Design/editorial overhaul

.claude/launch.json

@@ -0,0 +1,27 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "dev",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["run", "dev"],
+      "port": 3000,
+      "autoPort": true
+    },
+    {
+      "name": "landing",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": [
+        "run",
+        "dev",
+        "--prefix",
+        "/Users/piyush/Projects/shadowailandingpage",
+        "--",
+        "--port",
+        "5180",
+        "--strictPort"
+      ],
+      "port": 5180
+    }
+  ]
+}

.env.local.example

@@ -5,6 +5,10 @@ NEXT_PUBLIC_SUPABASE_ANON_KEY=
 # Supabase Private
 SUPABASE_SERVICE_ROLE_KEY=
 
+# Supabase Proxy (set to "true" to route browser requests through your domain)
+# Use this if ISPs are blocking supabase.co (e.g. in India)
+NEXT_PUBLIC_SUPABASE_PROXY=true
+
 # Ollama
 NEXT_PUBLIC_OLLAMA_URL=http://localhost:11434
 
@@ -33,4 +37,54 @@ EMAIL_DOMAIN_WHITELIST=
 EMAIL_WHITELIST=
 
 # File size limit for uploads in bytes
-NEXT_PUBLIC_USER_FILE_SIZE_LIMIT=10485760
+NEXT_PUBLIC_USER_FILE_SIZE_LIMIT=10485760
+
+# Rate limiting (Upstash Redis REST)
+# Required in production - without these, rate limiting fails open.
+# Create a free Redis at https://upstash.com and paste the REST URL/TOKEN.
+UPSTASH_REDIS_REST_URL=
+UPSTASH_REDIS_REST_TOKEN=
+
+# Inngest signature verification
+# Required in production - protects /api/inngest from forged event payloads.
+# Grab the signing key from the Inngest dashboard → your app → Keys.
+INNGEST_SIGNING_KEY=
+
+# ── Billing / metering ──────────────────────────────────────────────────────
+# Token metering ALWAYS records usage (needs SUPABASE_SERVICE_ROLE_KEY above).
+# The hard 402 over-limit BLOCK is gated separately so you can launch
+# metering-only, validate the credit calibration against real usage, then turn
+# enforcement on with no redeploy. Default (unset) = record but never block.
+# Set to true/1/on/yes to enforce the cap.
+BILLING_ENFORCE=
+
+# Free-tier experiment paywall: free users get FREE_EXPERIMENT_LIMIT (lib/billing
+# /plans.ts, default 3) GENERATED designs, then must upgrade. Like BILLING_ENFORCE
+# this is count-only by default - set EXPERIMENT_PAYWALL=true/1/on/yes to actually
+# BLOCK a 4th design generation for free users (returns 402 EXPERIMENT_LIMIT).
+EXPERIMENT_PAYWALL=
+
+# ── RevenueCat (Web Billing) - required for paid plans + credit packs ────────
+# Until NEXT_PUBLIC_REVENUECAT_WEB_PUBLIC_KEY is set, the payment path stays
+# dormant (Free works; upgrades show "Coming soon"). See BILLING.md for the
+# RevenueCat dashboard setup (entitlements pro/max, products, offering, webhook).
+NEXT_PUBLIC_REVENUECAT_WEB_PUBLIC_KEY=
+NEXT_PUBLIC_REVENUECAT_PRO_PACKAGE=
+NEXT_PUBLIC_REVENUECAT_MAX_PACKAGE=
+NEXT_PUBLIC_REVENUECAT_CREDITS_PACKAGE=
+NEXT_PUBLIC_REVENUECAT_PORTAL_URL=
+# Server: must equal the Authorization header set on the RevenueCat webhook.
+REVENUECAT_WEBHOOK_AUTH=
+# Server: JSON map of one-time credit-pack product id → raw token count,
+# e.g. {"credits_20k":20000000}. Required for credit packs to grant anything.
+REVENUECAT_CREDIT_PRODUCTS=
+
+# --- Influencer affiliate / creator program --------------------------------
+# Shared bearer secret for the operator-only admin endpoints
+# (POST /api/admin/affiliate to mint a creator code, POST /api/admin/comp to
+# grant a comp Max plan). Fail-closed: if unset, those endpoints reject all
+# calls. Generate a long random value and keep it secret.
+ADMIN_API_SECRET=
+# Public site origin used to build creator share links (e.g.
+# https://shadowai.work). Falls back to the request origin if unset.
+NEXT_PUBLIC_SITE_URL=

.firebaserc

@@ -0,0 +1,5 @@
+{
+  "projects": {
+    "default": "shadowai-adcf7"
+  }
+}

.github/workflows/ci.yml

@@ -0,0 +1,102 @@
+name: CI
+
+# Release gate for the core flows. Runs on every PR and on pushes to the
+# main + active design branches. Blocks merges if type-check, lint, the test
+# suite (incl. the design-pipeline guard in __tests__/design/pipeline.test.ts),
+# or the production build break - so create-design → literature → hypotheses →
+# design → chat-context can't silently regress.
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - design/editorial-overhaul
+
+# Cancel superseded runs on the same ref to save CI minutes.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: type-check · lint · test · build
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      # `next-env.d.ts` is gitignored (Next.js regenerates it on build), and it
+      # is what pulls in `next/image-types/global` - the declarations that make
+      # `import x from "@/public/foo.png"` type-check. Since this job runs
+      # type-check BEFORE build, the file does not exist yet and every image
+      # import fails with TS2307. It passes on a developer machine only because
+      # a previous build left the file behind, which is exactly the kind of
+      # "works locally" divergence that had main red for weeks. Write the file
+      # Next would generate, verbatim, before type-checking.
+      - name: Generate Next.js type references
+        run: |
+          cat > next-env.d.ts <<'TYPES'
+          /// <reference types="next" />
+          /// <reference types="next/image-types/global" />
+
+          // NOTE: This file should not be edited
+          // see https://nextjs.org/docs/app/building-your-application/configuring/typescript for more information.
+          TYPES
+
+      # Deterministic, env-free gates - catch the regressions that have bitten
+      # the design pipeline (types, wiring, dropped fields, bad merges).
+      - name: Type check
+        run: npm run type-check
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Test
+        run: npm test
+
+      # Production build - catches issues tsc can't (e.g. edge-runtime bundling).
+      #
+      # `next build` collects page data for every API route, which imports each
+      # route's module graph and runs its top-level initializers. Several of
+      # those throw outright when their key is absent (the SerpApi client is the
+      # loudest), so the original assumption here - that "the build reads real
+      # secrets only at request time" - does not hold, and the build died in a
+      # clean checkout. These placeholders exist purely to get those
+      # initializers past construction; nothing is called, so the values are
+      # never used for anything. Real credentials still belong in the runtime
+      # environment, not here.
+      - name: Build
+        run: npm run build
+        env:
+          # Server-side keys whose clients construct at module load.
+          SERPAPI_API_KEY: "placeholder-serpapi-key"
+          SUPABASE_SERVICE_ROLE_KEY: "placeholder-service-role-key"
+          AZURE_OPENAI_ENDPOINT: "https://placeholder.openai.azure.com"
+          AZURE_OPENAI_KEY: "placeholder-azure-key"
+          AZURE_OPENAI_API_KEY: "placeholder-azure-key"
+          AZURE_OPENAI_DEPLOYMENT: "placeholder-deployment"
+          AZURE_OPENAI_DESIGN_DEPLOYMENT: "placeholder-deployment"
+          OPENAI_API_KEY: "placeholder-openai-key"
+          ANTHROPIC_API_KEY: "placeholder-anthropic-key"
+          RESEND_API_KEY: "placeholder-resend-key"
+          INNGEST_SIGNING_KEY: "signkey-prod-placeholder"
+          INNGEST_EVENT_KEY: "placeholder-event-key"
+          FIREBASE_PROJECT_ID: "placeholder-project"
+          FIREBASE_CLIENT_EMAIL: "placeholder@placeholder.iam.gserviceaccount.com"
+          FIREBASE_PRIVATE_KEY: "-----BEGIN PRIVATE KEY-----\nplaceholder\n-----END PRIVATE KEY-----\n"
+          NEXT_PUBLIC_SUPABASE_URL: "https://placeholder.supabase.co"
+          NEXT_PUBLIC_SUPABASE_ANON_KEY: "placeholder-anon-key"
+          NEXT_PUBLIC_FIREBASE_API_KEY: "placeholder"
+          NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN: "placeholder.firebaseapp.com"
+          NEXT_PUBLIC_FIREBASE_PROJECT_ID: "placeholder"
+          NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET: "placeholder.appspot.com"
+          NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID: "0000000000"
+          NEXT_PUBLIC_FIREBASE_APP_ID: "1:0:web:0"

.github/workflows/nightly-qa.yml

@@ -0,0 +1,98 @@
+name: Nightly QA
+
+# Full production health check: can a person sign up, sign in, create a design,
+# and does the science pipeline still produce papers, hypotheses, a design and
+# a report? Runs against the live deployment, because a health check that
+# passes on localhost while production is down is worse than none.
+on:
+  schedule:
+    # 02:30 UTC == 08:00 IST. Off-peak for Azure quota, and the result is
+    # waiting in the inbox at the start of the working day.
+    - cron: "30 2 * * *"
+  workflow_dispatch:
+    inputs:
+      base_url:
+        description: "Deployment to test (defaults to production)"
+        required: false
+        default: ""
+      suite:
+        description: "Which projects to run"
+        required: false
+        default: "all"
+        type: choice
+        options: ["all", "smoke"]
+      # "smoke" runs everything except the expensive AI pipeline.
+
+# Never let two nightly runs overlap - they share one QA account and workspace.
+concurrency:
+  group: nightly-qa
+  cancel-in-progress: false
+
+jobs:
+  qa:
+    name: Production health check
+    runs-on: ubuntu-latest
+    # The pipeline project alone can run 25+ minutes; this is the hard stop.
+    timeout-minutes: 75
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Playwright Chromium
+        run: npx playwright install --with-deps chromium
+
+      - name: Run QA suite
+        id: qa
+        # Keep going on failure: the digest step below is the whole point, and
+        # it must run precisely when the tests did NOT pass.
+        continue-on-error: true
+        env:
+          CI: "true"
+          E2E_BASE_URL: ${{ github.event.inputs.base_url || vars.E2E_BASE_URL || 'https://app.shadowai.work' }}
+          E2E_EMAIL: ${{ secrets.E2E_EMAIL }}
+          E2E_PASSWORD: ${{ secrets.E2E_PASSWORD }}
+          E2E_SIGNUP_DOMAIN: ${{ vars.E2E_SIGNUP_DOMAIN || 'shadowai.work' }}
+          NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.E2E_SUPABASE_URL }}
+          SUPABASE_SERVICE_ROLE_KEY: ${{ secrets.SUPABASE_SERVICE_ROLE_KEY }}
+        run: |
+          if [ "${{ github.event.inputs.suite }}" = "smoke" ]; then
+            npx playwright test --config e2e/playwright.config.ts --project=public --project=smoke
+          else
+            npx playwright test --config e2e/playwright.config.ts
+          fi
+
+      - name: Upload Playwright report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: |
+            playwright-report/
+            e2e-results.json
+          retention-days: 14
+
+      - name: Email the digest
+        if: always()
+        env:
+          RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
+          QA_REPORT_TO: ${{ secrets.QA_REPORT_TO }}
+          EMAIL_FROM_ADDRESS: ${{ vars.EMAIL_FROM_ADDRESS }}
+          E2E_BASE_URL: ${{ github.event.inputs.base_url || vars.E2E_BASE_URL || 'https://app.shadowai.work' }}
+          GITHUB_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: node e2e/reporter/send-digest.mjs e2e-results.json
+
+      # The digest has been sent by now, so it is safe to fail the job and turn
+      # the Actions badge red.
+      - name: Fail the job if any check failed
+        if: steps.qa.outcome != 'success'
+        run: |
+          echo "::error::Nightly QA failed - see the emailed digest or the playwright-report artefact."
+          exit 1

.gitignore

@@ -44,3 +44,13 @@ sw.js
 sw.js.map
 workbox-*.js
 workbox-*.js.map
+
+# Supabase Studio scratch (local-only SQL snippets the IDE saves)
+supabase/snippets/
+.env*
+
+# Nightly QA (Playwright) artefacts
+e2e/.auth/
+playwright-report/
+e2e-results.json
+test-results/

.vscode/launch.json

@@ -0,0 +1,15 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "type": "chrome",
+            "request": "launch",
+            "name": "Launch Chrome against localhost",
+            "url": "http://localhost:8080",
+            "webRoot": "${workspaceFolder}"
+        }
+    ]
+}