-deployment ready code done

.commandcode/taste/taste.md

@@ -3,4 +3,12 @@
 [cmd]: https://commandcode.ai/
 
 # frontend
-- Avoid React Compiler plugin (`@rolldown/plugin-babel` with `reactCompilerPreset`, needs Node 22+); use plain `@vitejs/plugin-react` compatible with the current Vite version and react-js transform. Confidence: 0.65
+- Avoid React Compiler plugin (`@rolldown/plugin-babel` with `reactCompilerPreset`, needs Node 22+); use plain `@vitejs/plugin-react` compatible with the current Vite version and react-js transform. Confidence: 0.65
+
+# workflow
+- Read AGENTS.md first (before inspecting the codebase) to understand project conventions before starting any task. Confidence: 0.65
+
+# deployment
+- Target Render for production deployment; keep the codebase production-ready and Render-compatible (Node >=20, proper start/build scripts, no hardcoded localhost CORS origins). Confidence: 0.55
+- For Render deployment, deploy backend as a Web Service and frontend as a separate Static Site (Option A), not as a single monolith service. Confidence: 0.60
+- Never commit API keys to render.yaml (it lives in git); use `sync: false` for real secrets, `generateValue: true` for auto-generated random secrets, and `fromService` (with `prefix`/`suffix`) for cross-service URLs — don't set `PORT` explicitly. Confidence: 0.65

.gitignore

@@ -1,2 +1,43 @@
-#Ignore vscode AI rules
-.github\instructions\codacy.instructions.md
+# Dependencies
+node_modules/
+.pnp/
+.pnp.js
+
+# Build outputs
+backend/dist/
+Frontend/dist/
+dist/
+build/
+*.tsbuildinfo
+
+# Env files
+.env
+.env.*
+!.env.example
+
+# Logs
+logs/
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+
+# Editor / OS
+.vscode/
+!.vscode/settings.json
+!.vscode/extensions.json
+.idea/
+.DS_Store
+Thumbs.db
+
+# Test artifacts
+coverage/
+.nyc_output/
+playwright-report/
+test-results/
+
+# Tooling caches
+.eslintcache
+.cache/
+.turbo/

Frontend/.env.example

@@ -0,0 +1,7 @@
+# Backend API base URL (must end with /api)
+# Local: http://localhost:3000/api
+# Production: https://<your-backend>.onrender.com/api
+VITE_BASE_API_URL=http://localhost:3000/api
+
+# Razorpay key id (public — safe to expose in the browser)
+VITE_RAZORPAY_KEY_ID=

Frontend/package.json

@@ -55,7 +55,6 @@
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.5",
-    "babel-plugin-react-compiler": "^1.0.0",
     "eslint": "^10.6.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "eslint-plugin-react-refresh": "^0.5.3",

backend/.env.example

@@ -2,6 +2,8 @@ NODE_ENV=development
 PORT=3000
 BASE_URL=http://localhost:3000
 FRONTEND_URL=http://localhost:5173
+# Comma-separated additional CORS origins (e.g. https://your-app.onrender.com)
+CORS_ORIGINS=
 
 MONGO_URL=mongodb://127.0.0.1:27017/dev64
 JWT_SECRET=

backend/package.json

@@ -1,12 +1,16 @@
 {
   "name": "Dev64 AI",
   "version": "1.0.0",
-  "main": "index.js",
+  "main": "dist/index.js",
+  "engines": {
+    "node": ">=20"
+  },
   "scripts": {
     "test": "vitest run",
     "test:watch": "vitest",
-    "dev": "npm run dev:backend",
-    "dev:backend": "nodemon"
+    "dev": "nodemon",
+    "build": "tsup",
+    "start": "node dist/index.js"
   },
   "keywords": [],
   "author": "",

backend/src/app.ts

@@ -1,4 +1,3 @@
-import path from "path";
 import express, { Request, Response } from "express";
 import cors from "cors";
 import cookieParser from "cookie-parser";
@@ -10,14 +9,22 @@ import passport from "./config/passport.config";
 
 const app = express();
 
+app.set("trust proxy", 1);
+
 app.use("/api/payments/webhook", express.raw({ type: "*/*" }));
 app.use(express.json({ limit: "10mb" }));
 app.use(cookieParser());
 app.use(express.urlencoded({ extended: true }));
 
+const corsOrigins = envConfig.CORS_ORIGINS
+  ? envConfig.CORS_ORIGINS.split(",").map((o) => o.trim()).filter(Boolean)
+  : envConfig.NODE_ENV === "production"
+    ? [envConfig.FRONTEND_URL]
+    : [envConfig.FRONTEND_URL, "http://localhost:5174"];
+
 app.use(
   cors({
-    origin: [envConfig.FRONTEND_URL, "http://localhost:5174"],
+    origin: corsOrigins,
     methods: ["GET", "POST", "PUT", "DELETE"],
     credentials: true,
   })
@@ -41,14 +48,6 @@ app.get(
 
 app.use("/api", routes);
 
-if (envConfig.NODE_ENV === "production") {
-  const clientPath = path.resolve(__dirname, "../../client/dist");
-  app.use(express.static(clientPath));
-  app.get(/^(?!\/api).*/, (req: Request, res: Response) => {
-    res.sendFile(path.join(clientPath, "index.html"));
-  });
-}
-
 app.use(errorHandler);
 
 export default app;

backend/src/config/env.config.ts

@@ -18,6 +18,7 @@ const envConfig = {
   GOOGLE_OAUTH_STATE_SECRET: getEnv("GOOGLE_OAUTH_STATE_SECRET"),
 
   FRONTEND_URL: getEnv("FRONTEND_URL"),
+  CORS_ORIGINS: process.env.CORS_ORIGINS,
 
   MORPH_API_KEY: getEnv("MORPH_API_KEY"),
   AI_CRDITS_API_KEY: getEnv("AI_CRDITS_API_KEY"),

render.yaml

@@ -0,0 +1,67 @@
+services:
+  - type: web
+    name: dev64-ai-backend
+    runtime: node
+    rootDir: backend
+    plan: starter
+    buildCommand: npm ci && npm run build
+    startCommand: npm start
+    healthCheckPath: /health
+    autoDeploy: true
+    envVars:
+      - key: NODE_ENV
+        value: production
+      - key: BASE_URL
+        fromService:
+          type: web
+          name: dev64-ai-backend
+          property: host
+      - key: FRONTEND_URL
+        sync: false
+      - key: CORS_ORIGINS
+        sync: false
+      - key: MONGO_URL
+        sync: false
+      - key: JWT_SECRET
+        generateValue: true
+      - key: JWT_EXPIRES_IN
+        value: 7d
+      - key: AI_CRDITS_API_KEY
+        sync: false
+      - key: MORPH_API_KEY
+        sync: false
+      - key: UPSTASH_BOX_API_KEY
+        sync: false
+      - key: GITHUB_CLIENT_ID
+        sync: false
+      - key: GITHUB_CLIENT_SECRET
+        sync: false
+      - key: GITHUB_OAUTH_STATE_SECRET
+        generateValue: true
+      - key: GITHUB_TOKEN_ENCRYPTION_KEY
+        generateValue: true
+      - key: GOOGLE_CLIENT_ID
+        sync: false
+      - key: GOOGLE_CLIENT_SECRET
+        sync: false
+      - key: GOOGLE_OAUTH_STATE_SECRET
+        generateValue: true
+      - key: RAZORPAY_KEY_ID
+        sync: false
+      - key: RAZORPAY_KEY_SECRET
+        sync: false
+      - key: RAZORPAY_WEBHOOK_SECRET
+        sync: false
+
+  - type: web
+    name: dev64-ai-frontend
+    runtime: static
+    rootDir: Frontend
+    buildCommand: npm ci && npm run build
+    staticPublishPath: ./dist
+    autoDeploy: true
+    envVars:
+      - key: VITE_BASE_API_URL
+        sync: false
+      - key: VITE_RAZORPAY_KEY_ID
+        sync: false