Fix/vercel runtime routing

.env.example

@@ -1,12 +1,24 @@
 # Firebase Web SDK config (public keys, but keep local env private)
-FIREBASE_API_KEY=your_api_key
-FIREBASE_AUTH_DOMAIN=your_project.firebaseapp.com
-FIREBASE_DATABASE_URL=https://your_project-default-rtdb.firebaseio.com
-FIREBASE_PROJECT_ID=your_project_id
-FIREBASE_STORAGE_BUCKET=your_project.firebasestorage.app
-FIREBASE_MESSAGING_SENDER_ID=your_messaging_sender_id
-FIREBASE_APP_ID=your_app_id
-FIREBASE_MEASUREMENT_ID=your_measurement_id
-
-# Optional
+# Note: All VITE_ prefixed variables are exposed to client-side code
+VITE_FIREBASE_API_KEY=your_api_key
+VITE_FIREBASE_AUTH_DOMAIN=your_project.firebaseapp.com
+VITE_FIREBASE_DATABASE_URL=https://your_project-default-rtdb.firebaseio.com
+VITE_FIREBASE_PROJECT_ID=your_project_id
+VITE_FIREBASE_STORAGE_BUCKET=your_project.firebasestorage.app
+VITE_FIREBASE_MESSAGING_SENDER_ID=your_messaging_sender_id
+VITE_FIREBASE_APP_ID=your_app_id
+VITE_FIREBASE_MEASUREMENT_ID=your_measurement_id
+
+# Vercel Blob (used by /upload and /api/upload)
+# Get this token from Vercel Dashboard > Storage > Blob > your_store > Settings
+BLOB_READ_WRITE_TOKEN=vercel_blob_rw_xxxxxxxxxxxx
+
+# Server config
 PORT=4001
+
+# Required for encrypted admin secrets storage/rotation
+ADMIN_SECRETS_KEY=replace_with_a_long_random_secret
+
+# Gemini API key for server-side chatbot orchestration
+# Keep this server-side. Do not expose it to the browser.
+GEMINI_API_KEY=your_gemini_api_key

.github/copilot-instructions.md

@@ -0,0 +1,53 @@
+# Project Guidelines
+
+## Repository Overview
+- This is a React + Vite portfolio, blog, and admin project.
+- Entry points and routing live in `src/main.jsx` and `src/App.jsx`.
+- Main routes:
+  - `/` and `/home`: portfolio (`src/Pages/Portfolio/Portfolio.jsx`)
+  - `/blog`: public blog (`src/Pages/Blog/Blog.jsx`)
+  - `/admin`: admin dashboard/auth (`src/Pages/Admin/`)
+- Backend runtime and API endpoints are in `server.js`.
+
+## Code Style
+- Keep implementation framework-consistent with existing React function components and hooks.
+- Prefer small, direct state updates and existing component patterns.
+- Preserve existing naming and data shape contracts in hooks and API responses.
+- Reuse existing CSS variables and section patterns from `src/index.css` and page styles.
+
+## Architecture
+- Portfolio UI behavior belongs in `src/Pages/` and `src/Components/`.
+- Shared data access belongs in `src/hooks/useBlogPosts.js`.
+- Auth state belongs in `src/contexts/AuthContext.jsx`.
+- Chatbot UI adapter belongs in `src/Components/Chatbot/Chatbot.jsx`.
+- Chatbot orchestration, memory, and Gemini runtime belong in `server.js` and `chatbot/`.
+- Keep server responsibilities focused on config serving, chatbot endpoints, upload endpoint, and static hosting.
+
+## Build And Run
+- Install dependencies: `npm install`
+- Local development (frontend + backend): `npm run dev`
+- Backend only: `npm start`
+- Lint/type-check: `npm run lint`
+- Runtime smoke test: `npm test`
+- Build production assets: `npm run build`
+
+## Conventions
+- Keep Firebase web config flow intact via `/firebase-config.js` generated by `server.js`.
+- Keep Realtime Database compatibility for `blogPosts`, `portfolioProjects`, and `portfolioCredentials`.
+- Preserve safe rendering and escaping patterns in blog/admin/chatbot flows.
+- Keep chatbot prompts externalized in `chatbot/prompts/` (do not hardcode in React components).
+
+## Environment And Pitfalls
+- Local development requires `.env` values matching `.env.example`.
+- Uploads require `BLOB_READ_WRITE_TOKEN`.
+- Optional Firebase Admin features require `FIREBASE_SERVICE_ACCOUNT` or `serviceAccountKey.json`.
+- Chatbot generation requires `GEMINI_API_KEY`.
+- Use HTTP-served pages (`npm run dev` or `npm start`), not `file://`.
+
+## Key References
+- `README.md`
+- `server.js`
+- `chatbot/ARCHITECTURE.md`
+- `chatbot/STAGE_1_TODO.md`
+- `chatbot/api/contract.md`
+- `src/Components/Chatbot/Chatbot.jsx`

.github/prompts/audit.prompt.md

@@ -0,0 +1,18 @@
+---
+name: audit
+description: "Use when: you need to audit and update project dependencies"
+argument-hint: "Optional: specify a package name to audit a specific dependency"
+---
+
+# Goal: Audit and update project dependencies
+
+Your goal is to check project dependencies, check for lint errors, check outdated dependencies and update them.
+
+1. Run `npm audit` to check for vulnerabilities.
+2. Run `npm audit fix` to fix vulnerabilities.
+3. Run `npm audit fix --force` if no. 2 doesn't fix vulnerabilities to disable Recommended protections.
+4. Run `npm outdated` to check for outdated dependencies.
+5. Update dependencies using `npm update` or manually update the version in `package.json` and run `npm install`.
+6. Run `npm run lint` to check for lint errors and fix them.
+7. Run `npm run build` to ensure the project builds successfully after updates.
+8. Run tests if available to ensure nothing is broken after updates.

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+---
+name: CI
+
+"on":
+  push:
+    branches:
+      - main
+      - master
+      - develop
+      - 'feature/**'
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Smoke test
+        run: npm test
+
+      - name: Build
+        run: npm run build

.gitignore

@@ -1,4 +1,9 @@
 node_modules/
+dist/
+coverage/
+*.log
+.vercel/
+.DS_Store
 serviceAccountKey.json
 firebase-config.js
 .env

.vscode/settings.json

@@ -0,0 +1,5 @@
+{
+  "css.lint.unknownAtRules": "ignore",
+  "scss.lint.unknownAtRules": "ignore",
+  "less.lint.unknownAtRules": "ignore"
+}