@useatlas/create 0.0.6 → 0.0.7

package/templates/nextjs-standalone/package.json

@@ -5,7 +5,7 @@
   "description": "Atlas text-to-SQL data analyst agent (Next.js + Vercel)",
   "scripts": {
     "dev": "next dev --turbopack",
-    "build": "bun run type && next build",
+    "build": "next build",
     "start": "next start",
     "lint": "eslint src/",
     "type": "tsgo --noEmit",
@@ -13,35 +13,55 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ai-sdk/amazon-bedrock": "^4.0.63",
-    "@ai-sdk/anthropic": "^3.0.46",
-    "@ai-sdk/openai": "^3.0.31",
-    "@ai-sdk/react": "^3.0.99",
-    "ai": "^6.0.97",
-    "@better-auth/api-key": "^1.5.1",
+    "@ai-sdk/amazon-bedrock": "^4.0.83",
+    "@ai-sdk/anthropic": "^3.0.64",
+    "@ai-sdk/gateway": "^3.0.83",
+    "@ai-sdk/openai": "^3.0.48",
+    "@ai-sdk/provider": "^3.0.8",
+    "@ai-sdk/react": "^3.0.143",
+    "@useatlas/react": "^0.0.5",
+    "@useatlas/types": "^0.0.3",
+    "ai": "^6.0.141",
+    "@better-auth/api-key": "^1.5.6",
+    "@dnd-kit/core": "^6.3.1",
+    "@dnd-kit/modifiers": "^9.0.0",
+    "@dnd-kit/sortable": "^10.0.0",
+    "@dnd-kit/utilities": "^3.2.2",
+    "@hookform/resolvers": "^5.2.2",
+    "@better-auth/scim": "^1.5.6",
+    "@better-auth/stripe": "^1.5.6",
+    "@hono/zod-openapi": "^1.2.4",
+    "@opentelemetry/api": "^1.9.1",
+    "@tanstack/react-table": "^8.21.3",
     "better-auth": "^1.5.1",
+    "drizzle-orm": "^0.45.2",
+    "effect": "^3.21.0",
+    "exceljs": "^4.4.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
-    "croner": "^9.0.0",
-    "hono": "^4.12.3",
-    "jose": "^6.1.3",
+    "croner": "^10.0.1",
+    "hono": "^4.12.9",
+    "jose": "^6.2.2",
     "js-yaml": "^4.1.1",
-    "just-bash": "^2.10.2",
-    "lucide-react": "^0.577.0",
-    "mysql2": "^3.18.0",
-    "next": "^16.1.6",
+    "just-bash": "^2.14.0",
+    "lucide-react": "^1.7.0",
+    "mysql2": "^3.20.0",
+    "next": "^16.2.1",
     "node-sql-parser": "^5.4.0",
     "nuqs": "^2.8.9",
-    "pg": "^8.18.0",
+    "pg": "^8.20.0",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
     "radix-ui": "^1.4.3",
+    "react-day-picker": "^9.14.0",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
+    "react-hook-form": "^7.72.0",
     "react-markdown": "^10.1.0",
-    "react-syntax-highlighter": "^16.1.0",
-    "recharts": "^3.7.0",
+    "react-syntax-highlighter": "^16.1.1",
+    "recharts": "^3.8.1",
+    "stripe": "^21.0.1",
     "tailwind-merge": "^3.5.0",
     "tw-animate-css": "^1.4.0",
     "zod": "^4.3.6"
@@ -50,23 +70,23 @@
     "@vercel/sandbox": "^1"
   },
   "devDependencies": {
-    "@clack/prompts": "^0.10.0",
+    "@clack/prompts": "^1.1.0",
     "@eslint/js": "^10.0.1",
-    "@next/eslint-plugin-next": "^16.1.6",
-    "@tailwindcss/postcss": "^4.2.1",
+    "@next/eslint-plugin-next": "^16.2.1",
+    "@tailwindcss/postcss": "^4.2.2",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^25.3.2",
-    "@types/pg": "^8.16.0",
+    "@types/node": "^25.5.0",
+    "@types/pg": "^8.20.0",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "@types/react-syntax-highlighter": "^15.5.13",
-    "@types/bun": "^1.3.9",
-    "@typescript/native-preview": "^7.0.0-dev.20260226.1",
-    "eslint": "^10.0.2",
-    "tailwindcss": "^4.2.1",
-    "shadcn": "^3.8.5",
-    "picocolors": "^1.1.0",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.56.1"
+    "@types/bun": "^1.3.11",
+    "@typescript/native-preview": "^7.0.0-dev.20260328.1",
+    "eslint": "^10.1.0",
+    "tailwindcss": "^4.2.2",
+    "shadcn": "^4.1.1",
+    "picocolors": "^1.1.1",
+    "typescript": "^6.0.2",
+    "typescript-eslint": "^8.57.2"
   }
 }

package/templates/nextjs-standalone/src/api/index.ts

@@ -1,40 +1,132 @@
 /**
- * Atlas API — Hono application.
+ * Atlas API — OpenAPIHono application.
  *
- * Mounts chat, health, auth, v1 query, conversations, OpenAPI, and admin routes
- * with CORS middleware. Actions, scheduled tasks, and Slack routes are
- * conditionally loaded based on env vars.
+ * Mounts chat, health, auth, v1 query, conversations, public shared
+ * conversations, semantic, OpenAPI, admin, and widget routes with CORS
+ * middleware. Actions, scheduled tasks, and Slack routes are conditionally
+ * loaded based on env vars.
  * Can be served standalone (./server.ts). The Next.js frontend
  * connects via same-origin rewrites (default) or cross-origin
  * fetch (when NEXT_PUBLIC_ATLAS_API_URL is set).
  */
 
-import { Hono } from "hono";
-import { cors } from "hono/cors";
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { HTTPException } from "hono/http-exception";
+import {
+  trace,
+  SpanStatusCode,
+  context as otelContext,
+} from "@opentelemetry/api";
 import { createLogger } from "@atlas/api/lib/logger";
+import { validationHook } from "./routes/validation-hook";
 import { chat } from "./routes/chat";
 import { health } from "./routes/health";
 import { auth } from "./routes/auth";
 import { query } from "./routes/query";
-import { openapi } from "./routes/openapi";
-import { conversations } from "./routes/conversations";
+import { staticPaths, staticTags, securitySchemes } from "./routes/openapi";
+import { conversations, publicConversations } from "./routes/conversations";
+import { semantic } from "./routes/semantic";
+import { tables } from "./routes/tables";
+import { validateSqlRoute } from "./routes/validate-sql";
+import { prompts } from "./routes/prompts";
+import { widget } from "./routes/widget";
+import { widgetLoader, widgetTypesLoader } from "./routes/widget-loader";
+import { publicBranding } from "./routes/public-branding";
+import { onboardingEmails } from "./routes/onboarding-emails";
 
 const log = createLogger("api");
-const app = new Hono();
+const tracer = trace.getTracer("atlas");
+const app = new OpenAPIHono({ defaultHook: validationHook });
+
+// OTel tracing — root span per HTTP request. No-op when SDK is not initialized.
+// Must be the first middleware so all downstream operations are children.
+app.use("/api/*", async (c, next) => {
+  const span = tracer.startSpan("http.request", {
+    attributes: {
+      "http.method": c.req.method,
+      "http.target": c.req.path,
+    },
+  });
+  const ctx = trace.setSpan(otelContext.active(), span);
+  try {
+    await otelContext.with(ctx, () => next());
+    span.setAttributes({ "http.status_code": c.res.status });
+    span.setStatus({
+      code: c.res.status < 400 ? SpanStatusCode.OK : SpanStatusCode.ERROR,
+    });
+  } catch (err) {
+    try {
+      span.setStatus({
+        code: SpanStatusCode.ERROR,
+        message: err instanceof Error ? err.message : String(err),
+      });
+      span.recordException(
+        err instanceof Error ? err : new Error(String(err)),
+      );
+    } catch {
+      // OTel span operations must never replace the original error.
+    }
+    throw err;
+  } finally {
+    try { span.end(); } catch { /* span lifecycle must not crash the request */ }
+  }
+});
 
 // CORS — configurable origin for cross-origin frontend deployments.
 // Default "*" is fine for API key / BYOT auth (header-based).
 // Managed auth (cookies) needs explicit origin + credentials — see docs/hono-extraction-design.md.
-const corsOrigin = process.env.ATLAS_CORS_ORIGIN;
-app.use(
-  "/api/*",
-  cors({
-    origin: corsOrigin ?? "*",
-    credentials: !!corsOrigin, // only send credentials header when origin is explicit
-    allowHeaders: ["Content-Type", "Authorization"],
-    exposeHeaders: ["Retry-After", "x-conversation-id"],
-  }),
-);
+//
+// The origin is read per-request from the settings cache so admin changes
+// take effect without a server restart.
+const bootCorsOrigin = process.env.ATLAS_CORS_ORIGIN;
+let corsSettingsWarnLogged = false;
+
+function resolveCorsOrigin(): string {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports -- lazy import avoids circular dependency at module load
+    const { getSettingAuto } = require("@atlas/api/lib/settings") as {
+      getSettingAuto: (key: string) => string | undefined;
+    };
+    return getSettingAuto("ATLAS_CORS_ORIGIN") ?? bootCorsOrigin ?? "*";
+  } catch (err) {
+    if (!corsSettingsWarnLogged) {
+      log.warn(
+        { err: err instanceof Error ? err.message : String(err) },
+        "CORS: failed to read live setting — falling back to boot-time origin",
+      );
+      corsSettingsWarnLogged = true;
+    }
+    return bootCorsOrigin ?? "*";
+  }
+}
+
+app.use("/api/*", async (c, next) => {
+  const requestOrigin = c.req.header("Origin") ?? "";
+  const configuredOrigin = resolveCorsOrigin();
+  const isWildcard = configuredOrigin === "*";
+  const isMatch = isWildcard || configuredOrigin === requestOrigin;
+
+  // Set CORS headers dynamically
+  if (isWildcard) {
+    c.header("Access-Control-Allow-Origin", "*");
+    // credentials must NOT be set with wildcard origin per CORS spec
+  } else if (isMatch) {
+    c.header("Access-Control-Allow-Origin", requestOrigin);
+    c.header("Access-Control-Allow-Credentials", "true");
+  }
+  // Non-matching origin: no CORS headers set — browser will reject
+
+  c.header("Access-Control-Allow-Headers", "Content-Type, Authorization");
+  c.header("Access-Control-Expose-Headers", "Retry-After, x-conversation-id");
+
+  // Handle preflight
+  if (c.req.method === "OPTIONS") {
+    c.header("Access-Control-Allow-Methods", "GET, HEAD, PUT, POST, DELETE, PATCH");
+    return c.body(null, 204);
+  }
+
+  await next();
+});
 
 // Plugin hook middleware — dispatches onRequest/onResponse to plugin hooks.
 // Dynamic import avoids circular deps; dispatchHook is a no-op when no plugins.
@@ -53,12 +145,73 @@ app.use("/api/*", async (c, next) => {
   });
 });
 
-app.route("/api/chat", chat);
+app.route("/api/v1/chat", chat);
 app.route("/api/health", health);
 app.route("/api/auth", auth);
 app.route("/api/v1/query", query);
-app.route("/api/v1/openapi.json", openapi);
+// OpenAPI spec served below via merged auto + static endpoint
 app.route("/api/v1/conversations", conversations);
+app.route("/api/public/conversations", publicConversations);
+app.route("/api/v1/semantic", semantic);
+app.route("/api/v1/tables", tables);
+app.route("/api/v1/validate-sql", validateSqlRoute);
+app.route("/api/v1/prompts", prompts);
+app.route("/widget", widget);
+app.route("/widget.js", widgetLoader);
+app.route("/widget.d.ts", widgetTypesLoader);
+app.route("/api/v1/branding", publicBranding);
+app.route("/api/v1/onboarding-emails", onboardingEmails);
+
+// Onboarding routes — self-serve signup flow (test-connection, complete setup).
+try {
+  const { onboarding } = await import("./routes/onboarding");
+  app.route("/api/v1/onboarding", onboarding);
+} catch (err) {
+  log.error(
+    { err: err instanceof Error ? err : new Error(String(err)) },
+    "Failed to load onboarding routes",
+  );
+}
+
+// Wizard routes — guided semantic layer setup (admin-gated).
+try {
+  const { wizard } = await import("./routes/wizard");
+  app.route("/api/v1/wizard", wizard);
+} catch (err) {
+  log.error(
+    { err: err instanceof Error ? err : new Error(String(err)) },
+    "Failed to load wizard routes",
+  );
+}
+
+// Suggestions routes — user-facing query suggestions.
+try {
+  const { suggestions } = await import("./routes/suggestions");
+  app.route("/api/v1/suggestions", suggestions);
+  // Also register trailing-slash variant so ?table=orders and GET / both match.
+  app.route("/api/v1/suggestions/", suggestions);
+} catch (err) {
+  log.error(
+    { err: err instanceof Error ? err : new Error(String(err)) },
+    "Failed to load suggestions routes",
+  );
+}
+
+// Demo mode routes — email-gated public demo with lead capture.
+if (process.env.ATLAS_DEMO_ENABLED === "true") {
+  try {
+    const { demo } = await import("./routes/demo");
+    app.route("/api/v1/demo", demo);
+    log.info("Demo mode enabled");
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err : new Error(String(err)) },
+      "Failed to load demo routes",
+    );
+  }
+} else {
+  log.debug("Demo mode disabled (ATLAS_DEMO_ENABLED not set)");
+}
 
 // Action routes — lazy import, only loaded if ATLAS_ACTIONS_ENABLED is set.
 if (process.env.ATLAS_ACTIONS_ENABLED === "true") {
@@ -78,6 +231,17 @@ if (process.env.ATLAS_SCHEDULER_ENABLED === "true") {
   log.debug("Scheduled tasks disabled (ATLAS_SCHEDULER_ENABLED not set)");
 }
 
+// User session self-service routes — requires managed auth + internal DB.
+try {
+  const { sessions } = await import("./routes/sessions");
+  app.route("/api/v1/sessions", sessions);
+} catch (err) {
+  log.error(
+    { err: err instanceof Error ? err : new Error(String(err)) },
+    "Failed to load session routes — user session self-service will be unavailable",
+  );
+}
+
 // Admin routes — always available (auth-gated to admin role).
 // Wrapped in try/catch so a missing dependency (e.g. js-yaml) doesn't crash the entire server.
 try {
@@ -91,27 +255,175 @@ try {
   );
 }
 
+// Platform admin routes — cross-tenant management (gated to platform_admin role).
+try {
+  const { platformAdmin } = await import("./routes/platform-admin");
+  app.route("/api/v1/platform", platformAdmin);
+  log.info("Platform admin routes enabled");
+} catch (err) {
+  log.error(
+    { err: err instanceof Error ? err : new Error(String(err)) },
+    "Failed to load platform admin routes — platform console will be unavailable",
+  );
+}
+
+// Platform SLA monitoring routes — enterprise-gated, platform_admin role.
+try {
+  const { platformSLA } = await import("./routes/platform-sla");
+  app.route("/api/v1/platform/sla", platformSLA);
+  log.info("Platform SLA monitoring routes enabled");
+} catch (err) {
+  log.error(
+    { err: err instanceof Error ? err : new Error(String(err)) },
+    "Failed to load platform SLA routes — SLA monitoring will be unavailable",
+  );
+}
+
+// Platform backups routes — enterprise-gated, platform_admin role.
+try {
+  const { platformBackups } = await import("./routes/platform-backups");
+  app.route("/api/v1/platform/backups", platformBackups);
+  log.info("Platform backup routes enabled");
+} catch (err) {
+  log.error(
+    { err: err instanceof Error ? err : new Error(String(err)) },
+    "Failed to load platform backup routes — backup management will be unavailable",
+  );
+}
+
+// Platform data residency routes — enterprise-gated, platform_admin role.
+try {
+  const { platformResidency } = await import("./routes/platform-residency");
+  app.route("/api/v1/platform/residency", platformResidency);
+  log.info("Platform residency routes enabled");
+} catch (err) {
+  log.error(
+    { err: err instanceof Error ? err : new Error(String(err)) },
+    "Failed to load platform residency routes — data residency will be unavailable",
+  );
+}
+
+// Platform custom domain routes — enterprise-gated, platform_admin role.
+try {
+  const { platformDomains } = await import("./routes/platform-domains");
+  app.route("/api/v1/platform/domains", platformDomains);
+  log.info("Platform custom domain routes enabled");
+} catch (err) {
+  log.error(
+    { err: err instanceof Error ? err : new Error(String(err)) },
+    "Failed to load platform domain routes — custom domains will be unavailable",
+  );
+}
+
+// Billing routes — lazy import, only loaded if STRIPE_SECRET_KEY is set (SaaS mode).
+if (process.env.STRIPE_SECRET_KEY) {
+  try {
+    const { billing } = await import("./routes/billing");
+    app.route("/api/v1/billing", billing);
+    log.info("Stripe billing routes enabled");
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err : new Error(String(err)) },
+      "Failed to load billing routes — billing endpoints will be unavailable",
+    );
+  }
+} else {
+  log.debug("Billing routes disabled (STRIPE_SECRET_KEY not set)");
+}
+
 // Slack routes — lazy import, only loaded if SLACK_SIGNING_SECRET is set.
 // Dynamic import avoids pulling slack dependencies into the module graph
 // when Slack is disabled, and prevents mock.module leaks in test suites.
 if (process.env.SLACK_SIGNING_SECRET) {
   const { slack } = await import("./routes/slack");
-  app.route("/api/slack", slack);
+  app.route("/api/v1/slack", slack);
   log.info("Slack integration enabled");
 } else {
   log.debug("Slack integration disabled (SLACK_SIGNING_SECRET not set)");
 }
 
+// Teams routes — lazy import, only loaded if TEAMS_APP_ID is set.
+// Dynamic import avoids pulling teams dependencies into the module graph
+// when Teams is disabled, and prevents mock.module leaks in test suites.
+if (process.env.TEAMS_APP_ID) {
+  const { teams } = await import("./routes/teams");
+  app.route("/api/v1/teams", teams);
+  log.info("Teams integration enabled");
+} else {
+  log.debug("Teams integration disabled (TEAMS_APP_ID not set)");
+}
+
+// Discord routes — lazy import, only loaded if DISCORD_CLIENT_ID is set.
+if (process.env.DISCORD_CLIENT_ID) {
+  const { discord } = await import("./routes/discord");
+  app.route("/api/v1/discord", discord);
+  log.info("Discord integration enabled");
+} else {
+  log.debug("Discord integration disabled (DISCORD_CLIENT_ID not set)");
+}
+
 app.onError((err, c) => {
-  log.error({ err, path: c.req.path }, "Unhandled error");
+  // Framework HTTP exceptions (e.g., malformed JSON from @hono/zod-openapi) carry
+  // their own status code and response — forward them instead of converting to 500.
+  if (err instanceof HTTPException) {
+    return err.getResponse();
+  }
+  const requestId = crypto.randomUUID();
+  log.error({ err, path: c.req.path, requestId }, "Unhandled error");
   return c.json(
     {
       error: "internal_error",
-      message: "An unexpected server error occurred. Please try again.",
+      message: `An unexpected server error occurred (ref: ${requestId.slice(0, 8)}). Please try again.`,
+      requestId,
     },
     500,
   );
 });
 
+// ---------------------------------------------------------------------------
+// OpenAPI spec — merged auto-generated + static entries
+// ---------------------------------------------------------------------------
+// Auto-generated routes come from OpenAPIHono createRoute() definitions.
+// Static entries (auth proxy, widget assets) are defined in openapi.ts.
+
+let cachedSpec: Record<string, unknown> | null = null;
+
+app.get("/api/v1/openapi.json", (c) => {
+  if (!cachedSpec) {
+    const auto = app.getOpenAPI31Document({
+      openapi: "3.1.0",
+      info: {
+        title: "Atlas API",
+        version: "0.9.7",
+        description:
+          "Text-to-SQL data analyst agent. Ask natural-language questions about your data and receive structured answers.",
+      },
+      servers: [
+        { url: "http://localhost:3001", description: "Standalone API (development)" },
+        { url: "http://localhost:3000", description: "Same-origin via Next.js rewrites" },
+      ],
+    });
+
+    // Merge static paths (auth, widget) into the auto-generated spec
+    const autoPaths = (auto.paths ?? {}) as Record<string, unknown>;
+    const mergedPaths = { ...autoPaths, ...staticPaths };
+
+    // Merge static tags
+    const autoTags = (auto.tags ?? []) as Array<{ name: string; description?: string }>;
+    const autoTagNames = new Set(autoTags.map((t) => t.name));
+    const mergedTags = [...autoTags, ...staticTags.filter((t) => !autoTagNames.has(t.name))];
+
+    // Add security schemes
+    const autoComponents = (auto.components ?? {}) as Record<string, unknown>;
+    const mergedComponents = {
+      ...autoComponents,
+      securitySchemes: { ...((autoComponents.securitySchemes as Record<string, unknown>) ?? {}), ...securitySchemes },
+    };
+
+    cachedSpec = { ...auto, paths: mergedPaths, tags: mergedTags, components: mergedComponents };
+  }
+  return c.json(cachedSpec);
+});
+
 export { app };
 export type AppType = typeof app;