@useatlas/create 0.0.5 → 0.0.7

package/templates/nextjs-standalone/bin/benchmark.ts

@@ -25,6 +25,8 @@ import {
   type ColumnProfile,
 } from "./atlas";
 import { connections, type DBConnection, type QueryResult } from "@atlas/api/lib/db/connection";
+import type { DuckDBConnection } from "@duckdb/node-api";
+import type { DuckDBInstance as DuckDBInstanceType } from "@duckdb/node-api";
 import { _resetWhitelists } from "@atlas/api/lib/semantic";
 import { invalidateExploreBackend } from "@atlas/api/lib/tools/explore";
 
@@ -39,7 +41,7 @@ interface BIRDQuestion {
   difficulty: string;
 }
 
-export interface QuestionResult {
+interface QuestionResult {
   question_id: number;
   db_id: string;
   question: string;
@@ -56,7 +58,7 @@ export interface QuestionResult {
 // --- Result set comparison (re-exported from shared module) ---
 
 import { escapeIdent, compareResultSets } from "../lib/compare";
-export { escapeIdent, normalizeValue, sortRows, valuesMatch, compareResultSets, explainMismatch } from "../lib/compare";
+export { escapeIdent, normalizeValue, sortRows, valuesMatch, compareResultSets } from "../lib/compare";
 
 // --- Gold SQL execution (bun:sqlite) ---
 
@@ -85,22 +87,20 @@ async function loadDuckDB() {
 }
 
 async function duckdbQuery<T = Record<string, unknown>>(
-  conn: unknown,
+  conn: DuckDBConnection,
   sql: string,
 ): Promise<T[]> {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const reader = await (conn as any).runAndReadAll(sql);
+  const reader = await conn.runAndReadAll(sql);
   return reader.getRowObjects() as T[];
 }
 
 /**
  * Build a DBConnection wrapper around a DuckDB connection.
  */
-function wrapDuckDBConnection(conn: unknown): DBConnection {
+function wrapDuckDBConnection(conn: DuckDBConnection): DBConnection {
   return {
     async query(sql: string): Promise<QueryResult> {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const reader = await (conn as any).runAndReadAll(sql);
+      const reader = await conn.runAndReadAll(sql);
       const columns: string[] = reader.columnNames();
       const rows: Record<string, unknown>[] = reader.getRowObjects();
       return { columns, rows };
@@ -118,7 +118,7 @@ function wrapDuckDBConnection(conn: unknown): DBConnection {
  * Uses information_schema queries — no external DB connection needed.
  */
 async function profileFromConnection(
-  conn: unknown,
+  conn: DuckDBConnection,
   tableNames: string[],
 ): Promise<TableProfile[]> {
   const profiles: TableProfile[] = [];
@@ -273,8 +273,8 @@ function clearSemanticDir(): void {
 // --- Per-database setup ---
 
 interface DatabaseSetupResult {
-  instance: unknown;
-  conn: unknown;
+  instance: DuckDBInstanceType;
+  conn: DuckDBConnection;
   dbConnection: DBConnection;
 }
 
@@ -357,16 +357,14 @@ async function setupDatabase(
   return { instance, conn, dbConnection };
 }
 
-function closeDuckDB(instance: unknown, conn: unknown): void {
+function closeDuckDB(instance: DuckDBInstanceType, conn: DuckDBConnection): void {
   try {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    (conn as any).disconnectSync();
+    conn.disconnectSync();
   } catch (err) {
     process.stderr.write(`WARNING: DuckDB disconnect failed: ${err instanceof Error ? err.message : String(err)}\n`);
   }
   try {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    (instance as any).closeSync();
+    instance.closeSync();
   } catch (err) {
     process.stderr.write(`WARNING: DuckDB close failed: ${err instanceof Error ? err.message : String(err)}\n`);
   }

package/templates/nextjs-standalone/bin/enrich.ts

@@ -44,10 +44,15 @@ function addUsage(accumulator: TokenUsage, usage: Partial<TokenUsage>): void {
  * ```yaml ... ``` code blocks.
  */
 function extractYamlBlock(text: string): string {
-  const match = text.match(/```yaml\s*\n([\s\S]*?)```/);
+  // Match ```yaml or ```yml fenced blocks
+  const match = text.match(/```ya?ml[ \t]*\r?\n([\s\S]*?)```/);
   if (match) return match[1].trim();
 
-  // Fallback: try to parse the whole response as YAML
+  // Fallback: try a generic fenced block (``` without language tag)
+  const generic = text.match(/```\s*\r?\n([\s\S]*?)```/);
+  if (generic) return generic[1].trim();
+
+  // Last resort: try to parse the whole response as YAML
   console.warn("    Note: LLM response did not contain a ```yaml block, attempting to parse raw response");
   return text.trim();
 }

package/templates/nextjs-standalone/brand.css

@@ -0,0 +1,13 @@
+/* Atlas brand tokens — single source of truth.
+ * Brand green: #23CE9E / oklch(0.759 0.148 167.71)
+ *
+ * Adapters per frontend:
+ *   packages/web/globals.css  → shadcn/ui theme tokens (primary, ring, sidebar-*)
+ *   apps/docs/globals.css     → Fumadocs theme tokens (fd-primary, fd-ring)
+ *   apps/www/globals.css      → Tailwind utilities (brand, brand-hover)
+ */
+:root {
+  --atlas-brand: oklch(0.759 0.148 167.71);
+  --atlas-brand-hover: oklch(0.82 0.148 167.71);
+  --atlas-brand-foreground: oklch(0.145 0 0);
+}

package/templates/nextjs-standalone/data/cybersec-semantic/catalog.yml

@@ -0,0 +1,222 @@
+version: "1.0"
+name: Sentinel Security — Cybersecurity SaaS
+description: |
+  Cybersecurity SaaS platform dataset for Sentinel Security. Tracks customer
+  organizations, their IT assets, vulnerability scanning, incident response,
+  compliance assessments, and subscription billing. Use this dataset to explore
+  security posture analysis, vulnerability trends, incident response metrics,
+  compliance readiness, and SaaS revenue health.
+
+entities:
+  - name: Organizations
+    file: entities/organizations.yml
+    grain: one row per customer organization
+    description: >
+      Customer organizations using the Sentinel Security platform. Contains
+      firmographic data — industry, company size tier, country, and domain.
+    use_for:
+      - Customer segmentation by industry, size, and geography
+      - Organization-level security posture comparison
+      - Active vs inactive customer analysis
+    common_questions:
+      - How many active organizations do we have?
+      - What industries make up our customer base?
+      - Which countries have the most customers?
+      - How are organizations distributed by size tier?
+
+  - name: Users
+    file: entities/users.yml
+    grain: one row per user account
+    description: >
+      Users within customer organizations. Contains role, email, login
+      activity, and active status. Linked to organizations via organization_id.
+    use_for:
+      - User adoption and engagement analysis
+      - Role distribution across organizations
+      - Login activity and stale account detection
+    common_questions:
+      - How many active users per organization?
+      - What is the role breakdown across all users?
+      - Which users have never logged in?
+      - How many users were created this month?
+
+  - name: Plans
+    file: entities/plans.yml
+    grain: one row per subscription plan
+    description: >
+      Available subscription plans with pricing, asset limits, user limits,
+      and feature sets. Reference table for subscription analysis.
+    use_for:
+      - Plan feature comparison
+      - Pricing tier analysis
+      - Capacity planning (asset and user limits)
+    common_questions:
+      - What plans are available and their pricing?
+      - What are the asset limits per plan?
+      - Which plans include which features?
+
+  - name: Subscriptions
+    file: entities/subscriptions.yml
+    grain: one row per subscription
+    description: >
+      Active and historical subscriptions linking organizations to plans.
+      Contains MRR, billing status, and period dates. Core table for
+      revenue and churn analysis.
+    use_for:
+      - MRR and revenue analysis by plan
+      - Churn and retention tracking
+      - Subscription lifecycle analysis
+      - Cross-entity revenue + security posture correlation
+    common_questions:
+      - What is total MRR by plan?
+      - How many subscriptions are active vs churned?
+      - What is our churn rate by plan?
+      - Which organizations have the highest MRR?
+
+  - name: Assets
+    file: entities/assets.yml
+    grain: one row per IT asset
+    description: >
+      IT assets (servers, workstations, network devices, containers, cloud
+      instances) monitored by the platform. Linked to organizations.
+    use_for:
+      - Asset inventory and coverage analysis
+      - Environment breakdown (production vs staging vs dev)
+      - OS distribution and version tracking
+      - Asset activity and staleness detection
+    common_questions:
+      - How many assets per organization?
+      - What is the asset type distribution?
+      - Which assets haven't been seen recently?
+      - What OS versions are deployed across environments?
+
+  - name: Vulnerabilities
+    file: entities/vulnerabilities.yml
+    grain: one row per known vulnerability (CVE)
+    description: >
+      Known vulnerabilities from CVE databases. Contains severity rating,
+      CVSS score, category, and publication date. Reference table for
+      vulnerability analysis.
+    use_for:
+      - Vulnerability severity distribution
+      - CVE category analysis
+      - Threat landscape trending over time
+      - CVSS score analysis and prioritization
+    common_questions:
+      - How many critical vulnerabilities exist?
+      - What is the severity breakdown of known CVEs?
+      - What vulnerability categories are most common?
+      - How many new CVEs were published this month?
+
+  - name: Scans
+    file: entities/scans.yml
+    grain: one row per scan execution
+    description: >
+      Vulnerability scan executions. Tracks scan type, status, timing,
+      and results summary. Linked to organizations.
+    use_for:
+      - Scan coverage and frequency analysis
+      - Scan performance (duration, assets scanned)
+      - Findings trend analysis over scan history
+      - Scan failure rate monitoring
+    common_questions:
+      - How many scans ran this week?
+      - What is the average scan duration?
+      - Which organizations scan most frequently?
+      - What is the scan failure rate?
+
+  - name: Scan Results
+    file: entities/scan_results.yml
+    grain: one row per vulnerability finding in a scan
+    description: >
+      Individual findings from scans — a specific vulnerability found on a
+      specific asset during a specific scan. Contains risk level, status,
+      and resolution dates.
+    use_for:
+      - Finding status tracking (open vs resolved)
+      - Risk level distribution analysis
+      - Mean time to remediation (MTTR) calculation
+      - Asset-level vulnerability density
+    common_questions:
+      - How many open findings exist?
+      - What is the average time to resolve a finding?
+      - Which assets have the most findings?
+      - What is the risk level distribution?
+
+  - name: Incidents
+    file: entities/incidents.yml
+    grain: one row per security incident
+    description: >
+      Security incidents reported across organizations. Tracks severity,
+      status, assignment, and resolution timing. Core table for incident
+      response metrics.
+    use_for:
+      - Incident volume and severity trending
+      - Mean time to resolve (MTTR) analysis
+      - Assignment and workload analysis
+      - Organization-level incident comparison
+    common_questions:
+      - How many open incidents exist by severity?
+      - What is the average incident resolution time?
+      - Which organizations have the most incidents?
+      - What is the incident trend over time?
+
+  - name: Alerts
+    file: entities/alerts.yml
+    grain: one row per alert
+    description: >
+      Security alerts generated by rules and detection systems. Can be
+      linked to incidents. Tracks severity, source, acknowledgment status.
+    use_for:
+      - Alert volume and noise analysis
+      - Alert-to-incident conversion rate
+      - Alert acknowledgment time tracking
+      - Source and rule effectiveness analysis
+    common_questions:
+      - How many unacknowledged alerts exist?
+      - What is the alert-to-incident ratio?
+      - What alert sources generate the most volume?
+      - What is the average time to acknowledge an alert?
+
+  - name: Compliance Assessments
+    file: entities/compliance_assessments.yml
+    grain: one row per compliance assessment
+    description: >
+      Compliance assessments against regulatory frameworks. Tracks
+      assessment status, scoring, and timing per organization.
+    use_for:
+      - Compliance score tracking by framework
+      - Assessment completion rate analysis
+      - Organization compliance readiness comparison
+      - Score trending over time
+    common_questions:
+      - What is the average compliance score by framework?
+      - How many assessments are in progress?
+      - Which organizations have the lowest scores?
+      - How has compliance improved over time?
+
+  - name: Remediation Actions
+    file: entities/remediation_actions.yml
+    grain: one row per remediation action
+    description: >
+      Remediation tasks assigned to address vulnerability instances.
+      Tracks priority, assignment, due dates, and completion status.
+    use_for:
+      - Remediation backlog and burndown analysis
+      - SLA compliance (overdue actions)
+      - Assignment workload distribution
+      - Priority-based completion rate tracking
+    common_questions:
+      - How many remediation actions are overdue?
+      - What is the average time to complete a remediation?
+      - Who has the most open remediations assigned?
+      - What is the completion rate by priority?
+
+glossary: glossary.yml
+metrics:
+  - file: metrics/security.yml
+    description: Security metrics — vulnerability counts, MTTR, open/closed rates, incident trends
+  - file: metrics/business.yml
+    description: Business metrics — MRR, churn, customer count, subscription health
+  - file: metrics/compliance.yml
+    description: Compliance metrics — assessment scores, framework coverage, finding rates

package/templates/nextjs-standalone/data/cybersec-semantic/entities/alerts.yml

@@ -0,0 +1,195 @@
+name: Alerts
+type: fact_table
+table: alerts
+grain: one row per alert
+description: |
+  Security alerts generated by detection rules and monitoring systems.
+  Each alert has a severity (can be NULL), title, status, source, and
+  timestamps. Alerts can optionally be linked to incidents via incident_id
+  (no formal FK constraint). Tracks acknowledgment timing for response
+  metrics. Use for alert volume analysis, noise reduction, and
+  alert-to-incident correlation.
+
+dimensions:
+  - name: id
+    sql: id
+    type: number
+    description: Primary key — unique alert identifier
+    primary_key: true
+
+  - name: organization_id
+    sql: organization_id
+    type: number
+    description: Foreign key to organizations — which customer generated this alert
+
+  - name: alert_rule_id
+    sql: alert_rule_id
+    type: number
+    description: Foreign key to alert_rules — which detection rule triggered this alert
+
+  - name: severity
+    sql: severity
+    type: string
+    description: |
+      Alert severity level. Can be NULL for some alerts where severity was
+      not determined. Filter NULLs when aggregating by severity.
+    sample_values: [critical, high, medium, low]
+
+  - name: title
+    sql: title
+    type: string
+    description: Short description / title of the alert
+
+  - name: status
+    sql: status
+    type: string
+    description: Current alert status
+    sample_values: [new, acknowledged, investigating, resolved, dismissed]
+
+  - name: incident_id
+    sql: incident_id
+    type: number
+    description: |
+      Reference to the incident this alert was escalated to. No formal FK
+      constraint. NULL if the alert was not linked to an incident.
+
+  - name: source
+    sql: source
+    type: string
+    description: Detection source / system that generated the alert
+    sample_values: [ids, siem, endpoint, network, cloud, manual]
+
+  - name: created_at
+    sql: created_at
+    type: timestamp
+    description: When the alert was generated
+
+  - name: acknowledged_at
+    sql: acknowledged_at
+    type: timestamp
+    description: When the alert was first acknowledged by an analyst (NULL if not acknowledged)
+
+  - name: has_severity
+    sql: CASE WHEN severity IS NOT NULL THEN true ELSE false END
+    type: boolean
+    description: Whether the alert has a severity assigned
+    virtual: true
+
+  - name: is_escalated
+    sql: CASE WHEN incident_id IS NOT NULL THEN true ELSE false END
+    type: boolean
+    description: Whether the alert has been linked to an incident
+    virtual: true
+
+  - name: is_acknowledged
+    sql: CASE WHEN acknowledged_at IS NOT NULL THEN true ELSE false END
+    type: boolean
+    description: Whether the alert has been acknowledged
+    virtual: true
+
+  - name: ack_time_minutes
+    sql: |-
+      CASE
+        WHEN acknowledged_at IS NOT NULL
+        THEN EXTRACT(EPOCH FROM (acknowledged_at - created_at)) / 60.0
+      END
+    type: number
+    description: Minutes between alert creation and acknowledgment (NULL if not acknowledged)
+    virtual: true
+
+  - name: created_date
+    sql: created_at::DATE
+    type: date
+    description: Date the alert was created (for daily grouping)
+    virtual: true
+
+  - name: created_month
+    sql: TO_CHAR(created_at, 'YYYY-MM')
+    type: string
+    description: Year-month the alert was created
+    virtual: true
+
+  - name: severity_or_unknown
+    sql: COALESCE(severity, 'unknown')
+    type: string
+    description: Severity with NULL replaced by 'unknown' — use for grouping
+    virtual: true
+    sample_values: [critical, high, medium, low, unknown]
+
+measures:
+  - name: alert_count
+    sql: id
+    type: count_distinct
+    description: Number of unique alerts
+
+  - name: unacknowledged_count
+    sql: CASE WHEN acknowledged_at IS NULL THEN id END
+    type: count_distinct
+    description: Number of alerts not yet acknowledged
+
+  - name: escalated_count
+    sql: CASE WHEN incident_id IS NOT NULL THEN id END
+    type: count_distinct
+    description: Number of alerts escalated to incidents
+
+  - name: avg_ack_time_minutes
+    sql: CASE WHEN acknowledged_at IS NOT NULL THEN EXTRACT(EPOCH FROM (acknowledged_at - created_at)) / 60.0 END
+    type: avg
+    description: Average minutes to acknowledge an alert
+
+joins:
+  - target_entity: Organizations
+    relationship: many_to_one
+    join_columns:
+      from: organization_id
+      to: id
+    description: Each alert belongs to one organization
+
+  - target_entity: Incidents
+    relationship: many_to_one
+    join_columns:
+      from: incident_id
+      to: id
+    description: An alert may be linked to one incident (no formal FK)
+
+use_cases:
+  - Alert volume and noise analysis by source and severity
+  - Alert-to-incident conversion rate (escalation rate)
+  - Acknowledgment time tracking and SLA compliance
+  - Source effectiveness — which detection systems generate actionable alerts
+  - Alert trending over time for capacity planning
+
+query_patterns:
+  - name: alerts_by_severity
+    description: Alert count by severity (including unknowns)
+    sql: |-
+      SELECT COALESCE(severity, 'unknown') AS severity,
+             COUNT(*) AS alert_count,
+             COUNT(*) FILTER (WHERE acknowledged_at IS NULL) AS unacknowledged,
+             COUNT(*) FILTER (WHERE incident_id IS NOT NULL) AS escalated
+      FROM alerts
+      GROUP BY COALESCE(severity, 'unknown')
+      ORDER BY alert_count DESC
+
+  - name: alerts_by_source
+    description: Alert volume and escalation rate by source
+    sql: |-
+      SELECT source,
+             COUNT(*) AS alert_count,
+             COUNT(*) FILTER (WHERE incident_id IS NOT NULL) AS escalated,
+             ROUND(100.0 * COUNT(*) FILTER (WHERE incident_id IS NOT NULL) / COUNT(*), 1) AS escalation_pct,
+             AVG(EXTRACT(EPOCH FROM (acknowledged_at - created_at)) / 60.0)
+               FILTER (WHERE acknowledged_at IS NOT NULL) AS avg_ack_minutes
+      FROM alerts
+      GROUP BY source
+      ORDER BY alert_count DESC
+
+  - name: alert_trend
+    description: Daily alert volume
+    sql: |-
+      SELECT created_at::DATE AS alert_date,
+             COUNT(*) AS alert_count,
+             COUNT(*) FILTER (WHERE COALESCE(severity, '') IN ('critical', 'high')) AS high_sev_count
+      FROM alerts
+      GROUP BY alert_date
+      ORDER BY alert_date