feat: Report template editor with AI assistant

backend/drizzle/0019_create-report-templates.sql

@@ -0,0 +1,30 @@
+CREATE TABLE report_templates (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name TEXT NOT NULL,
+  description TEXT,
+  content JSONB NOT NULL,
+  input_schema JSONB NOT NULL,
+  sample_data JSONB,
+  version INTEGER NOT NULL DEFAULT 1,
+  is_system BOOLEAN DEFAULT FALSE,
+  created_by UUID REFERENCES auth_users(id),
+  org_id UUID REFERENCES organizations(id),
+  created_at TIMESTAMPTZ DEFAULT NOW() NOT NULL,
+  updated_at TIMESTAMPTZ DEFAULT NOW() NOT NULL
+);
+
+CREATE TABLE generated_reports (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  template_id UUID REFERENCES report_templates(id) ON DELETE SET NULL,
+  template_version INTEGER,
+  workflow_run_id UUID REFERENCES workflow_runs(run_id) ON DELETE SET NULL,
+  input_data JSONB,
+  artifact_id UUID REFERENCES artifacts(id) ON DELETE SET NULL,
+  org_id UUID REFERENCES organizations(id),
+  generated_at TIMESTAMPTZ DEFAULT NOW() NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS report_templates_org_idx ON report_templates(org_id);
+CREATE INDEX IF NOT EXISTS report_templates_system_idx ON report_templates(is_system);
+CREATE INDEX IF NOT EXISTS generated_reports_template_idx ON generated_reports(template_id);
+CREATE INDEX IF NOT EXISTS generated_reports_workflow_idx ON generated_reports(workflow_run_id);

backend/drizzle/0020_update-report-template-org-types.sql

@@ -0,0 +1,13 @@
+ALTER TABLE report_templates
+  DROP CONSTRAINT IF EXISTS report_templates_created_by_fkey,
+  DROP CONSTRAINT IF EXISTS report_templates_org_id_fkey;
+
+ALTER TABLE generated_reports
+  DROP CONSTRAINT IF EXISTS generated_reports_org_id_fkey;
+
+ALTER TABLE report_templates
+  ALTER COLUMN created_by TYPE VARCHAR(191) USING created_by::text,
+  ALTER COLUMN org_id TYPE VARCHAR(191) USING org_id::text;
+
+ALTER TABLE generated_reports
+  ALTER COLUMN org_id TYPE VARCHAR(191) USING org_id::text;

backend/package.json

@@ -16,6 +16,8 @@
     "delete:runs": "bun scripts/delete-all-workflow-runs.ts"
   },
   "dependencies": {
+    "@ai-sdk/google": "^3.0.2",
+    "@ai-sdk/openai": "^3.0.2",
     "@clerk/backend": "^2.9.4",
     "@clerk/types": "^4.81.0",
     "@grpc/grpc-js": "^1.14.0",
@@ -32,12 +34,13 @@
     "@temporalio/workflow": "^1.11.3",
     "@types/express": "^5.0.3",
     "@types/minio": "^7.1.1",
-    "ai": "^6.0.0-beta.68",
+    "ai": "^6.0.5",
     "bcryptjs": "^3.0.3",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.1",
     "dotenv": "^17.2.3",
     "drizzle-orm": "^0.44.6",
+    "handlebars": "^4.7.8",
     "ioredis": "^5.4.1",
     "kafkajs": "^2.2.4",
     "long": "^5.2.4",

backend/src/agent-trace/agent-trace-ingest.service.ts

@@ -23,7 +23,10 @@ export class AgentTraceIngestService implements OnModuleInit, OnModuleDestroy {
     }
 
     this.kafkaTopic = process.env.AGENT_TRACE_KAFKA_TOPIC ?? 'telemetry.agent-trace';
-    this.kafkaGroupId = process.env.AGENT_TRACE_KAFKA_GROUP_ID ?? 'shipsec-agent-trace-ingestor';
+    const baseGroupId = process.env.AGENT_TRACE_KAFKA_GROUP_ID ?? 'shipsec-agent-trace-ingestor';
+    this.kafkaGroupId = process.env.NODE_ENV === 'production' 
+      ? baseGroupId 
+      : `${baseGroupId}-dev-${Math.random().toString(36).substring(7)}`;
     this.kafkaClientId = process.env.AGENT_TRACE_KAFKA_CLIENT_ID ?? 'shipsec-backend-agent-trace';
   }
 

backend/src/ai/ai.controller.ts

@@ -0,0 +1,103 @@
+import {
+  BadRequestException,
+  Controller,
+  Post,
+  Req,
+  Res,
+  UnauthorizedException,
+  UseGuards,
+} from '@nestjs/common';
+import { ApiOkResponse, ApiTags } from '@nestjs/swagger';
+import type { Request, Response } from 'express';
+import { UIMessage } from 'ai';
+
+import { AiService } from './ai.service';
+import { AuthGuard } from '../auth/auth.guard';
+import { CurrentAuth } from '../auth/auth-context.decorator';
+import type { AuthContext } from '../auth/types';
+
+/**
+ * AI Controller - AI SDK v6 compatible
+ * 
+ * Receives UIMessage[] from useChat's DefaultChatTransport.
+ * Returns toUIMessageStreamResponse() for streaming.
+ */
+@ApiTags('AI')
+@Controller('ai')
+@UseGuards(AuthGuard)
+export class AiController {
+  constructor(private readonly aiService: AiService) {}
+
+  /**
+   * Main chat endpoint
+   * 
+   * Receives: { messages: UIMessage[], id?, systemPrompt?, context?, model? }
+   * Returns: UI Message Stream Response
+   */
+  @Post()
+  @ApiOkResponse({ description: 'AI SDK v6 UI message stream' })
+  async chat(
+    @CurrentAuth() auth: AuthContext | null,
+    @Req() req: Request,
+    @Res() res: Response,
+  ) {
+    this.requireAuth(auth);
+
+    const body = req.body as { 
+      messages: UIMessage[]; 
+      systemPrompt?: string;
+      context?: string;
+      model?: string;
+    };
+
+    const { messages, systemPrompt, context, model } = body;
+
+    if (!messages || !Array.isArray(messages) || messages.length === 0) {
+      throw new BadRequestException('Messages are required');
+    }
+
+    const system = systemPrompt || this.aiService.buildSystemPrompt(context);
+
+    const result = await this.aiService.streamChat(messages, { system, model, context });
+
+    // toUIMessageStreamResponse returns a Response object
+    // We need to pipe it to Express response
+    const streamResponse = result.toUIMessageStreamResponse();
+
+    // Set headers from the stream response
+    res.setHeader('Content-Type', streamResponse.headers.get('Content-Type') || 'text/event-stream');
+    res.setHeader('Cache-Control', 'no-cache');
+    res.setHeader('Connection', 'keep-alive');
+
+    // Pipe the body to the response
+    if (streamResponse.body) {
+      const reader = streamResponse.body.getReader();
+      const pump = async () => {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) {
+            res.end();
+            break;
+          }
+          res.write(value);
+        }
+      };
+      pump().catch((err) => {
+        console.error('Stream error:', err);
+        res.end();
+      });
+    } else {
+      res.end();
+    }
+  }
+
+  private requireAuth(auth: AuthContext | null): AuthContext {
+    if (!auth?.isAuthenticated) {
+      throw new UnauthorizedException('Authentication required');
+    }
+    if (!auth.organizationId) {
+      throw new BadRequestException('Organization context is required');
+    }
+    return auth;
+  }
+}

backend/src/ai/ai.module.ts

@@ -0,0 +1,13 @@
+import { Module } from '@nestjs/common';
+import { AiService } from './ai.service';
+import { forwardRef } from '@nestjs/common';
+import { ApiKeysModule } from '../api-keys/api-keys.module';
+import { AiController } from './ai.controller';
+
+@Module({
+  imports: [forwardRef(() => ApiKeysModule)],
+  controllers: [AiController],
+  providers: [AiService],
+  exports: [AiService],
+})
+export class AiModule {}