@wenathlan/cobaia 2.0.155 → 2.0.159

package/.dev.vars.example

@@ -0,0 +1,3 @@
+# local wrangler dev secrets (never committed; copy to .dev.vars)
+DEVTHINK_DB_URL=placeholder
+COBAIA_RUNNER_TOKEN=placeholder

package/.dockerignore

@@ -0,0 +1,41 @@
+# the cobaia docker build context.
+# The docker build context carries the sources only: THE Dockerfile builds
+# from a clean checkout — the deps stage installs the frozen bun.lock tree
+# itself, the builder compiles every dist target and runs the deterministic
+# checks, and the runtime copies only the lean output. The local
+# node_modules trees, the built dist, the committed distpackage staging
+# (the builder stages its own), the release scratch, the mobile capacitor
+# shell (a native wrapper concern, never a container input), the packaged
+# archives and the development state never enter the image.
+.git
+# the workflow corpus stays in the build context: the gate ladder the
+# container image runs (npm test) reads .github/workflows through the
+# workflowcheck, readiness and publishing-pipeline contracts, so the
+# workflows travel with the sources into the builder stage only — the
+# runtime stages copy their lean outputs and never ship the corpus.
+.github/*
+!.github/workflows
+.manus-logs
+node_modules
+sol/node_modules
+mobile
+dist
+distpackage
+build
+sol/dist
+release
+staging
+*.tgz
+*.zip
+*.xpi
+*.vsix
+*.tar.gz
+*.log
+*.sqlite
+*.db
+.env
+.env.*
+__pycache__
+*.pyc
+*.pyo
+tests/tmp

package/.env.example

@@ -0,0 +1,9 @@
+# cobaia monetization environment variables
+# copy to .env and fill in your values
+
+# database url — sqlite local file or libsql remote
+# local sqlite (default for dev)
+DATABASE_URL="file:./local.db"
+# remote libsql (for vercel netlify production)
+# DATABASE_URL="libsql:https://your-turso-db.turso.io"
+# DATABASE_AUTH_TOKEN="your-turso-auth-token"

package/.gitattributes

@@ -0,0 +1,36 @@
+# the cobaia text attributes.
+# Normalize line endings to LF
+* text=auto eol=lf
+
+# Explicit text types (the merged engine sources)
+*.ts text eol=lf
+*.tsx text eol=lf
+*.js text eol=lf
+*.mjs text eol=lf
+*.cjs text eol=lf
+*.json text eol=lf
+*.css text eol=lf
+*.md text eol=lf
+*.prisma text eol=lf
+
+# Explicit binary types (no EOL conversion)
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.webp binary
+*.ico binary
+*.icns binary
+*.woff binary
+*.woff2 binary
+*.ttf binary
+*.otf binary
+*.eot binary
+*.zip binary
+*.tgz binary
+*.tar.gz binary
+*.lock binary
+
+# Local database stores stay binary (the sqlite mirrors the workbench writes at runtime)
+*.db binary
+*.db-journal binary

package/.nvmrc

@@ -0,0 +1 @@
+26.13.0

package/App.tsx

@@ -7,8 +7,8 @@
  * directly and every page is public; the intro (/intro) is the one bare
  * presentation page the family grammar gives every app, mounted full-bleed
  * under the family fullscreen law. The root manages the theme as a single
- * file: it imports only the theme anchor (Sol/Sol.tsx — the file named
- * after the theme folder, beside Sol/sol.css), the theme stylesheet and the
+ * file: it imports only the theme anchor (sol/Sol.tsx — the file named
+ * after the theme folder, beside sol/sol.css), the theme stylesheet and the
  * root logics, wraps the anchor in the wouter router (the subpath the pages
  * deploy owns answers through the declared base, the same mount grammar
  * every sibling carries) and renders the theme into the root element —
@@ -18,10 +18,10 @@
  */
 import { createRoot } from "react-dom/client";
 import { Router as WouterRouter } from "wouter";
-import Sol from "./Sol/Sol";
+import Sol from "./sol/Sol";
 import "@fontsource-variable/geist-mono";
 import "@fontsource-variable/inter";
-import "./Sol/sol.css";
+import "./sol/sol.css";
 import { seedLabels } from "./labels";
 
 // the copy law rides the boot: the seed refreshes the label store rows from

package/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Cobaia release notes
+
+## 2.0.158 — the docstd rung (the document family answers one template)
+
+### Changed
+
+| Area | Change |
+| --- | --- |
+| The document suite | Cobaia joins the family document standard: the saddle-shape doc suite lands whole at the app root — the notice, the authors, the copyright, the disclaimer, the eula, the support, the governance, the cla, the acceptable use policy, the export control notice, the trademark policy, the terms of use, the terms and conditions, the privacy policy, the code of conduct, the bug report, the pull request template, the third-party notices, the readme, the security policy and this changelog — every seat of the family answering one template in its own voice. |
+| The provenance | The suite adapts the saddle reference documents (the most complete seat of the family) to the cobaia seat — the public monetization surface: mrr plans, honest ad slots and the support links; GPL-3.0-only, the DevThink monorepo home (https://github.com/wenathlan/devthink/tree/main/cobaia) and the owner contact carry across every file. |

package/Dockerfile

@@ -14,8 +14,11 @@ ARG COBAIA_VERSION=2.0.134
 
 WORKDIR /src
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY pnpmboot.package.json /tmp/pnpmboot/package.json
+COPY pnpmboot.package-lock.json /tmp/pnpmboot/package-lock.json
 RUN apk add --no-cache python3 make g++ \
- && npm install -g --no-fund --no-audit pnpm@12.3.4 \
+ && npm ci --prefix /tmp/pnpmboot --no-fund --no-audit \
+ && ln -sf /tmp/pnpmboot/node_modules/.bin/pnpm /usr/local/bin/pnpm \
  && pnpm install --frozen-lockfile
 COPY . .
 RUN pnpm build

package/README.md

@@ -0,0 +1,5 @@
+# cobaia
+
+Public monetization surface. MRR plans, honest ad slots and the support links (github sponsors, ko-fi); the os imports it for plans, quotas and billing surfaces while the family apps stay clean. This folder receives the cobaia application per the complete tree.
+
+The document suite answers the family template: the legal and community set (notice, authors, copyright, disclaimer, eula, support, governance, cla, acceptable use policy, export control, trademark policy, terms of use, terms and conditions, privacy policy, code of conduct), the contribution set (contributing, bug report, pull request template, third-party notices) and the release face (this readme, SECURITY, CHANGELOG) — the saddle-shape suite every seat of the family carries, in the cobaia voice.

package/SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy — Cobaia (the monetization surface)
+
+## Supported release line
+
+Security fixes target the maintained `2.x` family line and later maintained releases.
+
+| Version | Supported |
+| --- | --- |
+| 2.0.x (the family ladder) | Yes |
+
+## Scope
+
+Cobaia is the public monetization surface of the DevThink family: the mrr plan catalog, the honest ad slots and the support links (github sponsors, ko-fi) — the os imports it for plans, quotas and billing surfaces. The Plan, ad slot and support surfaces read only the configuration and the data the operator supplies; nothing rides upstream without an operator-requested integration.
+
+## Secrets and credentials
+
+The public repository must not include provider keys, session cookies, database files, captured authorization headers or `.env` payloads. The plan catalog and the ad slots reference public support links; the repository carries no payment credential. The CI secret-scan gate (TruffleHog with `--results=verified` over the full git history) and the Trivy filesystem scan (vuln, secret, misconfig) run on every push and pull request.
+
+Private disclosure: do not publish exploit details in a public issue before maintainers have had a reasonable opportunity to investigate and coordinate a fix. Remove sensitive data from logs and send a minimal report through the repository's private security reporting channel at https://github.com/wenathlan/devthink/security/advisories/new. Revoke any credential that may have appeared in a local file or public commit before reporting. Security advisories and published fixes are tracked at https://github.com/wenathlan/devthink/security/advisories.
+
+Security testing must be authorized by the owner of the target system. Development and CI scanning of artifacts is allowed within the project's own build and test environments. Unauthorized penetration testing, fuzzing, active scanning or credential probing of third-party systems is not allowed.
+
+## Supply chain
+
+- Security advisories for the npm package line are published at https://github.com/wenathlan/devthink/security/advisories.
+- The version tag is the supply-chain contract for every GitHub Actions reference (the family standard: digests and checksums are computed on the GitHub runners at run time — release `SHA256SUMS` assets, GitHub-computed release-asset digests consumed as build args — never written into workflow files or the Dockerfile).
+- The project records accepted risks, dependency advisories and remediation status in the security documentation and workflow reports.

package/acceptableusepolicy.md

@@ -0,0 +1,9 @@
+# Cobaia acceptable use policy
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+The Cobaia source code is licensed under the GNU General Public License version 3.0 only. This policy governs hosted services, credentials, runners and integrations operated with Cobaia; it does not reduce rights granted by the GPL.
+
+Operators must use Cobaia lawfully, respect the terms of each connected provider, protect credentials, and obtain authorization before accessing systems or data. Operators must not use Cobaia to distribute malware, evade access controls, attack third-party systems, violate privacy, infringe intellectual property, or exceed provider quotas.
+
+The project may suspend a hosted integration or reject an unsafe request when necessary to protect users, providers or the public. These operational controls do not restrict lawful use, modification or redistribution of the GPL-licensed software itself.

package/authors.md

@@ -0,0 +1,16 @@
+# Cobaia authors
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+The project authors and historical copyright holders are:
+
+| Contributor | Role |
+|---|---|
+| devthink | Historical author and project contributor |
+| nathlan | Project owner and maintainer |
+| iakadion | Historical author and project contributor |
+| nathu filho | Historical author and project contributor |
+| allan neris | Historical author and project contributor |
+| andraneris | Historical author and project contributor |
+
+Cobaia is maintained at https://github.com/wenathlan/devthink/tree/main/cobaia (the DevThink monorepo) and distributed under GPL-3.0-only. Contributors retain copyright in their original contributions unless a separate written agreement states otherwise.

package/biome.jsonc

@@ -23,9 +23,9 @@
       "!**/docs",
       "!**/tests/tmp",
       "!**/tests/code",
-      "!**/Sol/dist",
-      "!**/Sol/.vite",
-      "!**/Sol/node_modules",
+      "!**/sol/dist",
+      "!**/sol/.vite",
+      "!**/sol/node_modules",
       "!**/coverage",
       "!**/android",
       "!**/releasecheck",

package/bugreport.md

@@ -0,0 +1,16 @@
+---
+name: Bug Report
+about: Report a reproducible issue in Cobaia
+title: "[BUG]"
+labels: bug
+---
+
+# Cobaia is licensed under GPL-3.0-only. Please do not include secrets or private data.
+
+**Describe the issue:**
+
+**File / Line:**
+
+**Expected behavior:**
+
+**Additional context:**