# Lefty deployment

## Why `lefty.gabath.com` showed a directory listing / timeout

The project source must not be uploaded directly into a public document root. A Next.js project needs either a Next.js runtime (recommended: Vercel) or a generated static export. Uploading folders such as `app/`, `components/`, `data/` and `lib/` directly makes the web server serve the project directory instead of the application.

The production package deliberately does **not** bundle the Excel-derived private transaction JSON into the client. Personal data is imported into Supabase after authentication is configured.

## Recommended: Vercel

1. Create a Supabase project.
2. Run `supabase/migrations/001_init.sql` in Supabase SQL Editor.
3. Add production environment variables in Vercel:
   - `NEXT_PUBLIC_SUPABASE_URL`
   - `NEXT_PUBLIC_SUPABASE_ANON_KEY`
   - `NEXT_PUBLIC_LEFTY_DEMO_MODE=false`
4. Deploy the repository to Vercel.
5. Add `lefty.gabath.com` as a custom domain in Vercel and follow the displayed DNS instructions.
6. In Supabase Authentication > URL Configuration set:
   - Site URL: `https://lefty.gabath.com`
   - Redirect URL: `https://lefty.gabath.com/auth/callback/`
7. Register your Lefty user account, then copy its UUID from Supabase Authentication > Users.
8. For the one-time private workbook import, run locally only:

   ```bash
   NEXT_PUBLIC_SUPABASE_URL="..." \
   SUPABASE_SERVICE_ROLE_KEY="..." \
   LEFTY_IMPORT_USER_ID="..." \
   npm run import:data
   ```

   Never add `SUPABASE_SERVICE_ROLE_KEY` to `NEXT_PUBLIC_*` variables or expose it in the browser.

## Alternative: existing Apache/static hosting

A static export is supported if Node.js hosting is unavailable:

```bash
npm install
NEXT_PUBLIC_SUPABASE_URL="..." \
NEXT_PUBLIC_SUPABASE_ANON_KEY="..." \
NEXT_PUBLIC_LEFTY_DEMO_MODE=false \
npm run build:static
```

Upload **only the contents of `out/`** to the document root for `lefty.gabath.com`. Do not upload the source project. `public/.htaccess` is copied into the export to disable directory indexes and support folder-style routes such as `/auth/`.

## Verification checklist

After deployment:

- `/` redirects unauthenticated users to `/auth/` when Supabase is configured.
- `/auth/` loads without a 5xx or gateway timeout.
- No directory index is visible.
- Source folders (`/app/`, `/components/`, `/lib/`, `/supabase/`) are not publicly browseable.
- Login succeeds.
- Transactions appear only after login.
- Logout returns to `/auth/`.
- `manifest.webmanifest`, `/icon-192.png`, and `/icon-512.png` return successfully.
- Mobile bottom navigation and desktop sidebar render correctly.

You can also run the included smoke test after DNS/deployment is live:

```bash
npm run check:deployment
```