feat(web): real 3-step wizard, settings, audit, docs, marketing pages

Sprint 3.5: close every dead link and replace the single-step wizard with the
spec-mandated 3-step flow.

Wizard:
- Step 1 collects prompt + name + slug, calls /v1/servers/preview.
- Step 2 renders parsed tools (name, description, input schema as copyable JSON)
  + a credential field per requiredSecret Claude actually identified. Self-contained
  servers see 'No credentials needed' instead of generic Notion placeholders.
- Step 3 streams the live build over WebSocket and shows install snippets.

New dashboard pages:
- /settings — org, plan/usage, members table, API keys + billing stubs (Sprint 4),
  encryption status. Reads /v1/me/org.
- /audit — filterable table over /v1/audit with action pills, resource refs, IP,
  metadata JSON.

Docs site (/docs + 6 sub-pages):
- Sticky 240px sidebar, max-w-prose article column, shared DocsTitle/H2/Code primitives.
- Quickstart, MCP concepts, OAuth 2.1 flow (full walkthrough with curl), Authoring
  tools, Self-hosting, API reference, FAQ.

Marketing pages:
- /changelog with tagged release timeline.
- /security with 8 pillars + disclosure.
- /privacy with GDPR-aware sections.
- /terms (10 clauses).
- /pricing full page (nav now points here instead of /#pricing anchor).
- /status with live 10s probes against /api/health and /login.

Footer 'system status' badge now links to /status.

All 20 routes 200 OK in smoke crawl. Typecheck clean across packages.
This commit is contained in:
Marco Sadjadi
2026-05-19 18:20:31 +02:00
parent 1c92964bbd
commit 09688c1114
20 changed files with 2055 additions and 75 deletions

View File

@@ -0,0 +1,120 @@
'use client';
import { useEffect, useState } from 'react';
import { apiFetch } from '@/lib/api';
import { Input } from '@/components/input';
interface AuditEntry {
id: string;
action: string;
resourceType: string | null;
resourceId: string | null;
metadata: Record<string, unknown> | null;
ipAddress: string | null;
userId: string | null;
createdAt: string;
}
const ACTION_FILTERS = [
{ value: '', label: 'All actions' },
{ value: 'auth.login', label: 'Logins' },
{ value: 'auth.logout', label: 'Logouts' },
{ value: 'server.create', label: 'Server created' },
{ value: 'server.iterate', label: 'Server iterated' },
{ value: 'server.delete', label: 'Server deleted' },
];
export default function AuditPage() {
const [entries, setEntries] = useState<AuditEntry[] | null>(null);
const [action, setAction] = useState('');
const [search, setSearch] = useState('');
useEffect(() => {
const q = action ? `?action=${encodeURIComponent(action)}` : '';
apiFetch<{ entries: AuditEntry[] }>(`/v1/audit${q}`).then((r) => setEntries(r.entries));
}, [action]);
const visible = entries?.filter((e) =>
search
? e.action.includes(search) ||
e.resourceId?.includes(search) ||
e.ipAddress?.includes(search)
: true,
);
return (
<div className="mx-auto max-w-7xl px-6 py-8">
<div>
<h1 className="text-[22px] font-semibold tracking-tight">Audit log</h1>
<p className="mt-1 text-[13px] text-[--color-fg-muted]">
Every privileged action in your workspace, with IP and metadata.
</p>
</div>
<div className="mt-6 flex flex-wrap gap-2">
<select
value={action}
onChange={(e) => setAction(e.target.value)}
className="h-8 rounded-md border border-[--color-border] bg-[--color-bg-subtle] px-2 text-[13px] focus:border-[--color-accent] focus:outline-none"
>
{ACTION_FILTERS.map((f) => (
<option key={f.value} value={f.value}>
{f.label}
</option>
))}
</select>
<Input
value={search}
onChange={(e) => setSearch(e.target.value)}
placeholder="Filter by resource id or ip…"
className="w-72"
/>
</div>
<div className="panel mt-4">
{!visible && (
<div className="px-4 py-4 text-[12.5px] text-[--color-fg-muted]">Loading</div>
)}
{visible && visible.length === 0 && (
<div className="px-4 py-12 text-center text-[13px] text-[--color-fg-muted]">
No matching entries.
</div>
)}
{visible && visible.length > 0 && (
<table className="w-full text-[12px]">
<thead className="border-b border-[--color-border] text-[--color-fg-subtle]">
<tr>
<th className="px-4 py-2 text-left font-medium">When</th>
<th className="px-4 py-2 text-left font-medium">Action</th>
<th className="px-4 py-2 text-left font-medium">Resource</th>
<th className="px-4 py-2 text-left font-medium">IP</th>
<th className="px-4 py-2 text-left font-medium">Metadata</th>
</tr>
</thead>
<tbody>
{visible.map((e) => (
<tr key={e.id} className="border-b border-[--color-border] last:border-0">
<td className="px-4 py-2 mono text-[--color-fg-muted]">
{new Date(e.createdAt).toLocaleString()}
</td>
<td className="px-4 py-2">
<span className="mono rounded-full border border-[--color-border] bg-[--color-bg-subtle] px-2 py-0.5 text-[11px]">
{e.action}
</span>
</td>
<td className="px-4 py-2 mono text-[--color-fg-muted]">
{e.resourceType ? `${e.resourceType}/${e.resourceId?.slice(0, 8) ?? '—'}` : '—'}
</td>
<td className="px-4 py-2 mono text-[--color-fg-muted]">{e.ipAddress ?? '—'}</td>
<td className="px-4 py-2 mono text-[10.5px] text-[--color-fg-subtle]">
{e.metadata ? JSON.stringify(e.metadata) : '—'}
</td>
</tr>
))}
</tbody>
</table>
)}
</div>
</div>
);
}

View File

@@ -8,15 +8,50 @@ import { Input, Label, Textarea } from '@/components/input';
import { StreamingLogs } from '@/components/streaming-logs';
import { InstallSnippets } from '@/components/install-snippets';
import { CodeBlock } from '@/components/code-block';
import { Loader2 } from 'lucide-react';
const EXAMPLE_PROMPTS = [
'Read-only Postgres reader for the users and orders tables at db.example.com',
'Search and read pages from our Notion workspace via the Notion API',
'Wrap our internal HTTP API at api.acme.com — endpoints /search and /lookup',
'Stripe charges and customers (read-only)',
{
label: 'Echo / demo (no external API)',
text: 'Build a simple echo server with two tools: echo (string in, same string back) and now (returns current UTC timestamp). No external API needed.',
},
{
label: 'Notion search',
text: 'Search and read pages from our Notion workspace via the Notion API. Tools: search_pages(query), get_page_content(page_id). Auth: NOTION_API_KEY.',
},
{
label: 'Postgres reader',
text: 'Read-only Postgres reader for the users and orders tables at db.example.com. One tool per table: list_users(limit), list_orders(limit, customer_id?). Auth: DATABASE_URL.',
},
{
label: 'Wrap our REST API',
text: 'Wrap our internal HTTP API at api.acme.com — endpoints /search?q= and /lookup?id=. Tools: search(query), lookup(id). Auth: ACME_API_TOKEN.',
},
{
label: 'Stripe charges (read-only)',
text: 'Stripe charges and customers, read-only. Tools: list_recent_charges(limit), get_customer(customer_id). Auth: STRIPE_SECRET_KEY.',
},
];
type Step = 'prompt' | 'building' | 'done';
type Step = 'prompt' | 'analyzing' | 'confirm' | 'building' | 'done';
interface PreviewTool {
name: string;
description: string;
inputSchema: Record<string, unknown>;
}
interface PreviewResponse {
previewId: string;
source: 'claude' | 'mock';
spec: {
name: string;
description?: string;
tools: PreviewTool[];
requiredSecrets: string[];
scopes: string[];
};
}
interface BuildResult {
serverId: string;
@@ -26,10 +61,14 @@ interface BuildResult {
export default function NewServerPage() {
const router = useRouter();
const [step, setStep] = useState<Step>('prompt');
const [prompt, setPrompt] = useState('');
const [name, setName] = useState('');
const [slug, setSlug] = useState('');
const [prompt, setPrompt] = useState('');
const [secretRows, setSecretRows] = useState<{ key: string; value: string }[]>([{ key: '', value: '' }]);
const [preview, setPreview] = useState<PreviewResponse | null>(null);
const [secretValues, setSecretValues] = useState<Record<string, string>>({});
const [error, setError] = useState<string | null>(null);
const [buildId, setBuildId] = useState<string | null>(null);
const [serverId, setServerId] = useState<string | null>(null);
@@ -38,20 +77,61 @@ export default function NewServerPage() {
const trySlug = (n: string) =>
n.toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 32);
async function submit() {
async function analyze() {
setError(null);
if (!name || !slug || prompt.length < 10) {
setError('Name, slug and a prompt of at least 10 characters are required.');
if (prompt.trim().length < 10) {
setError('Prompt must be at least 10 characters.');
return;
}
const secrets: Record<string, string> = {};
for (const row of secretRows) {
if (row.key && row.value) secrets[row.key.trim()] = row.value;
if (!name || !slug) {
setError('Name and slug are required.');
return;
}
setStep('analyzing');
try {
const res = await apiFetch<PreviewResponse>('/v1/servers/preview', {
method: 'POST',
body: JSON.stringify({ prompt }),
});
setPreview(res);
const initial: Record<string, string> = {};
for (const key of res.spec.requiredSecrets) initial[key] = '';
setSecretValues(initial);
setStep('confirm');
} catch (e) {
const detail = (e as { detail?: { error?: string; detail?: string } }).detail;
setError(detail?.detail ?? detail?.error ?? (e as Error).message);
setStep('prompt');
}
}
async function build() {
setError(null);
if (!preview) return;
const filledSecrets: Record<string, string> = {};
for (const [k, v] of Object.entries(secretValues)) {
if (v.trim()) filledSecrets[k] = v;
}
const missing = preview.spec.requiredSecrets.filter((k) => !filledSecrets[k]);
if (missing.length > 0) {
setError(`Fill in: ${missing.join(', ')} — or remove if not needed.`);
return;
}
try {
const res = await apiFetch<{ server: { id: string }; build: { id: string } }>(
'/v1/servers',
{ method: 'POST', body: JSON.stringify({ name, slug, prompt, secrets }) },
{
method: 'POST',
body: JSON.stringify({
name,
slug,
prompt,
secrets: filledSecrets,
previewId: preview.previewId,
}),
},
);
setBuildId(res.build.id);
setServerId(res.server.id);
@@ -62,35 +142,40 @@ export default function NewServerPage() {
}
}
const stepNumber = step === 'prompt' ? 1 : step === 'analyzing' || step === 'confirm' ? 2 : 3;
return (
<div className="mx-auto max-w-3xl px-6 py-8">
<div className="flex items-baseline justify-between">
<h1 className="text-[22px] font-semibold tracking-tight">New MCP server</h1>
<div className="mono text-[11px] tracking-wider text-[--color-fg-subtle]">
STEP {step === 'prompt' ? '1' : step === 'building' ? '2' : '3'} / 3
STEP {stepNumber} / 3
</div>
</div>
{step === 'prompt' && (
<div className="mt-7 space-y-5">
<div className="space-y-1.5">
<Label htmlFor="prompt">Describe your tool</Label>
<Label htmlFor="prompt">Describe what your tool should do</Label>
<Textarea
id="prompt"
rows={5}
value={prompt}
onChange={(e) => setPrompt(e.target.value)}
placeholder="A sentence is enough. Mention APIs, secrets, scopes, expected tool names."
placeholder="A sentence is enough. Mention which APIs you need, which scopes, what the AI client should be able to do."
/>
<div className="flex flex-wrap gap-1.5">
<p className="text-[12px] leading-relaxed text-[--color-fg-subtle]">
Next step we&apos;ll show you exactly which tools we&apos;ll expose and which credentials we need from you.
</p>
<div className="flex flex-wrap gap-1.5 pt-1">
{EXAMPLE_PROMPTS.map((p) => (
<button
type="button"
key={p}
onClick={() => setPrompt(p)}
key={p.label}
onClick={() => setPrompt(p.text)}
className="rounded-full border border-[--color-border] bg-[--color-bg-subtle] px-2.5 py-1 text-[11.5px] text-[--color-fg-muted] transition-colors hover:border-[--color-border-strong] hover:text-[--color-fg]"
>
{p}
{p.label}
</button>
))}
</div>
@@ -110,7 +195,7 @@ export default function NewServerPage() {
/>
</div>
<div className="space-y-1.5">
<Label htmlFor="slug" hint="subdomain / id">Slug</Label>
<Label htmlFor="slug" hint="becomes subdomain / id">Slug</Label>
<Input
id="slug"
value={slug}
@@ -120,58 +205,128 @@ export default function NewServerPage() {
</div>
</div>
<div className="space-y-2">
<Label hint="environment variables, encrypted at rest">Secrets</Label>
<div className="space-y-2">
{secretRows.map((row, i) => (
<div key={i} className="grid grid-cols-[1fr_1fr_auto] gap-2">
<Input
placeholder="NOTION_API_KEY"
value={row.key}
onChange={(e) => {
const next = [...secretRows];
next[i] = { key: e.target.value.toUpperCase(), value: row.value };
setSecretRows(next);
}}
/>
<Input
placeholder="secret_xxx"
type="password"
value={row.value}
onChange={(e) => {
const next = [...secretRows];
next[i] = { key: row.key, value: e.target.value };
setSecretRows(next);
}}
/>
<Button
variant="ghost"
size="md"
onClick={() =>
setSecretRows((rs) => (rs.length > 1 ? rs.filter((_, j) => j !== i) : rs))
}
>
Remove
</Button>
</div>
))}
<Button
variant="ghost"
size="sm"
onClick={() => setSecretRows((rs) => [...rs, { key: '', value: '' }])}
>
+ Add secret
</Button>
</div>
</div>
{error && <p className="text-[12.5px] text-[--color-danger]">{error}</p>}
<div className="flex justify-end gap-2">
<Button variant="ghost" size="md" onClick={() => router.push('/servers')}>
Cancel
</Button>
<Button variant="primary" size="md" onClick={submit}>
<Button variant="primary" size="md" onClick={analyze}>
Analyze
</Button>
</div>
</div>
)}
{step === 'analyzing' && (
<div className="mt-10 panel p-8 text-center">
<Loader2 className="mx-auto animate-spin text-[--color-fg-muted]" size={20} />
<p className="mt-4 text-[13px]">Analyzing your prompt</p>
<p className="mt-1 text-[12px] text-[--color-fg-subtle]">
Claude Opus 4.7 is parsing the spec. Usually 2040 seconds.
</p>
</div>
)}
{step === 'confirm' && preview && (
<div className="mt-7 space-y-6">
<div className="panel p-4">
<div className="flex items-baseline justify-between">
<h2 className="text-[14px] font-semibold tracking-tight">Confirm what we&apos;ll build</h2>
<span className="mono text-[10.5px] text-[--color-fg-subtle]">
spec via {preview.source}
</span>
</div>
<p className="mt-1 text-[12.5px] text-[--color-fg-muted]">{preview.spec.description}</p>
</div>
<div>
<h3 className="text-[13px] font-semibold tracking-tight">
Tools ({preview.spec.tools.length})
</h3>
<div className="mt-2 space-y-2">
{preview.spec.tools.map((tool) => (
<div key={tool.name} className="panel p-3">
<div className="flex items-baseline gap-2">
<span className="mono text-[13px] font-semibold">{tool.name}</span>
<span className="mono text-[10.5px] text-[--color-fg-subtle]">
{Object.keys(tool.inputSchema).length} param
{Object.keys(tool.inputSchema).length === 1 ? '' : 's'}
</span>
</div>
<p className="mt-1 text-[12.5px] text-[--color-fg-muted]">{tool.description}</p>
{Object.keys(tool.inputSchema).length > 0 && (
<div className="mt-2">
<CodeBlock
label="input schema"
code={JSON.stringify(tool.inputSchema, null, 2)}
/>
</div>
)}
</div>
))}
</div>
</div>
{preview.spec.requiredSecrets.length > 0 ? (
<div>
<h3 className="text-[13px] font-semibold tracking-tight">
Credentials we need
</h3>
<p className="mt-1 text-[12px] leading-relaxed text-[--color-fg-muted]">
These will be AES-256-GCM encrypted at rest and injected as environment variables
into your server&apos;s container at runtime.
</p>
<div className="mt-3 space-y-2">
{preview.spec.requiredSecrets.map((key) => (
<div key={key} className="space-y-1">
<Label htmlFor={`secret-${key}`}>
<span className="mono">{key}</span>
</Label>
<Input
id={`secret-${key}`}
type="password"
value={secretValues[key] ?? ''}
onChange={(e) =>
setSecretValues((s) => ({ ...s, [key]: e.target.value }))
}
placeholder="paste credential value"
/>
</div>
))}
</div>
</div>
) : (
<div className="panel p-3">
<p className="text-[12.5px] text-[--color-fg-muted]">
No credentials needed. This server runs self-contained.
</p>
</div>
)}
{preview.spec.scopes.length > 0 && (
<div>
<h3 className="text-[13px] font-semibold tracking-tight">OAuth scopes</h3>
<div className="mt-2 flex flex-wrap gap-1.5">
{preview.spec.scopes.map((s) => (
<span
key={s}
className="mono rounded-full border border-[--color-border] bg-[--color-bg-subtle] px-2 py-0.5 text-[11px] text-[--color-fg-muted]"
>
{s}
</span>
))}
</div>
</div>
)}
{error && <p className="text-[12.5px] text-[--color-danger]">{error}</p>}
<div className="flex justify-end gap-2">
<Button variant="ghost" size="md" onClick={() => setStep('prompt')}>
Back
</Button>
<Button variant="primary" size="md" onClick={build}>
Build server
</Button>
</div>
@@ -220,9 +375,7 @@ export default function NewServerPage() {
Drop this into your client. OAuth handshake runs automatically on first use.
</p>
<div className="mt-3">
<InstallSnippets
input={{ name, slug, publicUrl: result.publicUrl }}
/>
<InstallSnippets input={{ name, slug, publicUrl: result.publicUrl }} />
</div>
</div>
)}

View File

@@ -0,0 +1,178 @@
'use client';
import { useEffect, useState } from 'react';
import { apiFetch } from '@/lib/api';
import { Button } from '@/components/ui/button';
interface Org {
id: string;
slug: string;
name: string;
plan: string;
monthlyCallQuota: number;
callsThisPeriod: number;
periodStartsAt: string;
createdAt: string;
}
interface Member {
id: string;
userId: string;
email: string;
name: string | null;
role: string;
createdAt: string;
}
export default function SettingsPage() {
const [org, setOrg] = useState<Org | null>(null);
const [members, setMembers] = useState<Member[]>([]);
const [err, setErr] = useState<string | null>(null);
useEffect(() => {
apiFetch<{ org: Org; members: Member[] }>('/v1/me/org')
.then((r) => {
setOrg(r.org);
setMembers(r.members);
})
.catch((e) => setErr((e as Error).message));
}, []);
if (err?.includes('401')) {
if (typeof window !== 'undefined') window.location.href = '/login';
return null;
}
return (
<div className="mx-auto max-w-5xl px-6 py-8">
<div>
<h1 className="text-[22px] font-semibold tracking-tight">Settings</h1>
<p className="mt-1 text-[13px] text-[--color-fg-muted]">
Organization, plan, members, billing.
</p>
</div>
{!org && <div className="mt-6 text-[12.5px] text-[--color-fg-muted]">Loading</div>}
{org && (
<div className="mt-6 grid gap-4 md:grid-cols-2">
<Card title="Organization">
<Row label="Name" value={org.name} />
<Row label="Slug" value={org.slug} mono />
<Row label="Created" value={new Date(org.createdAt).toLocaleString()} />
<Row label="Organization ID" value={org.id} mono small />
</Card>
<Card title="Plan & usage">
<Row label="Plan" value={org.plan.charAt(0).toUpperCase() + org.plan.slice(1)} />
<Row
label="Calls this period"
value={`${org.callsThisPeriod.toLocaleString()} / ${org.monthlyCallQuota.toLocaleString()}`}
/>
<Row
label="Period started"
value={new Date(org.periodStartsAt).toLocaleString()}
/>
<div className="mt-3">
<Button variant="secondary" size="sm" disabled>
Manage billing (Sprint 4)
</Button>
</div>
</Card>
<Card title="Members" className="md:col-span-2">
<table className="w-full text-[12.5px]">
<thead className="border-b border-[--color-border] text-[--color-fg-subtle]">
<tr>
<th className="py-2 text-left font-medium">Email</th>
<th className="py-2 text-left font-medium">Name</th>
<th className="py-2 text-left font-medium">Role</th>
<th className="py-2 text-left font-medium">Joined</th>
</tr>
</thead>
<tbody>
{members.map((m) => (
<tr key={m.id} className="border-b border-[--color-border] last:border-0">
<td className="py-2.5 mono">{m.email}</td>
<td className="py-2.5 text-[--color-fg-muted]">{m.name ?? '—'}</td>
<td className="py-2.5">
<span className="mono rounded-full border border-[--color-border] bg-[--color-bg-subtle] px-2 py-0.5 text-[11px]">
{m.role}
</span>
</td>
<td className="py-2.5 text-[--color-fg-muted]">
{new Date(m.createdAt).toLocaleDateString()}
</td>
</tr>
))}
</tbody>
</table>
<div className="mt-3">
<Button variant="secondary" size="sm" disabled>
Invite member (Team plan)
</Button>
</div>
</Card>
<Card title="API keys">
<p className="text-[12.5px] text-[--color-fg-muted]">
Programmatic access for the upcoming <span className="mono">bmm</span> CLI.
</p>
<div className="mt-3">
<Button variant="secondary" size="sm" disabled>
Generate key (Sprint 4)
</Button>
</div>
</Card>
<Card title="Encryption">
<Row label="Secret storage" value="AES-256-GCM" mono />
<Row label="Key source" value="env (SECRETS_ENCRYPTION_KEY)" mono />
<p className="mt-3 text-[12px] leading-relaxed text-[--color-fg-subtle]">
Secrets are encrypted before write to Postgres, decrypted only at the moment of
container env injection. Plaintext is never logged.
</p>
</Card>
</div>
)}
</div>
);
}
function Card({
title,
children,
className,
}: {
title: string;
children: React.ReactNode;
className?: string;
}) {
return (
<div className={`panel p-4 ${className ?? ''}`}>
<div className="text-[11px] uppercase tracking-wider text-[--color-fg-subtle]">{title}</div>
<div className="mt-3 space-y-1.5">{children}</div>
</div>
);
}
function Row({
label,
value,
mono,
small,
}: {
label: string;
value: string;
mono?: boolean;
small?: boolean;
}) {
return (
<div className="flex items-baseline justify-between gap-3 text-[12.5px]">
<span className="text-[--color-fg-subtle]">{label}</span>
<span className={`${mono ? 'mono' : ''} ${small ? 'text-[11px]' : ''} text-[--color-fg]`}>
{value}
</span>
</div>
);
}