Complete dashboard redesign and onboarding overhaul

.env.local.example

@@ -44,22 +44,20 @@ WHOOP_CLIENT_ID=
 # Apple Health is file-import — no credentials at all.
 
 # ── CAMS atmosphere relay (powers the Sun Data Source `auto` mode) ──
-# When set, the local /api/proxy?meteo=cams handler forwards browser
-# requests to the maintainer-hosted (or self-run) getbased-uvdata
-# instance, which fronts CAMS Atmospheric Composition Forecasts and
-# merges Open-Meteo's hourly clouds/temp/UVI into a single response.
-# The bearer is injected server-side so it never reaches the browser.
+# The local /api/proxy?meteo=cams handler forwards browser requests to
+# getbased-uvdata, which fronts CAMS Atmospheric Composition Forecasts
+# and merges Open-Meteo's hourly clouds/temp/UVI into one response.
+# By default it uses the maintainer-hosted instance:
+# https://uvdata.getbased.health
+# The hosted instance requires UVDATA_BEARER. The bearer is injected
+# server-side, so it never reaches the browser.
 #
-# When unset, /api/proxy returns 503 and the app's auto-fallback chain
-# moves on to Open-Meteo for clouds/temp/UVI — the user still gets data,
-# just without the CAMS-quality ozone/aerosol fields (`ozoneDU` reads
-# null, confidence drops from ~0.95 to ~0.65).
-#
-# UVDATA_UPSTREAM  — base URL of the getbased-uvdata server.
-#                    Production: https://uvdata.getbased.health
-#                    Self-host:  https://your-uvdata.example.com
+# UVDATA_UPSTREAM  — optional base URL override for the getbased-uvdata server.
+#                    Leave blank for the hosted default above.
+#                    Self-host example: https://your-uvdata.example.com
 # UVDATA_BEARER    — bearer token registered in the uvdata server's
-#                    GETBASED_UVDATA_BEARER env. Treat like a credential.
+#                    GETBASED_UVDATA_BEARER env. Required for the hosted
+#                    default. Treat like a credential.
 
 UVDATA_UPSTREAM=
 UVDATA_BEARER=

api/proxy.js

@@ -4,6 +4,8 @@
 
 export const config = { runtime: 'edge' };
 
+const DEFAULT_UVDATA_UPSTREAM = 'https://uvdata.getbased.health';
+
 // Allowlisted provider URL prefixes — these always pass without further
 // checks. User-configured endpoints (Custom API, decentralized Routstr
 // nodes) are allowed too, but only over HTTPS with a non-private host.
@@ -510,20 +512,33 @@ async function handlePolarTokenRequest(payload, req) {
   }
 }
 
-// CAMS atmosphere relay → getbased-uvdata (the maintainer-run instance
-// behind UVDATA_UPSTREAM env). The proxy injects the bearer server-side
-// so the token never reaches the browser. Hosted-only path; self-host
-// users go straight via the `selfhost` Sun Data Source mode instead.
+// CAMS atmosphere relay → getbased-uvdata. Defaults to the maintainer-run
+// instance so Sun Data Source `auto` is genuinely CAMS-first out of the box.
+// UVDATA_UPSTREAM can override the upstream, and UVDATA_BEARER is injected
+// server-side when configured so the token never reaches the browser.
+// Self-host users can also go straight via the `selfhost` Sun Data Source
+// mode instead.
 //
 // env:
-//   UVDATA_UPSTREAM — base URL, e.g. https://uvdata.getbased.health
+//   UVDATA_UPSTREAM — optional base URL override, e.g. https://your-uvdata.example.com
 //   UVDATA_BEARER   — token to send on Authorization header
 async function handleCamsRelay(payload, req) {
-  const upstream = (typeof process !== 'undefined' && process.env?.UVDATA_UPSTREAM)
-    ? process.env.UVDATA_UPSTREAM.replace(/\/+$/, '') : '';
+  const configuredUpstream = (typeof process !== 'undefined' && process.env?.UVDATA_UPSTREAM)
+    ? process.env.UVDATA_UPSTREAM.replace(/\/+$/, '')
+    : '';
+  const upstream = configuredUpstream || DEFAULT_UVDATA_UPSTREAM;
+  const bearer = (typeof process !== 'undefined' && process.env?.UVDATA_BEARER) ? process.env.UVDATA_BEARER : '';
   if (!upstream) {
     return new Response(JSON.stringify({
-      error: 'CAMS relay not configured on this deploy. Set UVDATA_UPSTREAM env or use the self-host Sun Data Source mode.',
+      error: 'CAMS relay upstream is empty. Set UVDATA_UPSTREAM or switch Sun Data Source to Open-Meteo/manual.',
+    }), {
+      status: 503,
+      headers: { ...corsHeaders(req), 'Content-Type': 'application/json' },
+    });
+  }
+  if (!configuredUpstream && !bearer) {
+    return new Response(JSON.stringify({
+      error: 'CAMS hosted relay requires UVDATA_BEARER. Set UVDATA_BEARER for the hosted default, set UVDATA_UPSTREAM for your own relay, or switch Sun Data Source to Open-Meteo/manual.',
     }), {
       status: 503,
       headers: { ...corsHeaders(req), 'Content-Type': 'application/json' },
@@ -542,7 +557,6 @@ async function handleCamsRelay(payload, req) {
   if (time) qs.set('time', time);
   const url = `${upstream}/uv?${qs.toString()}`;
   const headers = { 'Accept': 'application/json' };
-  const bearer = (typeof process !== 'undefined' && process.env?.UVDATA_BEARER) ? process.env.UVDATA_BEARER : '';
   if (bearer) headers['Authorization'] = `Bearer ${bearer}`;
   try {
     const res = await fetch(url, { headers });