Supporter plan, cloud backend, and SEO pages (1.1.0)

.env.example

@@ -0,0 +1,62 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# IB EconGraph AI — environment variables
+#
+# Everything here is OPTIONAL. Without any of it the app runs fully free &
+# local (BYOK AI keys are entered in the UI, data lives in localStorage).
+# Configure these only if you want accounts, cloud sync, and the Supporter
+# plan on your own deployment. See docs/BACKEND_SETUP.md for the full guide.
+# ─────────────────────────────────────────────────────────────────────────────
+
+# ── Client (bundled into the frontend by Vite — safe to expose) ─────────────
+# Supabase project URL + publishable key (sb_publishable_…, Project Settings →
+# API Keys). Low-privilege, safe in the client bundle. Enables sign-in/sync/share.
+VITE_SUPABASE_URL=
+VITE_SUPABASE_PUBLISHABLE_KEY=
+
+# ── Server (Vercel project env vars — NEVER commit real values) ─────────────
+# Supabase secret key (sb_secret_…, Project Settings → API Keys). Bypasses RLS;
+# server only — Supabase rejects it if sent from a browser.
+SUPABASE_URL=
+SUPABASE_SECRET_KEY=
+
+# ── Hosted AI (Supporter plan) ──────────────────────────────────────────────
+# The server generates diagrams for supporters using ONE of three backends.
+# They are tried in the order below; the first one that is configured wins.
+#
+# 1) Vertex AI express mode: a single API key, no service account, so it works
+#    on serverless out of the box. Create one in the Google Cloud console under
+#    "Gemini Enterprise Agent Platform" (the 2026 rebrand of Vertex AI), express
+#    mode. NOTE: creating a Vertex API key requires a Google Cloud organization;
+#    a personal @gmail.com account with no org is blocked and should use (2).
+VERTEX_API_KEY=
+#
+# 2) Vertex AI with a project id (and optional location, default "global").
+#    Locally this authenticates with your gcloud Application Default
+#    Credentials: run `gcloud auth application-default login` once. On hosts
+#    without gcloud (e.g. Vercel), also paste a service-account key JSON as a
+#    single line into GOOGLE_SERVICE_ACCOUNT_JSON.
+GOOGLE_CLOUD_PROJECT=
+GOOGLE_CLOUD_LOCATION=global
+GOOGLE_SERVICE_ACCOUNT_JSON=
+#
+# 3) Gemini Developer API (Google AI Studio): the simplest fully-free option.
+#    Get a key at https://aistudio.google.com/apikey
+GEMINI_API_KEY=
+
+# Shared hosted-AI settings, applied to whichever backend above is active.
+HOSTED_AI_MONTHLY_LIMIT=150
+HOSTED_AI_MODEL=gemini-2.5-flash
+
+# Polar billing (https://polar.sh). Use POLAR_SERVER=sandbox while testing.
+POLAR_ACCESS_TOKEN=
+POLAR_WEBHOOK_SECRET=
+POLAR_PRODUCT_ID_MONTHLY=
+POLAR_PRODUCT_ID_YEARLY=
+POLAR_SERVER=production
+
+# Public URL of the deployment, used to pin checkout redirects to a canonical
+# domain. Optional: if left blank the server uses the incoming request's origin
+# (your real domain), which is correct for most setups. Set it only to force a
+# specific domain, e.g. when *.vercel.app preview aliases should redirect to
+# your primary URL. Example: https://your-app.vercel.app
+APP_URL=

.github/workflows/db-keepalive.yml

@@ -0,0 +1,50 @@
+name: DB keepalive
+
+# Supabase free-tier projects pause after 7 days of inactivity. This makes a
+# cheap read against the database every ~5 days to keep it awake, leaving a
+# safe margin under the 7-day pause window.
+#
+# Reuses the same repository secrets as the supporters workflow
+# (Settings, then Secrets and variables, then Actions):
+#   SUPABASE_URL         your Supabase project URL
+#   SUPABASE_SECRET_KEY  the Supabase secret key (sb_secret_...)
+
+on:
+  schedule:
+    # Runs on days 1,6,11,16,21,26,31 -> a gap of at most 5 days, always under 7.
+    - cron: '0 6 */5 * *'
+  workflow_dispatch: {}
+
+concurrency:
+  group: db-keepalive
+  cancel-in-progress: false
+
+jobs:
+  ping:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Ping the database
+        env:
+          SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
+          SUPABASE_SECRET_KEY: ${{ secrets.SUPABASE_SECRET_KEY }}
+        run: |
+          if [ -z "$SUPABASE_URL" ] || [ -z "$SUPABASE_SECRET_KEY" ]; then
+            echo "Supabase secrets are not set; nothing to ping."
+            exit 0
+          fi
+          # One-row read via PostgREST. The secret key bypasses RLS, so this is a
+          # trivial query that still counts as real database activity.
+          # Bound the request: without a timeout a hung connection would stall
+          # the job until GitHub's 6h default runner limit.
+          code=$(curl -s -o /dev/null -w '%{http_code}' \
+            --connect-timeout 15 --max-time 60 --retry 2 --retry-delay 5 \
+            "$SUPABASE_URL/rest/v1/profiles?select=id&limit=1" \
+            -H "apikey: $SUPABASE_SECRET_KEY" \
+            -H "Authorization: Bearer $SUPABASE_SECRET_KEY")
+          echo "Supabase responded: HTTP $code"
+          # 200 (rows) and 206 (partial content) both mean the query was served.
+          if [ "$code" != "200" ] && [ "$code" != "206" ]; then
+            echo "Unexpected status $code; keepalive may have failed."
+            exit 1
+          fi
+          echo "Keepalive ping OK."

.github/workflows/update-supporters.yml

@@ -0,0 +1,53 @@
+name: Update supporters
+
+# Refreshes the Supporters block in README.md from the database on a schedule.
+# Requires two repository secrets (Settings → Secrets and variables → Actions):
+#   SUPABASE_URL         — your Supabase project URL
+#   SUPABASE_SECRET_KEY  — the Supabase secret key (sb_secret_…)
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'   # every Monday at 06:00 UTC
+  workflow_dispatch: {}    # allow manual runs from the Actions tab
+
+permissions:
+  contents: write
+
+# Never run two updates at once.
+concurrency:
+  group: update-supporters
+  cancel-in-progress: false
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Don't leave a contents:write token in .git/config while `npm ci`
+          # runs arbitrary dependency install scripts. The push below passes
+          # the token explicitly instead.
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+      - run: npm ci
+      - name: Refresh supporters block
+        env:
+          SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
+          SUPABASE_SECRET_KEY: ${{ secrets.SUPABASE_SECRET_KEY }}
+        run: node scripts/update-supporters.mjs
+      - name: Commit if the README changed
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ -n "$(git status --porcelain README.md)" ]; then
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git add README.md
+            git commit -m "chore: refresh supporters list"
+            git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF_NAME}"
+          else
+            echo "No supporter changes to commit."
+          fi

.gitignore

@@ -32,3 +32,6 @@ lerna-debug.log*
 # OS files
 .DS_Store
 Thumbs.db
+.vercel
+.env*
+!.env.example