deployments):
+#   ATLAS_MODEL, ATLAS_ROW_LIMIT, ATLAS_QUERY_TIMEOUT
+#   PORT (set automatically by most platforms)
+
+# === Explore Sandbox (Railway / Render) ===
+# The sidecar provides isolated shell execution for the explore tool on platforms
+# where nsjail can't run (Railway, Render). Deploy it as a second service.
+# ATLAS_SANDBOX_URL=http://sidecar.railway.internal:8080   # Railway private networking
+# SIDECAR_AUTH_TOKEN=                                       # Shared secret — set on both services
+
+# === Runtime ===
+# ATLAS_RUNTIME=vercel    # Force Vercel Sandbox for explore tool (auto-detected on Vercel)
+
+# === Explore Tool Isolation ===
+# ATLAS_SANDBOX=nsjail    # Process isolation for explore tool (auto-detected when nsjail is on PATH)

package/templates/docker/Dockerfile

@@ -0,0 +1,52 @@
+FROM oven/bun:1.3.10 AS base
+
+FROM base AS deps
+WORKDIR /app
+COPY package.json bun.lock* ./
+RUN bun ci --ignore-scripts
+
+FROM base AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN mkdir -p semantic && bun run build
+
+# --- nsjail build stage (parallel with builder) ---
+ARG INSTALL_NSJAIL=true
+FROM debian:trixie-slim AS nsjail-builder
+ARG INSTALL_NSJAIL=true
+RUN mkdir -p /nsjail-out && \
+    if [ "$INSTALL_NSJAIL" = "true" ]; then \
+      apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates autoconf bison flex gcc g++ git make pkg-config \
+        protobuf-compiler libprotobuf-dev libnl-route-3-dev libtool \
+      && rm -rf /var/lib/apt/lists/* \
+      && git clone --depth 1 --branch 3.4 https://github.com/google/nsjail.git /nsjail-src \
+      && cd /nsjail-src && make -j$(nproc) \
+      && cp /nsjail-src/nsjail /nsjail-out/nsjail; \
+    fi
+
+FROM base AS runner
+ARG INSTALL_NSJAIL=true
+WORKDIR /app
+ENV NODE_ENV=production
+RUN echo "nodejs:x:1001:" >> /etc/group && \
+    echo "nextjs:x:1001:1001:nextjs:/app:/bin/sh" >> /etc/passwd
+# Install nsjail runtime dependencies (when nsjail is enabled)
+RUN if [ "$INSTALL_NSJAIL" = "true" ]; then \
+      apt-get update && apt-get install -y --no-install-recommends \
+        libnl-route-3-200 libprotobuf32t64 \
+      && rm -rf /var/lib/apt/lists/*; \
+    fi
+COPY --from=nsjail-builder /nsjail-out/ /usr/local/bin/
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/semantic ./semantic
+USER nextjs
+EXPOSE 3000
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD bun -e "try { const r = await fetch('http://localhost:3000/api/health'); if(!r.ok){console.error(r.status); process.exit(1)} } catch(e) { console.error(e.message); process.exit(1) }"
+CMD ["bun", "server.js"]