@useatlas/create 0.0.5 → 0.0.7

package/templates/docker/ee/src/sla/alerting.ts

@@ -0,0 +1,382 @@
+/**
+ * SLA alerting — threshold evaluation and alert state management.
+ *
+ * Evaluates workspace metrics against configurable thresholds, creates
+ * and resolves alerts, and delivers notifications via webhook.
+ *
+ * Access-gated via platformAdminAuth middleware (platform_admin role required).
+ */
+
+import { hasInternalDB, internalQuery } from "@atlas/api/lib/db/internal";
+import { createLogger } from "@atlas/api/lib/logger";
+import type { SLAAlert, SLAAlertStatus, SLAAlertType, SLAThresholds } from "@useatlas/types";
+
+const log = createLogger("ee:sla-alerting");
+
+// ---------------------------------------------------------------------------
+// Thresholds
+// ---------------------------------------------------------------------------
+
+/**
+ * Get the effective thresholds for a workspace. Falls back to the
+ * `_default` row if no workspace-specific overrides exist, then to
+ * env vars (`ATLAS_SLA_LATENCY_P99_MS`, `ATLAS_SLA_ERROR_RATE_PCT`)
+ * with hardcoded defaults.
+ */
+export async function getThresholds(workspaceId?: string): Promise<SLAThresholds> {
+
+
+  if (!hasInternalDB()) {
+    throw new Error("Internal database not configured — SLA thresholds require DATABASE_URL");
+  }
+
+  if (workspaceId) {
+    const rows = await internalQuery<{
+      latency_p99_ms: number;
+      error_rate_pct: number;
+    }>(
+      `SELECT latency_p99_ms, error_rate_pct
+       FROM sla_thresholds WHERE workspace_id = $1`,
+      [workspaceId],
+    );
+    if (rows.length > 0) {
+      return {
+        latencyP99Ms: rows[0].latency_p99_ms,
+        errorRatePct: rows[0].error_rate_pct,
+      };
+    }
+  }
+
+  const defaults = await internalQuery<{
+    latency_p99_ms: number;
+    error_rate_pct: number;
+  }>(`SELECT latency_p99_ms, error_rate_pct FROM sla_thresholds WHERE workspace_id = '_default'`);
+
+  if (defaults.length > 0) {
+    return {
+      latencyP99Ms: defaults[0].latency_p99_ms,
+      errorRatePct: defaults[0].error_rate_pct,
+    };
+  }
+
+  return defaultThresholds();
+}
+
+function defaultThresholds(): SLAThresholds {
+  const latency = parseFloat(process.env.ATLAS_SLA_LATENCY_P99_MS ?? "");
+  const errorRate = parseFloat(process.env.ATLAS_SLA_ERROR_RATE_PCT ?? "");
+  return {
+    latencyP99Ms: isNaN(latency) ? 5000 : latency,
+    errorRatePct: isNaN(errorRate) ? 5 : errorRate,
+  };
+}
+
+/**
+ * Update the default SLA thresholds.
+ */
+export async function updateThresholds(thresholds: SLAThresholds): Promise<void> {
+
+
+  if (!hasInternalDB()) {
+    throw new Error("Internal database not configured");
+  }
+
+  await internalQuery(
+    `INSERT INTO sla_thresholds (workspace_id, latency_p99_ms, error_rate_pct, updated_at)
+     VALUES ('_default', $1, $2, now())
+     ON CONFLICT (workspace_id) DO UPDATE SET
+       latency_p99_ms = $1,
+       error_rate_pct = $2,
+       updated_at = now()`,
+    [thresholds.latencyP99Ms, thresholds.errorRatePct],
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Alert queries
+// ---------------------------------------------------------------------------
+
+/**
+ * Get all alerts, optionally filtered by status.
+ */
+export async function getAlerts(
+  status?: SLAAlertStatus,
+  limit = 100,
+): Promise<SLAAlert[]> {
+
+
+  if (!hasInternalDB()) {
+    throw new Error("Internal database not configured — SLA alerts require DATABASE_URL");
+  }
+
+  const rows = await internalQuery<{
+    id: string;
+    workspace_id: string;
+    workspace_name: string;
+    alert_type: SLAAlertType;
+    status: SLAAlertStatus;
+    current_value: number;
+    threshold: number;
+    message: string;
+    fired_at: string;
+    resolved_at: string | null;
+    acknowledged_at: string | null;
+    acknowledged_by: string | null;
+  }>(
+    status
+      ? `SELECT a.id, a.workspace_id, COALESCE(o.name, a.workspace_id) AS workspace_name,
+              a.alert_type, a.status, a.current_value, a.threshold, a.message,
+              a.fired_at::text, a.resolved_at::text, a.acknowledged_at::text, a.acknowledged_by
+         FROM sla_alerts a
+         LEFT JOIN organization o ON o.id = a.workspace_id
+         WHERE a.status = $1
+         ORDER BY a.fired_at DESC LIMIT $2`
+      : `SELECT a.id, a.workspace_id, COALESCE(o.name, a.workspace_id) AS workspace_name,
+              a.alert_type, a.status, a.current_value, a.threshold, a.message,
+              a.fired_at::text, a.resolved_at::text, a.acknowledged_at::text, a.acknowledged_by
+         FROM sla_alerts a
+         LEFT JOIN organization o ON o.id = a.workspace_id
+         ORDER BY a.fired_at DESC LIMIT $1`,
+    status ? [status, limit] : [limit],
+  );
+
+  return rows.map(toAlert);
+}
+
+/**
+ * Acknowledge an alert.
+ */
+export async function acknowledgeAlert(alertId: string, actorId: string): Promise<boolean> {
+
+
+  if (!hasInternalDB()) {
+    throw new Error("Internal database not configured — cannot acknowledge SLA alerts");
+  }
+
+  const rows = await internalQuery<{ id: string }>(
+    `UPDATE sla_alerts
+     SET status = 'acknowledged', acknowledged_at = now(), acknowledged_by = $2
+     WHERE id = $1 AND status = 'firing'
+     RETURNING id`,
+    [alertId, actorId],
+  );
+
+  return rows.length > 0;
+}
+
+// ---------------------------------------------------------------------------
+// Alert evaluation — called periodically or on-demand
+// ---------------------------------------------------------------------------
+
+/**
+ * Evaluate all workspaces against thresholds and create/resolve alerts.
+ * Returns newly fired alerts. Notifications are dispatched internally
+ * via webhook (if configured).
+ */
+export async function evaluateAlerts(): Promise<SLAAlert[]> {
+
+
+  if (!hasInternalDB()) {
+    throw new Error("Internal database not configured — SLA evaluation requires DATABASE_URL");
+  }
+
+  const thresholds = await getThresholds();
+  const newAlerts: SLAAlert[] = [];
+
+  // Get recent metrics per workspace (last hour)
+  const wsMetrics = await internalQuery<{
+    workspace_id: string;
+    workspace_name: string;
+    latency_p99: number | null;
+    error_rate: number;
+    total_queries: string;
+  }>(
+    `SELECT
+       m.workspace_id,
+       COALESCE(o.name, m.workspace_id) AS workspace_name,
+       PERCENTILE_CONT(0.99) WITHIN GROUP (ORDER BY m.latency_ms) AS latency_p99,
+       CASE WHEN COUNT(*) > 0
+            THEN (COUNT(*) FILTER (WHERE m.is_error)::float / COUNT(*)::float) * 100
+            ELSE 0
+       END AS error_rate,
+       COUNT(*)::text AS total_queries
+     FROM sla_metrics m
+     LEFT JOIN organization o ON o.id = m.workspace_id
+     WHERE m.recorded_at > now() - interval '1 hour'
+     GROUP BY m.workspace_id, o.name`,
+  );
+
+  for (const ws of wsMetrics) {
+    try {
+      const totalQueries = parseInt(ws.total_queries, 10);
+      if (totalQueries === 0) continue;
+
+      // Check latency P99
+      if (ws.latency_p99 !== null && ws.latency_p99 > thresholds.latencyP99Ms) {
+        const alert = await createAlertIfNotFiring(
+          ws.workspace_id,
+          ws.workspace_name,
+          "latency_p99",
+          ws.latency_p99,
+          thresholds.latencyP99Ms,
+          `Workspace "${ws.workspace_name}" p99 latency ${Math.round(ws.latency_p99)}ms exceeds threshold ${thresholds.latencyP99Ms}ms`,
+        );
+        if (alert) newAlerts.push(alert);
+      } else {
+        await resolveAlertsForType(ws.workspace_id, "latency_p99");
+      }
+
+      // Check error rate
+      if (ws.error_rate > thresholds.errorRatePct) {
+        const alert = await createAlertIfNotFiring(
+          ws.workspace_id,
+          ws.workspace_name,
+          "error_rate",
+          ws.error_rate,
+          thresholds.errorRatePct,
+          `Workspace "${ws.workspace_name}" error rate ${ws.error_rate.toFixed(1)}% exceeds threshold ${thresholds.errorRatePct}%`,
+        );
+        if (alert) newAlerts.push(alert);
+      } else {
+        await resolveAlertsForType(ws.workspace_id, "error_rate");
+      }
+    } catch (err) {
+      log.error(
+        { err: err instanceof Error ? err.message : String(err), workspaceId: ws.workspace_id },
+        "Failed to evaluate SLA for workspace — skipping",
+      );
+    }
+  }
+
+  if (newAlerts.length > 0) {
+    log.info({ count: newAlerts.length }, "New SLA alerts fired");
+    // Attempt webhook delivery (non-critical)
+    for (const alert of newAlerts) {
+      try {
+        await deliverAlert(alert);
+      } catch (err) {
+        log.error(
+          { err: err instanceof Error ? err.message : String(err), alertId: alert.id },
+          "Failed to deliver SLA alert notification — alert was created but notification was not sent",
+        );
+      }
+    }
+  }
+
+  return newAlerts;
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+async function createAlertIfNotFiring(
+  workspaceId: string,
+  workspaceName: string,
+  alertType: SLAAlertType,
+  currentValue: number,
+  threshold: number,
+  message: string,
+): Promise<SLAAlert | null> {
+  // Check if there's already a firing alert for this workspace + type
+  const existing = await internalQuery<{ id: string }>(
+    `SELECT id FROM sla_alerts
+     WHERE workspace_id = $1 AND alert_type = $2 AND status = 'firing'
+     LIMIT 1`,
+    [workspaceId, alertType],
+  );
+
+  if (existing.length > 0) return null;
+
+  const rows = await internalQuery<{
+    id: string;
+    fired_at: string;
+  }>(
+    `INSERT INTO sla_alerts (workspace_id, alert_type, status, current_value, threshold, message)
+     VALUES ($1, $2, 'firing', $3, $4, $5)
+     RETURNING id, fired_at::text`,
+    [workspaceId, alertType, currentValue, threshold, message],
+  );
+
+  if (rows.length === 0) return null;
+
+  return {
+    id: rows[0].id,
+    workspaceId,
+    workspaceName,
+    type: alertType,
+    status: "firing",
+    currentValue,
+    threshold,
+    message,
+    firedAt: rows[0].fired_at,
+    resolvedAt: null,
+    acknowledgedAt: null,
+    acknowledgedBy: null,
+  };
+}
+
+async function resolveAlertsForType(workspaceId: string, alertType: SLAAlertType): Promise<void> {
+  await internalQuery(
+    `UPDATE sla_alerts SET status = 'resolved', resolved_at = now()
+     WHERE workspace_id = $1 AND alert_type = $2 AND status = 'firing'`,
+    [workspaceId, alertType],
+  );
+}
+
+function toAlert(row: {
+  id: string;
+  workspace_id: string;
+  workspace_name: string;
+  alert_type: SLAAlertType;
+  status: SLAAlertStatus;
+  current_value: number;
+  threshold: number;
+  message: string;
+  fired_at: string;
+  resolved_at: string | null;
+  acknowledged_at: string | null;
+  acknowledged_by: string | null;
+}): SLAAlert {
+  return {
+    id: row.id,
+    workspaceId: row.workspace_id,
+    workspaceName: row.workspace_name,
+    type: row.alert_type,
+    status: row.status,
+    currentValue: row.current_value,
+    threshold: row.threshold,
+    message: row.message,
+    firedAt: row.fired_at,
+    resolvedAt: row.resolved_at,
+    acknowledgedAt: row.acknowledged_at,
+    acknowledgedBy: row.acknowledged_by,
+  };
+}
+
+/**
+ * Deliver alert notification via webhook or email (best-effort).
+ * Sends an HTTP POST with a JSON payload to the configured webhook URL.
+ */
+async function deliverAlert(alert: SLAAlert): Promise<void> {
+  const webhookUrl = process.env.ATLAS_SLA_WEBHOOK_URL;
+  if (!webhookUrl) return;
+
+  const response = await fetch(webhookUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      type: "sla.alert.fired",
+      alert,
+      timestamp: new Date().toISOString(),
+    }),
+  });
+
+  if (!response.ok) {
+    const body = await response.text().catch(() => "(unreadable body)");
+    log.error(
+      { status: response.status, alertId: alert.id, responseBody: body.slice(0, 500) },
+      "SLA alert webhook delivery failed — alert notification was not delivered",
+    );
+  }
+}

package/templates/docker/ee/src/sla/index.ts

@@ -0,0 +1,12 @@
+/**
+ * SLA monitoring and alerting — enterprise feature.
+ *
+ * Exports:
+ * - recordQueryMetric() — fire-and-forget, called from executeAndAudit() in sql.ts
+ * - getAllWorkspaceSLA() / getWorkspaceSLADetail() — read endpoints
+ * - getAlerts() / acknowledgeAlert() / evaluateAlerts() — alerting
+ * - getThresholds() / updateThresholds() — configuration
+ */
+
+export { recordQueryMetric, getAllWorkspaceSLA, getWorkspaceSLADetail } from "./metrics";
+export { getThresholds, updateThresholds, getAlerts, acknowledgeAlert, evaluateAlerts } from "./alerting";

package/templates/docker/ee/src/sla/metrics.ts

@@ -0,0 +1,275 @@
+/**
+ * SLA metrics collection and querying.
+ *
+ * Records per-workspace query latency and error counts, then aggregates
+ * them into SLA summary views (p50/p95/p99 latency, error rate, uptime).
+ * Uptime is derived as the inverse of the error rate (successful queries /
+ * total queries), not measured via health checks.
+ *
+ * Storage: internal DB `sla_metrics` table. Data is recorded on each query
+ * execution and queried by the platform admin API.
+ *
+ * Access-gated via platformAdminAuth middleware (platform_admin role required).
+ */
+
+import { hasInternalDB, internalQuery } from "@atlas/api/lib/db/internal";
+import { createLogger } from "@atlas/api/lib/logger";
+import type { WorkspaceSLASummary, WorkspaceSLADetail, SLAMetricPoint } from "@useatlas/types";
+
+const log = createLogger("ee:sla-metrics");
+
+// ---------------------------------------------------------------------------
+// Table bootstrap — idempotent, runs on first use
+// ---------------------------------------------------------------------------
+
+let _tableReady = false;
+
+async function ensureTable(): Promise<void> {
+  if (_tableReady) return;
+  if (!hasInternalDB()) {
+    throw new Error("Internal database not configured — SLA metrics require DATABASE_URL");
+  }
+
+  await internalQuery(
+    `CREATE TABLE IF NOT EXISTS sla_metrics (
+       id            TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+       workspace_id  TEXT NOT NULL,
+       latency_ms    DOUBLE PRECISION NOT NULL,
+       is_error      BOOLEAN NOT NULL DEFAULT false,
+       recorded_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+     )`,
+  );
+  // Index for workspace + time range queries
+  await internalQuery(
+    `CREATE INDEX IF NOT EXISTS idx_sla_metrics_ws_time ON sla_metrics (workspace_id, recorded_at DESC)`,
+  );
+
+  // Alerts table
+  await internalQuery(
+    `CREATE TABLE IF NOT EXISTS sla_alerts (
+       id               TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+       workspace_id     TEXT NOT NULL,
+       alert_type       TEXT NOT NULL,
+       status           TEXT NOT NULL DEFAULT 'firing',
+       current_value    DOUBLE PRECISION NOT NULL,
+       threshold        DOUBLE PRECISION NOT NULL,
+       message          TEXT NOT NULL,
+       fired_at         TIMESTAMPTZ NOT NULL DEFAULT now(),
+       resolved_at      TIMESTAMPTZ,
+       acknowledged_at  TIMESTAMPTZ,
+       acknowledged_by  TEXT
+     )`,
+  );
+  await internalQuery(
+    `CREATE INDEX IF NOT EXISTS idx_sla_alerts_ws ON sla_alerts (workspace_id, status)`,
+  );
+
+  // Thresholds table — one row per workspace (or a default row with workspace_id = '_default')
+  await internalQuery(
+    `CREATE TABLE IF NOT EXISTS sla_thresholds (
+       workspace_id       TEXT PRIMARY KEY,
+       latency_p99_ms     DOUBLE PRECISION NOT NULL DEFAULT 5000,
+       error_rate_pct     DOUBLE PRECISION NOT NULL DEFAULT 5,
+       updated_at         TIMESTAMPTZ NOT NULL DEFAULT now()
+     )`,
+  );
+
+  // Insert default thresholds row if missing
+  const rawLatency = parseFloat(process.env.ATLAS_SLA_LATENCY_P99_MS ?? "");
+  const rawErrorRate = parseFloat(process.env.ATLAS_SLA_ERROR_RATE_PCT ?? "");
+  const defaultLatency = isNaN(rawLatency) ? 5000 : rawLatency;
+  const defaultErrorRate = isNaN(rawErrorRate) ? 5 : rawErrorRate;
+  await internalQuery(
+    `INSERT INTO sla_thresholds (workspace_id, latency_p99_ms, error_rate_pct)
+     VALUES ('_default', $1, $2)
+     ON CONFLICT (workspace_id) DO NOTHING`,
+    [defaultLatency, defaultErrorRate],
+  );
+
+  _tableReady = true;
+}
+
+/** @internal Reset table-ready flag — for testing only. */
+export function _resetTableReady(): void {
+  _tableReady = false;
+}
+
+// ---------------------------------------------------------------------------
+// Recording — called on each query execution
+// ---------------------------------------------------------------------------
+
+/**
+ * Record a single query execution metric. Fire-and-forget — errors are
+ * logged but never thrown so this doesn't break the query path.
+ */
+export function recordQueryMetric(
+  workspaceId: string,
+  latencyMs: number,
+  isError: boolean,
+): void {
+  if (!hasInternalDB()) return;
+
+  // Ensure table exists (idempotent), then insert. Single promise chain
+  // so both bootstrap and insert failures are caught and logged.
+  ensureTable()
+    .then(() =>
+      internalQuery(
+        `INSERT INTO sla_metrics (workspace_id, latency_ms, is_error) VALUES ($1, $2, $3)`,
+        [workspaceId, latencyMs, isError],
+      ),
+    )
+    .catch((err) => {
+      log.warn(
+        { err: err instanceof Error ? err.message : String(err), workspaceId },
+        "Failed to record SLA metric",
+      );
+    });
+}
+
+// ---------------------------------------------------------------------------
+// Querying — platform admin API
+// ---------------------------------------------------------------------------
+
+/**
+ * Get SLA summary for all workspaces over the given time window.
+ * Default window: last 24 hours.
+ */
+export async function getAllWorkspaceSLA(
+  hoursBack = 24,
+): Promise<WorkspaceSLASummary[]> {
+
+  await ensureTable();
+
+  const rows = await internalQuery<{
+    workspace_id: string;
+    workspace_name: string;
+    total_queries: string;
+    failed_queries: string;
+    latency_p50: number | null;
+    latency_p95: number | null;
+    latency_p99: number | null;
+    last_query_at: string | null;
+  }>(
+    `SELECT
+       m.workspace_id,
+       COALESCE(o.name, m.workspace_id) AS workspace_name,
+       COUNT(*)::text AS total_queries,
+       COUNT(*) FILTER (WHERE m.is_error)::text AS failed_queries,
+       PERCENTILE_CONT(0.50) WITHIN GROUP (ORDER BY m.latency_ms) AS latency_p50,
+       PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY m.latency_ms) AS latency_p95,
+       PERCENTILE_CONT(0.99) WITHIN GROUP (ORDER BY m.latency_ms) AS latency_p99,
+       MAX(m.recorded_at)::text AS last_query_at
+     FROM sla_metrics m
+     LEFT JOIN organization o ON o.id = m.workspace_id
+     WHERE m.recorded_at > now() - make_interval(hours => $1)
+     GROUP BY m.workspace_id, o.name
+     ORDER BY COUNT(*) DESC`,
+    [hoursBack],
+  );
+
+  return rows.map((r) => {
+    const total = parseInt(r.total_queries, 10);
+    const failed = parseInt(r.failed_queries, 10);
+    return {
+      workspaceId: r.workspace_id,
+      workspaceName: r.workspace_name,
+      latencyP50Ms: Math.round(r.latency_p50 ?? 0),
+      latencyP95Ms: Math.round(r.latency_p95 ?? 0),
+      latencyP99Ms: Math.round(r.latency_p99 ?? 0),
+      errorRatePct: total > 0 ? Math.round((failed / total) * 10000) / 100 : 0,
+      uptimePct: total > 0 ? Math.round(((total - failed) / total) * 10000) / 100 : 100,
+      totalQueries: total,
+      failedQueries: failed,
+      lastQueryAt: r.last_query_at,
+    };
+  });
+}
+
+/**
+ * Get detailed SLA data for a single workspace including time-series.
+ */
+export async function getWorkspaceSLADetail(
+  workspaceId: string,
+  hoursBack = 24,
+): Promise<WorkspaceSLADetail> {
+
+  await ensureTable();
+
+  // Summary
+  const summaryRows = await internalQuery<{
+    workspace_name: string;
+    total_queries: string;
+    failed_queries: string;
+    latency_p50: number | null;
+    latency_p95: number | null;
+    latency_p99: number | null;
+    last_query_at: string | null;
+  }>(
+    `SELECT
+       COALESCE(o.name, $1) AS workspace_name,
+       COUNT(*)::text AS total_queries,
+       COUNT(*) FILTER (WHERE m.is_error)::text AS failed_queries,
+       PERCENTILE_CONT(0.50) WITHIN GROUP (ORDER BY m.latency_ms) AS latency_p50,
+       PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY m.latency_ms) AS latency_p95,
+       PERCENTILE_CONT(0.99) WITHIN GROUP (ORDER BY m.latency_ms) AS latency_p99,
+       MAX(m.recorded_at)::text AS last_query_at
+     FROM sla_metrics m
+     LEFT JOIN organization o ON o.id = m.workspace_id
+     WHERE m.workspace_id = $1 AND m.recorded_at > now() - make_interval(hours => $2)
+     GROUP BY o.name`,
+    [workspaceId, hoursBack],
+  );
+
+  const r = summaryRows[0];
+  const total = r ? parseInt(r.total_queries, 10) : 0;
+  const failed = r ? parseInt(r.failed_queries, 10) : 0;
+
+  const summary: WorkspaceSLASummary = {
+    workspaceId,
+    workspaceName: r?.workspace_name ?? workspaceId,
+    latencyP50Ms: Math.round(r?.latency_p50 ?? 0),
+    latencyP95Ms: Math.round(r?.latency_p95 ?? 0),
+    latencyP99Ms: Math.round(r?.latency_p99 ?? 0),
+    errorRatePct: total > 0 ? Math.round((failed / total) * 10000) / 100 : 0,
+    uptimePct: total > 0 ? Math.round(((total - failed) / total) * 10000) / 100 : 100,
+    totalQueries: total,
+    failedQueries: failed,
+    lastQueryAt: r?.last_query_at ?? null,
+  };
+
+  // Time-series: latency p99 and error rate per hour (independent queries)
+  const [latencyRows, errorRows] = await Promise.all([
+    internalQuery<{ bucket: string; value: number }>(
+      `SELECT
+         date_trunc('hour', recorded_at)::text AS bucket,
+         PERCENTILE_CONT(0.99) WITHIN GROUP (ORDER BY latency_ms) AS value
+       FROM sla_metrics
+       WHERE workspace_id = $1 AND recorded_at > now() - make_interval(hours => $2)
+       GROUP BY bucket
+       ORDER BY bucket`,
+      [workspaceId, hoursBack],
+    ),
+    internalQuery<{ bucket: string; value: number }>(
+      `SELECT
+         date_trunc('hour', recorded_at)::text AS bucket,
+         CASE WHEN COUNT(*) > 0
+              THEN (COUNT(*) FILTER (WHERE is_error)::float / COUNT(*)::float) * 100
+              ELSE 0
+         END AS value
+       FROM sla_metrics
+       WHERE workspace_id = $1 AND recorded_at > now() - make_interval(hours => $2)
+       GROUP BY bucket
+       ORDER BY bucket`,
+      [workspaceId, hoursBack],
+    ),
+  ]);
+
+  const toPoints = (rows: Array<{ bucket: string; value: number }>): SLAMetricPoint[] =>
+    rows.map((row) => ({ timestamp: row.bucket, value: Math.round(row.value * 100) / 100 }));
+
+  return {
+    summary,
+    latencyTimeline: toPoints(latencyRows),
+    errorTimeline: toPoints(errorRows),
+  };
+}

package/templates/docker/ee/src/test-setup.ts

@@ -0,0 +1 @@
+// Bun test preload — reserved for future setup (env cleanup is in beforeEach)

package/templates/docker/next.config.ts

@@ -3,7 +3,10 @@ import type { NextConfig } from "next";
 const nextConfig: NextConfig = {
   // standalone is for self-hosted deployments (Docker, Railway, etc.); Vercel uses its own build pipeline
   ...(process.env.VERCEL ? {} : { output: "standalone" }),
-  serverExternalPackages: ["pg", "mysql2", "@clickhouse/client", "@duckdb/node-api", "snowflake-sdk", "jsforce", "just-bash", "pino", "pino-pretty"],
+  serverExternalPackages: ["pg", "mysql2", "@clickhouse/client", "@duckdb/node-api", "snowflake-sdk", "jsforce", "just-bash", "pino", "pino-pretty", "stripe"],
+  // Type checking is handled by `bun run type` — skip during next build to avoid
+  // false positives from @ts-expect-error directives that differ between monorepo and standalone
+  typescript: { ignoreBuildErrors: true },
 };
 
 export default nextConfig;