@wenathlan/cobaia 0.0.0-stage → 2.0.158

package/App.tsx

@@ -0,0 +1,52 @@
+/**
+ * App — the global anchor (layer 1 of the anchor architecture) and the only
+ * TSX outside the cobaia theme. cobaia is the family site: the front door
+ * of the DevThink family — the pricing, the support page, the app directory
+ * and the update blog for the ten deployable applications. The site is a
+ * plain CONTENT surface: no onboarding, no entry gate — the home renders
+ * directly and every page is public; the intro (/intro) is the one bare
+ * presentation page the family grammar gives every app, mounted full-bleed
+ * under the family fullscreen law. The root manages the theme as a single
+ * file: it imports only the theme anchor (sol/Sol.tsx — the file named
+ * after the theme folder, beside sol/sol.css), the theme stylesheet and the
+ * root logics, wraps the anchor in the wouter router (the subpath the pages
+ * deploy owns answers through the declared base, the same mount grammar
+ * every sibling carries) and renders the theme into the root element —
+ * the site never booted without this mount (the blank cobaia defect).
+ * Every page and component lives behind the anchor chain (App → Sol → the
+ * page anchors → the loose components); nothing is imported directly.
+ */
+import { createRoot } from "react-dom/client";
+import { Router as WouterRouter } from "wouter";
+import Sol from "./sol/Sol";
+import "@fontsource-variable/geist-mono";
+import "@fontsource-variable/inter";
+import "./sol/sol.css";
+import { seedLabels } from "./labels";
+
+// the copy law rides the boot: the seed refreshes the label store rows from
+// the manifest (the browser cache mirrors the site db rows) before the theme
+// renders — best effort, the manifest always answers the wingets.
+if (typeof window !== "undefined") void seedLabels().catch(() => {});
+
+function routerBase(): string {
+  // the base rides the BUILD declaration only (the sibling grammar): the
+  // pages subpath owns /devthink/cobaia/, and that declaration arrives
+  // through the vite base — deriving it from the runtime path made every
+  // deep link look like a deployment subfolder
+  const declaredBase = import.meta.env.BASE_URL;
+  if (declaredBase !== "/" && declaredBase !== "./") return declaredBase.replace(/\/$/, "");
+  return "";
+}
+
+function App() {
+  return (
+    <WouterRouter base={routerBase()}>
+      <Sol />
+    </WouterRouter>
+  );
+}
+
+const root = document.getElementById("root");
+if (!root) throw new Error("cobaia root element is missing.");
+createRoot(root).render(<App />);

package/Dockerfile

@@ -0,0 +1,48 @@
+# cobaia 2.0.134 — THE SITE CONTAINER FILE
+#
+# The family container doctrine in the sol shape: one versioned static
+# container per site. The sol theme builds inside the container — stage one
+# installs the locked pnpm tree and runs the vite build, stage two serves
+# the built theme through the unprivileged nginx image. The version rides
+# the ARG the metadata lockstep stamps and the OCI labels declare — the
+# registry lanes pass it at build time, nothing is hardcoded beside the
+# stamp.
+
+FROM node:26-alpine@sha256:40cd011b55415bc894e45b02fdd5a5dfde056921b7d23a64c74f80497af48797 AS solbuild
+
+ARG COBAIA_VERSION=2.0.134
+
+WORKDIR /src
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY pnpmboot.package.json /tmp/pnpmboot/package.json
+COPY pnpmboot.package-lock.json /tmp/pnpmboot/package-lock.json
+RUN apk add --no-cache python3 make g++ \
+ && npm ci --prefix /tmp/pnpmboot --no-fund --no-audit \
+ && ln -sf /tmp/pnpmboot/node_modules/.bin/pnpm /usr/local/bin/pnpm \
+ && pnpm install --frozen-lockfile
+COPY . .
+RUN pnpm build
+
+FROM nginxinc/nginx-unprivileged:1.29-alpine@sha256:0c79d56aee561a1d81c63f00eee5fb5fe29279560cdc55e91425133104c7fbe6
+
+ARG COBAIA_VERSION=2.0.134
+
+LABEL org.opencontainers.image.title="cobaia" \
+      org.opencontainers.image.description="cobaia — the monetization surface: the ads, the plans and the conversion, kept apart from the main sites." \
+      org.opencontainers.image.version="${COBAIA_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink" \
+      org.opencontainers.image.documentation="https://github.com/wenathlan/devthink/tree/main/cobaia"
+
+COPY --from=solbuild /src/ /usr/share/nginx/html/
+
+# the explicit non-root runtime user (uid 101 is the nginx-unprivileged
+# default): the scan gate refuses an image without a pinned unprivileged
+# user, so the declaration is spelled out instead of inherited.
+USER 101
+
+# the unprivileged image answers 8080; the healthcheck probes the served
+# root the same way the pages lane does.
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+  CMD ["wget", "-qO-", "http://127.0.0.1:8080/"]

package/_headers

@@ -0,0 +1,4 @@
+/*
+  X-Content-Type-Options: nosniff
+  X-Frame-Options: DENY
+  Referrer-Policy: strict-origin-when-cross-origin

package/_redirects

@@ -0,0 +1 @@
+/spa/*  /index.html  200

package/adsconfig.ts

@@ -0,0 +1,59 @@
+/**
+ * adsconfig.ts — the honest ad slot registry of the family site, pure data
+ * at the app root. The family site carries ONE reserved ad container per
+ * content page (home, the app directory, the blog index), always at the end
+ * of the content, always labeled "advertisement", always a fixed aspect
+ * ratio so the page never shifts when a real unit arrives.
+ *
+ * THE SCRIPT RULE: no ad network script lives in this repository. The
+ * AdSense (or equivalent) loader is injected AFTER the network approves the
+ * site, through the deploy environment only. Until then the slot ids stay
+ * empty and the container renders the honest empty note. No network call,
+ * no click encouragement, no automated traffic ever touches an ad surface —
+ * invalid traffic is the one thing that kills both the ad account and the
+ * domain reputation, so the family does not do it.
+ */
+
+/** one reserved ad slot: the config id and the reserved shape. */
+export type adsslot = {
+  /** the ad network slot id — empty until the owner configures it after approval */
+  slotid: string;
+  /** the display format the reserved box mimics */
+  format: string;
+  /** the css aspect-ratio value the container reserves (never shifts layout) */
+  ratio: string;
+};
+
+/** the fixed label every ad container renders, visible and honest. */
+export const ADS_LABEL = "advertisement";
+
+/** the honest note the container renders while no slot id is configured. */
+export const ADS_EMPTY = "ad slot not configured yet";
+
+/** the reserved slots per content page, keyed by the page folder name. */
+export const ADSSLOTS: Readonly<Record<string, adsslot>> = {
+  home: { slotid: "", format: "display", ratio: "728 / 90" },
+  apps: { slotid: "", format: "in-feed", ratio: "3 / 1" },
+  blog: { slotid: "", format: "in-article", ratio: "3 / 1" },
+};
+
+/**
+ * Reads the reserved slot of one content page.
+ *
+ * @param page the page folder name (home, apps, blog).
+ * @returns the slot, or undefined when the page carries no slot.
+ */
+export function adsslotfor(page: string): adsslot | undefined {
+  return ADSSLOTS[page];
+}
+
+/**
+ * Answers whether a slot is configured with a real network id. An empty
+ * (or whitespace) slot id means the container stays an honest placeholder.
+ *
+ * @param slot the reserved slot entry.
+ * @returns true only when the slot id carries a value.
+ */
+export function adsslotlive(slot: adsslot | undefined): boolean {
+  return slot !== undefined && slot.slotid.trim().length > 0;
+}

package/biome.jsonc

@@ -0,0 +1,134 @@
+// the family biome baseline: identical across the apps, the identity only names the app.
+{
+  "$schema": "https://biomejs.dev/schemas/2.6.4/schema.json",
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": false
+  },
+  "files": {
+    "includes": [
+      "**/*.ts",
+      "**/*.tsx",
+      "**/*.js",
+      "**/*.mjs",
+      "**/*.cjs",
+      "**/*.json",
+      "!**/dist",
+      "!**/distpackage",
+      "!**/target",
+      "!**/node_modules",
+      "!**/bun.lock",
+      "!**/*.min.js",
+      "!**/docs",
+      "!**/tests/tmp",
+      "!**/tests/code",
+      "!**/sol/dist",
+      "!**/sol/.vite",
+      "!**/sol/node_modules",
+      "!**/coverage",
+      "!**/android",
+      "!**/releasecheck",
+      "!**/build",
+      "!**/release",
+      "!index-*.js"
+    ]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 120,
+    "lineEnding": "lf"
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "preset": "recommended",
+      "correctness": {
+        "noUnusedVariables": "warn",
+        "noUnsafeOptionalChaining": "warn",
+        "useExhaustiveDependencies": "warn",
+        "noUnusedImports": "warn",
+        "noUnusedPrivateClassMembers": "warn",
+        "noUnusedFunctionParameters": "warn",
+        "noConstantCondition": "warn",
+        "noVoidTypeReturn": "warn"
+      },
+      "a11y": {
+        "useButtonType": "warn",
+        "noStaticElementInteractions": "warn",
+        "useSemanticElements": "warn",
+        "useAriaPropsSupportedByRole": "warn"
+      },
+      "suspicious": {
+        "noExplicitAny": "warn",
+        "noArrayIndexKey": "warn",
+        "noControlCharactersInRegex": "warn",
+        "noRedeclare": "warn",
+        "noAssignInExpressions": "warn",
+        "noShadowRestrictedNames": "warn",
+        "noDuplicateElseIf": "warn",
+        "noImplicitAnyLet": "warn",
+        "noTsIgnore": "warn",
+        "noGlobalIsNan": "warn"
+      },
+      "style": {
+        "noNonNullAssertion": "warn",
+        "useTemplate": "warn",
+        "useExponentiationOperator": "warn",
+        "useConst": "warn"
+      },
+      "complexity": {
+        "useLiteralKeys": "warn",
+        "useOptionalChain": "warn",
+        "noUselessContinue": "warn",
+        "noUselessUndefinedInitialization": "warn",
+        "noUselessEscapeInRegex": "warn"
+      }
+    }
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "double",
+      "semicolons": "always",
+      "trailingCommas": "all",
+      "arrowParentheses": "always"
+    }
+  },
+  "css": {
+    "parser": {
+      "tailwindDirectives": true
+    }
+  },
+  "overrides": [
+    {
+      "includes": ["**/*"],
+      "linter": {
+        "rules": {
+          "suspicious": {
+            "noDebugger": "off"
+          }
+        }
+      }
+    },
+    {
+      "includes": ["tests/workflowcheck.ts", "tests/publishlanes.test.ts"],
+      "linter": {
+        "rules": {
+          "suspicious": {
+            "noTemplateCurlyInString": "off"
+          }
+        }
+      }
+    }
+  ],
+  "assist": {
+    "enabled": true,
+    "actions": {
+      "source": {
+        "useSortedKeys": "off"
+      }
+    }
+  }
+}