@wenathlan/cobaia 0.0.0-stage → 2.0.155

package/db.ts

@@ -0,0 +1,219 @@
+/**
+ * db.ts — the self-hosted sqlite runtime of the cobaia: the better-sqlite3
+ * bootstrap and the parameterized query helpers of the family site. Every
+ * statement is prepared and bound — no sql is ever assembled by string
+ * concatenation. The schema mirrors schema.prisma (the documentation of
+ * record) and the boot DDL is the idempotent seed-on-first-run: the tables
+ * exist after the first open, always. The platform gateway serves the same
+ * tables over HTTPS (GET/POST /api/v1/onboarding); no server route lives
+ * here.
+ */
+import { openStorageLane } from "@wenathlan/vault/storagelane";
+import { LABEL_MANIFEST, LABEL_REVISION } from "./labels";
+
+/** the correlated tables the runtime keeps (the family sync contract names). */
+export const tables = ["onboarding_states", "labels"] as const;
+
+/** the one storage lane of the site store (WAL, foreign keys, patient locks — the app's own file, the shared mechanism of the vault). */
+const lane = openStorageLane({ defaultFile: "./cobaia.db" });
+
+/** the one sqlite connection of the runtime (re-exported seat of the lane). */
+export const db = lane.db;
+
+/** the parameterized helpers of the site store (re-exported seats of the lane). */
+export const { execute, queryAll, queryOne } = lane;
+
+/** the parameter types the helpers bind (re-exported seat of the lane). */
+export type { SqlParam } from "@wenathlan/vault/storagelane";
+
+const SCHEMA = `
+CREATE TABLE IF NOT EXISTS onboarding_states (
+  id             INTEGER PRIMARY KEY AUTOINCREMENT,
+  visitor        TEXT NOT NULL UNIQUE,
+  introseen      INTEGER NOT NULL DEFAULT 0,
+  onboardingseen INTEGER NOT NULL DEFAULT 0,
+  updatedAt      TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE TABLE IF NOT EXISTS labels (
+  id         TEXT PRIMARY KEY,
+  text       TEXT NOT NULL,
+  revision   INTEGER NOT NULL DEFAULT 0,
+  updatedAt  TEXT NOT NULL DEFAULT (datetime('now')),
+  translated INTEGER NOT NULL DEFAULT 0
+);
+`;
+
+/** Creates the tables when they do not exist (idempotent, mirrors the prisma schema). */
+export function ensureSchema(): void {
+  lane.exec(SCHEMA);
+}
+
+// the boot seed: the tables exist from the first open, always (idempotent).
+ensureSchema();
+
+/** one row of the onboarding_states table (the entry-flow gates of a visitor). */
+export type OnboardingStateRow = {
+  id: number;
+  visitor: string;
+  introseen: number;
+  onboardingseen: number;
+  updatedAt: string;
+};
+
+/** the stage flags the entry flow consults, as booleans. */
+export type OnboardingFlags = { introseen: boolean; onboardingseen: boolean };
+
+/**
+ * Reads the onboarding stage flags of one visitor (parameterized; undefined
+ * before the first write). The browser accessor serves the same flags over
+ * GET /api/v1/onboarding.
+ *
+ * @param visitor the visitor key of the row.
+ * @returns the flags, or undefined when the visitor never wrote.
+ */
+export function getOnboardingState(visitor: string): OnboardingFlags | undefined {
+  const row = queryOne<Pick<OnboardingStateRow, "introseen" | "onboardingseen">>(
+    "SELECT introseen, onboardingseen FROM onboarding_states WHERE visitor = ?",
+    [visitor],
+  );
+  if (!row) return undefined;
+  return { introseen: row.introseen === 1, onboardingseen: row.onboardingseen === 1 };
+}
+
+/**
+ * Marks one onboarding stage seen for a visitor — idempotent seen-wins
+ * upsert (a stage seen anywhere stays seen), prepared and parameterized,
+ * never concatenated SQL.
+ *
+ * @param visitor the visitor key of the row.
+ * @param stage the stage the visitor just saw (or deliberately skipped).
+ * @returns the flags after the write.
+ */
+export function setOnboardingStage(visitor: string, stage: "intro" | "onboarding"): OnboardingFlags {
+  execute(
+    `INSERT INTO onboarding_states (visitor, introseen, onboardingseen, updatedAt)
+     VALUES (?, ?, ?, datetime('now'))
+     ON CONFLICT(visitor) DO UPDATE SET
+       introseen = MAX(introseen, excluded.introseen),
+       onboardingseen = MAX(onboardingseen, excluded.onboardingseen),
+       updatedAt = datetime('now')`,
+    [visitor, stage === "intro" ? 1 : 0, stage === "onboarding" ? 1 : 0],
+  );
+  return getOnboardingState(visitor) ?? { introseen: false, onboardingseen: false };
+}
+
+/* --------------------------------------------------------------------- */
+/* labels — the interface copy store                                      */
+/* --------------------------------------------------------------------- */
+
+/** one labels row: the interface copy store. the id is the page.widget.key
+ * path, the text rides the english source of truth (labels.ts), and the
+ * translated flag protects a runtime translation from the seed overwrite.
+ * the shape mirrors the browser seed rows in labels.ts one to one. */
+export type LabelRow = {
+  id: string;
+  text: string;
+  revision: number;
+  updatedAt: string;
+  translated?: boolean;
+};
+
+/** the raw labels projection sqlite answers (translated rides the 0/1 cell). */
+type LabelRowSql = {
+  id: string;
+  text: string;
+  revision: number;
+  updatedAt: string;
+  translated: number;
+};
+
+/** Projects one raw labels row into the stored label projection. */
+function labelRowOf(row: LabelRowSql): LabelRow {
+  return {
+    id: row.id,
+    text: row.text,
+    revision: row.revision,
+    updatedAt: row.updatedAt,
+    ...(row.translated === 1 ? { translated: true } : {}),
+  };
+}
+
+/**
+ * Writes one label row (idempotent upsert; the caller owns the revision),
+ * prepared and parameterized, never concatenated SQL.
+ *
+ * @param id the page.widget.key path of the label.
+ * @param text the surface text.
+ * @param revision the manifest revision the text carries.
+ * @param translated true when the row carries a runtime translation.
+ * @returns the stored label projection.
+ */
+export function saveLabel(id: string, text: string, revision: number, translated = false): LabelRow {
+  execute(
+    `INSERT INTO labels (id, text, revision, updatedAt, translated) VALUES (?, ?, ?, datetime('now'), ?)
+     ON CONFLICT(id) DO UPDATE SET
+       text = excluded.text,
+       revision = excluded.revision,
+       updatedAt = excluded.updatedAt,
+       translated = excluded.translated`,
+    [id, text, revision, translated ? 1 : 0],
+  );
+  const row = queryOne<LabelRowSql>("SELECT id, text, revision, updatedAt, translated FROM labels WHERE id = ?", [id]);
+  if (!row) throw new Error(`label "${id}" write did not land`);
+  return labelRowOf(row);
+}
+
+/**
+ * Reads one label row by its page.widget.key path.
+ *
+ * @param id the label id.
+ * @returns the row, or undefined when absent.
+ */
+export function readLabel(id: string): LabelRow | undefined {
+  const row = queryOne<LabelRowSql>("SELECT id, text, revision, updatedAt, translated FROM labels WHERE id = ?", [id]);
+  return row ? labelRowOf(row) : undefined;
+}
+
+/**
+ * Reads every label row of the store ordered by id.
+ *
+ * @returns the label rows.
+ */
+export function readAllLabels(): LabelRow[] {
+  return queryAll<LabelRowSql>("SELECT id, text, revision, updatedAt, translated FROM labels ORDER BY id ASC").map(
+    labelRowOf,
+  );
+}
+
+/**
+ * Ingests the english manifest of labels.ts into the labels table — the
+ * db-side twin of the browser seedLabels: idempotent, the changed rows
+ * refresh, and the translated rows stay protected from the overwrite.
+ *
+ * @returns the seeded and protected row counts.
+ */
+export function seedLabelRows(): { seeded: number; protected: number } {
+  ensureSchema();
+  const rows = new Map(readAllLabels().map((row) => [row.id, row]));
+  let seeded = 0;
+  let saved = 0;
+  for (const [id, text] of Object.entries(LABEL_MANIFEST)) {
+    const row = rows.get(id);
+    if (row === undefined || (row.translated !== true && row.text !== text)) {
+      saveLabel(id, text, LABEL_REVISION, row?.translated ?? false);
+      seeded += 1;
+    }
+    saved += 1;
+  }
+  return { seeded, protected: saved - seeded };
+}
+
+/* the copy law rides the db boot: the label seed ingests the english manifest
+ * of labels.ts beside the schema (the interface strings land in the store,
+ * the translated rows protected from the overwrite). best effort: a sealed
+ * store never blocks the boot, the manifest always answers the wingets. */
+try {
+  seedLabelRows();
+} catch {
+  /* the manifest answers; the store catches up on the next boot */
+}

package/devthink.toml

@@ -0,0 +1,5 @@
+# application identity on the platform
+app = "cobaia"
+role = "the monetization site of the family: the front door of the ten deployable apps — pricing, support, the app directory, the update blog and the legal pages, real content with honest ad slots and zero tracking"
+theme = "Sol"
+pages = ["home", "pricing", "support", "apps", "legal", "blog", "notfound"]

package/familyurl.ts

@@ -0,0 +1,22 @@
+/**
+ * familyurl.ts — the address book of the family deploy units that share the
+ * host with the cobaia. The family redirects both ways: the site directory
+ * (/apps) links every sibling application and the DevThink OS, and every
+ * sibling links back through its own copy of this helper. The deploy units
+ * sit beside this one as sibling folders on the shared origin, so the url
+ * resolves one level above this application (../slug/), with the slug
+ * trimmed of any slashes so both bare names and pasted segments resolve to
+ * the same address. Pure and side-effect free: the helper only shapes
+ * strings.
+ */
+
+/**
+ * Resolves the url of a family deploy unit that shares this origin.
+ *
+ * @param slug the deploy unit segment (the app folder name).
+ * @returns the relative url of the family application, one level above this
+ * deploy unit, always carrying the trailing slash.
+ */
+export function familyurl(slug: string): string {
+  return `../${slug.replace(/^\/+|\/+$/g, "")}/`;
+}

package/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" role="img" aria-label="cobaia favicon"><title>cobaia</title><rect width="32" height="32" rx="8" fill="#b45309"/></svg>

package/icon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96" role="img" aria-label="cobaia icon"><title>cobaia</title><defs><linearGradient id="cbbg" x1="0" y1="0" x2="0" y2="1"><stop offset="0" stop-color="#f59e0b"/><stop offset="1" stop-color="#b45309"/></linearGradient></defs><rect width="96" height="96" rx="24" fill="url(#cbbg)"/><g fill="none" stroke="#fbf5ea" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"><path d="M38 26 H58 M42 26 V44 L30 66 A4 4 0 0 0 34 72 H62 A4 4 0 0 0 66 66 L54 44 V26"/><path d="M36 56 H60"/></g></svg>

package/index.html

@@ -0,0 +1,26 @@
+<!doctype html>
+<!-- web entry of the theme -->
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no, viewport-fit=cover" />
+    <meta
+      name="description"
+      content="cobaia is the front door of the DevThink family: the pricing, the support page, the app directory and the update blog for ten deployable web applications."
+    />
+    <meta name="theme-color" content="#0a0a0b" />
+    <link rel="icon" href="./favicon.svg" />
+    <link rel="manifest" href="./manifest.webmanifest" />
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link
+      href="https://fonts.googleapis.com/css2?family=Inter:wght@100..900&family=Geist+Mono:wght@100..900&display=swap"
+      rel="stylesheet"
+    />
+    <title>cobaia — the devthink family site</title>
+    <script type="module" src="./App.tsx"></script>
+  </head>
+  <body>
+    <div id="root"></div>
+  </body>
+</html>

package/labels.ts

@@ -0,0 +1,291 @@
+/**
+ * labels.ts — the copy law of cobaia: every interface string lives in the
+ * label store, the wingets and page anchors read through this typed
+ * accessor, and a hardcoded string inside a widget is a defect. the
+ * manifest below is the english source of truth extracted from the real
+ * strings of the Sol wingets and the page anchors; the seed ingests it
+ * into the labels store (the site db through db.ts on the server, the
+ * browser rows cache in the visitor machine) and the seed never overwrites
+ * a translated row.
+ *
+ * the browser never imports db.ts (better-sqlite3 cannot ride the static
+ * bundle): the type comes across erased, the browser seed mirrors the rows
+ * into the local cache.
+ *
+ * data stays data: the app roster (apps.roster.ts — slugs, accents, the
+ * roles each app declares in its own devthink.toml), the plan billing
+ * values and the support hrefs (checkoutlinks.ts — ids, prices, checkout
+ * links; the plan prose itself rides here), the ad slot registry
+ * (adsconfig.ts — the fixed ad contract label and note ride there, pinned
+ * by the tests), the blog posts (posts.ts) and the route hrefs keep
+ * flowing from the data modules; the prose and the affordances around
+ * them ride here.
+ */
+
+import { createLabelStore } from "@wenathlan/vault/labelstore";
+
+/** the label revision of the manifest: bump on every copy wave so the seed
+ * refreshes the store rows of the changed strings. */
+export const LABEL_REVISION = 4;
+
+/** the english manifest: the page.widget.key path answers the surface text.
+ * every entry is the verbatim string the wingets and page anchors rendered
+ * before the copy wave — zero invented copy. */
+export const LABEL_MANIFEST = {
+  // the window shell widget (the one chrome of the content site)
+  "shell.skip": "skip to content",
+  "shell.window.aria": "cobaia",
+  "shell.brand.aria": "cobaia — home",
+  "shell.name": "cobaia",
+  "shell.role": "the devthink family site",
+  "shell.caption.minimize": "Minimize cobaia",
+  "shell.caption.maximize": "Maximize cobaia",
+  "shell.caption.close": "Close cobaia",
+  "shell.nav.aria": "site sections",
+  "shell.nav.apps": "apps",
+  "shell.nav.pricing": "pricing",
+  "shell.nav.blog": "blog",
+  "shell.nav.support": "support",
+  "shell.foot.aboutHead": "cobaia",
+  "shell.foot.aboutText":
+    "the front door of the devthink family: ten applications that run anywhere, tracked nowhere. pricing, support, the app directory and the update blog live here.",
+  "shell.foot.siteHead": "site",
+  "shell.foot.apps": "apps",
+  "shell.foot.pricing": "pricing",
+  "shell.foot.blog": "blog",
+  "shell.foot.support": "support",
+  "shell.foot.legal": "legal",
+  "shell.foot.familyHead": "the family",
+  "shell.colophon": "cobaia — a provisional name. part of the devthink family · ten honest tools under one roof.",
+  // the home page anchor (the landing)
+  "home.aria.hero": "cobaia — the devthink family site",
+  "home.eyebrow": "the devthink family site",
+  "home.title": "One family. Ten tools. Zero tracking.",
+  "home.lede":
+    "devthink builds and ships a family of web applications — sandboxes, studios, tools and a game platform — hosted free, tracked nowhere. this site is the front door: the directory, the pricing, the support page and the update blog.",
+  "home.action.pricing": "see the pricing",
+  "home.action.apps": "browse the ten apps",
+  "home.section.stepsAria": "what the family is made of",
+  "home.section.stepsTitle": "What the family is made of",
+  "home.section.stepsLede": "the same three choices behind every member of the family.",
+  "home.steps.engine.n": "01",
+  "home.steps.engine.title": "one core",
+  "home.steps.engine.text":
+    "the sandbox and the storage are shared parts. every application assembles the parts it needs and ships beside the others.",
+  "home.steps.static.n": "02",
+  "home.steps.static.title": "static first",
+  "home.steps.static.text":
+    "every public surface builds down to one stylesheet and a handful of bundles on free static hosting. nothing is stored on the visitor machine — no cookies, no accounts, no tracking.",
+  "home.steps.honest.n": "03",
+  "home.steps.honest.title": "honest money",
+  "home.steps.honest.text":
+    "the family runs on about us$15 a month of domains. the pricing and the support page exist to cover that floor first — and the apps themselves stay free of ads.",
+  "home.section.previewAria": "a preview of the app directory",
+  "home.section.previewTitle": "A few of the ten",
+  "home.section.previewLede": "every member lives beside this site, one link away. the full directory lives on",
+  "home.section.previewLink": "/apps",
+  "home.section.previewTail": ".",
+  "home.appcard.open": "open {slug}",
+  "home.section.supportAria": "supporting the family",
+  "home.section.supportTitle": "Keep the family independent",
+  "home.section.supportLede":
+    "github sponsors and ko-fi keep the domains paid and the tools free — both charge zero platform fees, so the support goes straight to the hosting floor.",
+  "home.action.support": "ways to support",
+  // the apps page anchor (the directory)
+  "apps.aria.hero": "the devthink app directory",
+  "apps.eyebrow": "the directory",
+  "apps.title": "Ten apps. One family.",
+  "apps.lede":
+    "every member of the family lives beside this site and links back to it. the roles below are the honest ones each app declares for itself; the accents are the family's spec table.",
+  "apps.section.rosterAria": "the family roster",
+  "apps.card.open": "open {slug}",
+  // the pricing page anchor (the plans)
+  "pricing.action.choose": "choose {name}",
+  "pricing.action.notConfigured": "checkout not configured yet",
+  "pricing.aria.hero": "cobaia pricing",
+  "pricing.eyebrow": "pricing",
+  "pricing.title": "Pay for what you use. Or use it free.",
+  "pricing.lede":
+    "the core surface of every application is free and stays free. the paid plans add the pro features of one app or of the whole family. the prices below are placeholders until billing goes live — a plan activates the moment its checkout link is configured, and says so honestly until then.",
+  "pricing.section.plansAria": "the plans",
+  "pricing.card.planAria": "{name} plan",
+  "pricing.section.moneyAria": "what the money covers",
+  "pricing.section.moneyTitle": "What the money covers",
+  "pricing.section.moneyLede":
+    "the family runs on about us$15 a month of domains and free static hosting. the paid plans cover that floor first, then the higher tiers. there are no ads inside the applications — the ad slots live only on this site's content pages, and they are labeled and reserved.",
+  "pricing.section.moneyNote":
+    "billing decision pending: stripe payment links or paddle (merchant of record). the checkout hrefs are configuration at the app root — never code, never a committed key.",
+  // the plan prose of the pricing cards and the intro plans zone (the
+  // billing values — ids, prices, hrefs — stay in checkoutlinks.ts; the
+  // words ride here so the store answers every plan sentence)
+  "pricing.plan.free.name": "Free",
+  "pricing.plan.free.per": "month",
+  "pricing.plan.free.blurb": "every app's core surface, for as long as the family is up.",
+  "pricing.plan.free.feat.1": "the core surface of all ten applications",
+  "pricing.plan.free.feat.2": "no ads inside the apps, ever",
+  "pricing.plan.free.feat.3": "community support through the public issue tracker",
+  "pricing.plan.pro.name": "Pro",
+  "pricing.plan.pro.per": "month",
+  "pricing.plan.pro.blurb": "one app and its pro features, billed per application.",
+  "pricing.plan.pro.feat.1": "the pro features of one chosen application",
+  "pricing.plan.pro.feat.2": "priority routes on the shared gateway",
+  "pricing.plan.pro.feat.3": "early access to that app's new surfaces",
+  "pricing.plan.studio.name": "Studio",
+  "pricing.plan.studio.per": "month",
+  "pricing.plan.studio.blurb": "the whole family at once, for people who live in the tools.",
+  "pricing.plan.studio.feat.1": "the pro features of every application in the family",
+  "pricing.plan.studio.feat.2": "early access across the family",
+  "pricing.plan.studio.feat.3": "a direct line to the maintainer for feature requests",
+  // the support page anchor (the channels)
+  "support.action.notConfigured": "link not configured yet",
+  "support.aria.hero": "cobaia support",
+  "support.eyebrow": "support",
+  "support.title": "Keep the family independent.",
+  "support.lede":
+    "the family runs on about us$15 a month of domains and free hosting. support covers that floor, keeps every tool free to use and keeps the applications free of ads. both channels below charge zero platform fees, so the support goes where it says.",
+  "support.section.channelsAria": "the support channels",
+  "support.channel.sponsors.name": "GitHub Sponsors",
+  "support.channel.sponsors.promise":
+    "sponsor the maintainer through github. zero platform fee, payouts land automatically, and the sponsorship shows up next to the public work it funds.",
+  "support.channel.sponsors.cta": "sponsor on github",
+  "support.channel.kofi.name": "Ko-fi",
+  "support.channel.kofi.promise":
+    "one-off donations and monthly memberships through ko-fi. zero fee on donations, no account required on your side beyond the payment.",
+  "support.channel.kofi.cta": "buy a coffee",
+  "support.section.otherAria": "other ways to help",
+  "support.section.otherTitle": "Other ways to help",
+  "support.section.otherLede":
+    "use the tools and tell the truth about them — report what breaks in the public issue tracker, write about what the family does well or badly, and link the directory when a tool earns it. none of it costs anything and all of it compounds.",
+  "support.section.otherNote":
+    "the honest line: no ad clicking, no traffic exchange, no bots. automated traffic against an ad surface is invalid traffic — it would end the ad account and the domain reputation. the family does not do it.",
+  // the blog page anchor (the update blog)
+  "blog.aria.hero": "the family update blog",
+  "blog.eyebrow": "updates",
+  "blog.title": "What the family is building.",
+  "blog.lede":
+    "short, written updates on the family — how the sites are built, what they cost and why they ship the way they do. every post lives on this page; the index jumps to it.",
+  "blog.section.indexAria": "the post index",
+  "blog.section.fullAria": "the posts in full",
+  "blog.post.meta": "{date} · {words} words · {tags}",
+  // the legal page anchor (privacy and terms)
+  "legal.aria.hero": "cobaia legal",
+  "legal.eyebrow": "legal",
+  "legal.title": "Privacy and terms.",
+  "legal.lede":
+    "the short version: the family sites are static files, they collect nothing by default, they track nobody, and the details below are the long version of the same promise. last updated 2026-10-10.",
+  "legal.privacy.aria": "privacy policy",
+  "legal.privacy.title": "Privacy policy",
+  "legal.privacy.collect.head": "What we collect: nothing, by default.",
+  "legal.privacy.collect.text":
+    "The family sites are static files served from a CDN. They set no cookies, run no analytics, embed no fingerprinting and write nothing to your browser — no local storage, no indexed databases, no session records. The only thing a visitor machine does is load the interface.",
+  "legal.privacy.logs.head": "Server logs.",
+  "legal.privacy.logs.text":
+    "The hosting providers (netlify, vercel, cloudflare and equivalents) keep standard access logs on their own infrastructure for security and abuse prevention. The family does not add identifiers to them and does not export them for profiling.",
+  "legal.privacy.ads.head": "Advertising.",
+  "legal.privacy.ads.text":
+    "The family site runs reserved, visibly labeled ad containers on its content pages. No ad script ships in the code: the advertising partner's loader is only added after the partner approves the site, and it arrives through the deploy environment. Once live, third-party vendors including Google may serve ads and use cookies to personalize them, as governed by the partner's own policies. You can opt out of personalized advertising through your ad settings (for Google, adssettings.google.com). Ads never appear inside the applications themselves.",
+  "legal.privacy.analytics.head": "Analytics.",
+  "legal.privacy.analytics.text":
+    "There is no analytics on the family sites today. If that ever changes, it will be opt-in, minimal and disclosed on this page before it goes live.",
+  "legal.privacy.payments.head": "Payments.",
+  "legal.privacy.payments.text":
+    "When paid plans go live, checkout runs on the payment provider's own pages (stripe, paddle or equivalents). The family sites never see or store card data.",
+  "legal.privacy.contact.head": "Contact.",
+  "legal.privacy.contact.text":
+    "Privacy questions and data requests go through the public issue tracker of the family repository — the same channel the software itself uses.",
+  "legal.terms.aria": "terms of use",
+  "legal.terms.title": "Terms of use",
+  "legal.terms.service.head": "The service.",
+  "legal.terms.service.text":
+    "The family applications and this site are provided as is, without warranty of any kind. They are tools built in public: features change, break and get fixed in the open. Nothing here is offered as professional advice or with any availability guarantee.",
+  "legal.terms.use.head": "Acceptable use.",
+  "legal.terms.use.text":
+    "Use the tools like a person. Do not run automated traffic against the sites or, above all, against any advertising surface: clicking your own ads, exchanging traffic or driving bots at ad containers is invalid traffic — it defrauds the advertisers, it ends the ad account and it burns the domain reputation. The family does not do it and asks nobody else to.",
+  "legal.terms.data.head": "Your data.",
+  "legal.terms.data.text":
+    "Since the sites collect nothing, there is nothing to export or delete. What you do inside the hosted tools stays governed by the tool's own page.",
+  "legal.terms.ip.head": "Intellectual property.",
+  "legal.terms.ip.text":
+    'The family code is free software under its repository license; the name devthink and the family marks belong to their author. The site name "cobaia" is provisional and may change.',
+  "legal.terms.changes.head": "Changes.",
+  "legal.terms.changes.text":
+    "These terms change when the facts change, and the changes land on this page with a new date. Using the sites after a change means you accept it.",
+  // the notfound page anchor (the empty address)
+  "notfound.eyebrow": "404",
+  "notfound.title": "This address is not part of the family.",
+  "notfound.lede":
+    "the page you asked for does not exist here. the front door and the app directory are the honest way back in.",
+  "notfound.action.home": "back to the front door",
+  "notfound.action.apps": "browse the apps",
+  // the intro page anchor (the bare presentation — the family grammar's last
+  // seat: every app carries an intro; the cobaia one presents the real offer,
+  // never invented numbers, never fake testimonials)
+  "intro.aria.page": "cobaia — the intro",
+  "intro.aria.splash": "the cobaia intro splash",
+  "intro.splash.name": "cobaia",
+  "intro.splash.role": "the devthink family site",
+  "intro.splash.skip": "click, tap or any key to skip",
+  "intro.bar.aria": "the intro doors",
+  "intro.hero.eyebrow": "the presentation",
+  "intro.hero.title": "The family's front door, and its price list.",
+  "intro.hero.lede":
+    "cobaia is the monetization face of the devthink family, kept apart so the ten applications stay clean — no ads inside the apps. the directory, the plans, the support channels and the update blog live here, on one static site that collects nothing by default.",
+  "intro.hero.cta": "enter the site",
+  "intro.hero.cue": "see the plans",
+  "intro.hero.note":
+    "the name is provisional, the hosting is free and static, the storage is zero — the long version of that promise rides the legal page.",
+  "intro.plans.aria": "the plans as they really are",
+  "intro.plans.eyebrow": "the plans",
+  "intro.plans.title": "The plans, as they really are.",
+  "intro.plans.lede":
+    "the same three plans the pricing page carries — us$0, 5 and 19 a month, placeholder prices until billing lands. a plan activates the moment its checkout link is configured, and says so honestly until then.",
+  "intro.plans.choose": "choose {name}",
+  "intro.plans.notConfigured": "checkout not configured yet",
+  "intro.plans.door": "the full pricing page",
+  "intro.doors.aria": "the doors of the site",
+  "intro.doors.eyebrow": "the doors",
+  "intro.doors.title": "Where the family lives.",
+  "intro.doors.apps": "the app directory",
+  "intro.doors.appsText":
+    "ten apps live beside this site. the full directory, with the honest role each application declares for itself, is one door away.",
+  "intro.doors.appsCta": "browse the ten apps",
+  "intro.doors.legal": "privacy and terms",
+  "intro.doors.legalText":
+    "the family sites are static files: they collect nothing by default and they track nobody. the privacy policy and the terms of use are the long version of the same promise.",
+  "intro.doors.legalCta": "read the legal page",
+  "intro.footer.siteAria": "the site doors",
+  "intro.footer.familyAria": "the family row",
+  "intro.footer.family": "the family",
+  "intro.footer.memberTip": "open {slug} — the door beside this site",
+  // the ad slot widget (the reserved box of the content pages)
+  "ads.slot.reserved": "reserved · {format}",
+} as const;
+
+export type LabelKey = keyof typeof LABEL_MANIFEST & string;
+
+/** the store mechanism rides the vault factory (the storage law of the
+ * family: the vault owns the store, the app owns the manifest — the
+ * mechanism is imported, never duplicated). the surface answers its own no-storage law: the visitor browser never writes. */
+const store = createLabelStore({
+  manifest: LABEL_MANIFEST,
+  revision: LABEL_REVISION,
+});
+
+/** the typed accessor of the copy: the only door a widget or page anchor uses. */
+export function label(key: LabelKey): string {
+  return store.label(key);
+}
+
+/** the placeholder door: fills the {token} slots of one format key with the
+ * runtime values (the store keeps the sentence, the widget passes the data). */
+export function labelfill(key: LabelKey, values: Record<string, string>): string {
+  return store.labelfill(key, values);
+}
+
+/** the seed ingests the manifest into the labels store, idempotent, and the
+ * translated rows stay protected from the overwrite. in the browser the rows
+ * ride the local cache of the site db; on the server db.ts seeds the same
+ * manifest into the labels table through seedLabelRows. */
+export function seedLabels(): Promise<{ seeded: number; protected: number }> {
+  return store.seedLabels();
+}

package/manifest.webmanifest

@@ -0,0 +1,56 @@
+{
+  "name": "cobaia",
+  "short_name": "cobaia",
+  "description": "The front door of the DevThink family: pricing, support, the app directory and the update blog for ten deployable web applications.",
+  "id": "/",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "display_override": ["window-controls-overlay", "standalone", "minimal-ui"],
+  "orientation": "any",
+  "background_color": "#0a0a0b",
+  "theme_color": "#f59e0b",
+  "lang": "en",
+  "dir": "ltr",
+  "categories": ["developer", "productivity"],
+  "icons": [
+    {
+      "src": "./favicon.svg",
+      "sizes": "any",
+      "type": "image/svg+xml",
+      "purpose": "any"
+    },
+    {
+      "src": "./favicon.svg",
+      "sizes": "any",
+      "type": "image/svg+xml",
+      "purpose": "any maskable"
+    },
+    {
+      "src": "./icon.svg",
+      "sizes": "any",
+      "type": "image/svg+xml",
+      "purpose": "any"
+    },
+    {
+      "src": "./icon.svg",
+      "sizes": "any",
+      "type": "image/svg+xml",
+      "purpose": "any maskable"
+    }
+  ],
+  "shortcuts": [
+    {
+      "name": "Pricing",
+      "short_name": "Pricing",
+      "url": "/pricing"
+    },
+    {
+      "name": "App directory",
+      "short_name": "Apps",
+      "url": "/apps"
+    }
+  ],
+  "related_applications": [],
+  "prefer_related_applications": false
+}

package/mime.types

@@ -0,0 +1,12 @@
+# MIME types served by the site
+text/html   html htm
+text/css    css
+text/javascript js mjs
+application/json json
+application/manifest+json webmanifest
+image/svg+xml svg
+image/png png
+image/jpeg jpg jpeg
+image/x-icon ico
+font/woff2  woff2
+application/wasm wasm

package/netlify.toml

@@ -0,0 +1,2 @@
+[build]
+  publish = "."