@wenathlan/cobaia 2.0.155 → 2.0.159

package/cobaia.csproj

@@ -0,0 +1,22 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFrameworks>netstandard2.0;netstandard2.1</TargetFrameworks>
+    <AssemblyName>cobaia</AssemblyName>
+    <RootNamespace>cobaia</RootNamespace>
+    <PackageId>cobaia</PackageId>
+    <Version>2.0.159</Version>
+    <Authors>wenathlan</Authors>
+    <Description>Distribution package containing the cobaia documentation set and the tests directory. cobaia is the monetization surface — the plans, the support rails and the honest advertisement slots.</Description>
+    <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
+    <PackageProjectUrl>https://github.com/wenathlan/devthink</PackageProjectUrl>
+    <RepositoryUrl>https://github.com/wenathlan/devthink</RepositoryUrl>
+    <PackageReadmeFile>README.md</PackageReadmeFile>
+    <PackageRequireLicenseAcceptance>false</PackageRequireLicenseAcceptance>
+    <EnableDefaultCompileItems>false</EnableDefaultCompileItems>
+  </PropertyGroup>
+  <ItemGroup>
+    <None Include="README.md" Pack="true" PackagePath="/" />
+    <None Include="docs/**/*" Pack="true" PackagePath="contentFiles/any/any/docs/" />
+    <None Include="tests/**/*" Pack="true" PackagePath="contentFiles/any/any/tests/" />
+  </ItemGroup>
+</Project>

package/cobaia.gemspec

@@ -0,0 +1,14 @@
+Gem::Specification.new do |spec|
+  spec.name = "cobaia"
+  spec.version = ENV.fetch("COBAIA_VERSION", "2.0.159")
+  spec.authors = ["wenathlan"]
+  spec.email = ["support@users.noreply.github.com"]
+  spec.summary = "The cobaia documentation and tests envelope (the monetization surface — the plans, the support rails and the honest advertisement slots)."
+  spec.description = "Distributes the cobaia documentation set and the tests directory as one Ruby gem. cobaia is the monetization surface — the plans, the support rails and the honest advertisement slots."
+  spec.homepage = "https://github.com/wenathlan/devthink"
+  spec.license = "GPL-3.0-only"
+  spec.required_ruby_version = ">= 3.1"
+  spec.files = Dir["README.md", "docs/**/*", "tests/**/*"]
+  spec.metadata["source_code_uri"] = "https://github.com/wenathlan/devthink"
+  spec.metadata["homepage_uri"] = spec.homepage
+end

package/cobaia.java

@@ -0,0 +1,16 @@
+package io.github.wenathlan.cobaia;
+
+/**
+ * The cobaia version envelope carrier.
+ *
+ * <p>The carrier answers the lowercase file name doctrine (the technical name {@code cobaia}
+ * while the class keeps the presentation name {@code Cobaia}); the class drops the public
+ * modifier so the java file name rule holds — the envelope carries the version constant the
+ * metadata lockstep stamps, the registry lanes never compile it.
+ */
+final class Cobaia {
+  /** The version of the cobaia envelope (the six-distribution completeness wave). */
+  public static final String VERSION = "2.0.159";
+  private Cobaia() {
+  }
+}

package/codeofconduct.md

@@ -0,0 +1,9 @@
+# Cobaia code of conduct
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+The Cobaia community follows a respectful, inclusive and technically constructive standard. Participants communicate in good faith, explain technical concerns with evidence, respect different backgrounds and experience levels, and protect private information.
+
+Unacceptable conduct includes harassment, discrimination, threats, deliberate disclosure of private information, malicious interference, impersonation, spam, and behavior that violates applicable law or the project policies.
+
+Project maintainers may moderate discussions, remove harmful content, or restrict participation when necessary. Reports should be sent through the repository security or support channels, with private disclosure used for security-sensitive matters.

package/content.ts

@@ -116,7 +116,7 @@ export const seedPosts: readonly blogpost[] = [
       "The whole family fits the static hosting free tiers — the only fixed cost is the domains. How ten deployable sites stay on a US$15 a month floor.",
     body: [
       "Every application in the DevThink family builds down to the same shape: one html file, one stylesheet and a handful of hashed bundles at the app root. There is no server to keep warm, no container to babysit and no database bill attached to the public surface. The whole family fits the free tiers of the usual static hosts, so the only fixed cost of the operation is the domains — about US$15 a month.",
-      "That number is the budget the family was designed against. The applications share one engine: the sandbox runner and the storage layer live as library-grade modules and get assembled per deploy, so a fix made once lands on every site that imports it. Nothing is provisioned per site beyond the deploy itself. A new application is a folder in the monorepo with the same skeleton as its siblings — config files at the root, the theme in Sol/, pure logic modules beside them and tests in the tests folder.",
+      "That number is the budget the family was designed against. The applications share one engine: the sandbox runner and the storage layer live as library-grade modules and get assembled per deploy, so a fix made once lands on every site that imports it. Nothing is provisioned per site beyond the deploy itself. A new application is a folder in the monorepo with the same skeleton as its siblings — config files at the root, the theme in sol/, pure logic modules beside them and tests in the tests folder.",
       "The trade-offs are real. Static sites cannot hold state, so the public surface of every app stores nothing on the visitor machine: no cookies, no accounts, no tracking. The pieces that genuinely need a backend — the AI gateway, the storage clones — run as separate deploy units on their own free tiers, and the sites talk to them over plain https with no credentials embedded anywhere.",
       "The accounting stays honest. US$15 a month is the floor, not the ceiling: a gateway that outgrows its free tier, or a storage clone that needs a persistent disk, moves the number. But the design keeps the moving parts few and every cost on a line item you can read. Ten working tools for the price of two coffees, and the bill never surprises anyone.",
     ],
@@ -129,7 +129,7 @@ export const seedPosts: readonly blogpost[] = [
     excerpt:
       "A page is a folder, an anchor and one stylesheet. The token set and the flat tree that keep ten sites feeling like one family.",
     body: [
-      "Every site in the family carries the same skeleton. A page is a folder directly under Sol/, named after the page, with an anchor file of the same name inside it. Components sit loose beside the anchor, infrastructure lives in a single shell folder and the whole theme styles from one stylesheet. There are no deeper folders. The rule sounds rigid until you maintain ten sites with it — then it is the only reason they stay consistent.",
+      "Every site in the family carries the same skeleton. A page is a folder directly under sol/, named after the page, with an anchor file of the same name inside it. Components sit loose beside the anchor, infrastructure lives in a single shell folder and the whole theme styles from one stylesheet. There are no deeper folders. The rule sounds rigid until you maintain ten sites with it — then it is the only reason they stay consistent.",
       "The theme runs on a fixed token set tuned against the trylle ruler: a near-black canvas, ink at #fafafa, eight surface steps from #171717 to #484848 and exactly one accent per application. Hairlines are the ink color mixed down to five and ten percent. Shadows are rings — a one-pixel outline plus doubling blur layers — instead of diffuse glows. Motion is capped at 150 milliseconds for micro-interactions on one shared cubic-bezier curve, and only transform and opacity ever animate.",
       "Each application keeps its own signal color: the sandbox engine wears tan, the gateway violet, the game platform coral, the video studio rose. The site you are reading uses the amber sun the whole family shares. One accent per screen, spent on actions and state, never on decoration — the ninety-ten rule. Everything else stays gray on gray: the hierarchy comes from the surface ladder and the typography, not from color.",
       "The constraints do the work. Because every token, radius, easing and spacing step is shared, a component copied between applications lands looking correct. Because the tree is flat, an audit is a directory listing. And because the stylesheet is one file, the entire design system of a site can be reviewed in a single pass. Ten sites feel like one family because, structurally, they are one.",

package/contributing.md

@@ -0,0 +1,9 @@
+# Contributing to Cobaia
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+Cobaia welcomes contributions that improve the monetization surface, its plan catalog and ad slots, the documentation, the tests and the security posture. Contributions are licensed under GPL-3.0-only unless a different compatible arrangement is agreed in writing before acceptance.
+
+A pull request should explain the change, include focused verification, preserve the root-first architecture and avoid credentials, private data or generated artifacts. Security vulnerabilities must use the private process in `SECURITY.md` rather than a public issue.
+
+Maintainers may review, request changes, decline or merge a contribution. No contributor is required to transfer exclusive ownership of their work merely to submit a pull request.

package/copyright.md

@@ -0,0 +1,7 @@
+# Cobaia copyright notice
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+The Cobaia source code and original documentation are distributed under the GNU General Public License version 3.0 only. The complete license text is kept in the repository `LICENSE` file (the saddle seat carries the family copy) and must be distributed with covered copies.
+
+Copyright ownership remains with the respective authors and contributors. Copyright ownership does not remove the rights granted by GPL-3.0-only. The Cobaia name, logos and other marks are covered separately by `trademarkpolicy.md`.

package/db.ts

@@ -8,7 +8,7 @@
  * tables over HTTPS (GET/POST /api/v1/onboarding); no server route lives
  * here.
  */
-import { openStorageLane } from "@wenathlan/vault/storagelane";
+import { openStorageLane } from "@wenathlan/vault/storage";
 import { LABEL_MANIFEST, LABEL_REVISION } from "./labels";
 
 /** the correlated tables the runtime keeps (the family sync contract names). */
@@ -24,7 +24,7 @@ export const db = lane.db;
 export const { execute, queryAll, queryOne } = lane;
 
 /** the parameter types the helpers bind (re-exported seat of the lane). */
-export type { SqlParam } from "@wenathlan/vault/storagelane";
+export type { SqlParam } from "@wenathlan/vault/storage";
 
 const SCHEMA = `
 CREATE TABLE IF NOT EXISTS onboarding_states (

package/disclaimer.md

@@ -0,0 +1,7 @@
+# Cobaia disclaimer
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+Cobaia is provided under GPL-3.0-only and without warranty to the maximum extent permitted by law. The project does not guarantee availability, correctness, security, compatibility, performance or fitness for a particular purpose.
+
+Operators remain responsible for reviewing source code, configuring integrations, protecting credentials, validating outputs and complying with the terms of connected services. Nothing in this disclaimer removes rights or obligations established by GPL-3.0-only.

package/docs/features.md

@@ -0,0 +1,58 @@
+# cobaia features
+
+the real feature list of the cobaia content site, extracted from the code: every item below exists in the app root logics or the Sol theme.
+
+## plans
+
+- three mrr plans: free at us$0, pro at us$5 and studio at us$19 per month, placeholder prices until the billing platform decision lands (stripe payment links or paddle)
+- honest checkout state: a configured plan href renders a live anchor, an empty one renders the disabled button with the note checkout not configured yet
+- plan lookup: planbyid answers one plan of the table by its stable id (free, pro, studio)
+- plan prose in the label store: every plan sentence (name, billing period, blurb, features) answers from labels.ts; only the billing values ride checkoutlinks.ts
+- intro plans zone: the intro page renders the same offer from the one checkoutlinks table, the studio plan leading raised
+- what the money covers: the pricing section states the us$15 a month floor of domains and free static hosting and that the applications stay ad free
+- billing webhook walk lane: the plan-checkout workload lane is declared in sandboxmodality.ts for the billing webhook work when it lands, secrets server side
+
+## ads
+
+- reserved slot registry: one slot per content page, home display at 728/90, apps in-feed at 3/1, blog in-article at 3/1, keyed by page folder name
+- honest ad container: a fixed aspect-ratio box on a hairline well, visibly labeled advertisement, rendering the empty note ad slot not configured yet while no slot id is set, so the page never shifts when a real unit arrives
+- script rule: no ad network script lives in the repository; the adsense or equivalent loader is injected after network approval through the deploy environment only
+- slot liveness check: adsslotlive answers whether a reserved slot carries a real network id
+- ad free surfaces: the pricing, support and legal pages carry no ad slot; nothing that asks for money or discloses policy sits beside an advertisement
+- ads slot lane: the ads-slot workload lane is declared for the reserved slots and the rotation decision the deploy answers before the render
+
+## content
+
+- content lane: the pages read the live rows the platform gateway serves over GET /api/v1/ui/content and fall back to the manifest seed in content.ts, so the interface never blanks
+- content kinds: the lane serves posts, roster, plans, supportlinks, ads.slots, ads.label and ads.empty, each row an ordinal and a json payload
+- live load discipline: one fetch per session against the configured base (VITE_CATALOG_URL) with a 4 second abort window; any failure keeps the seed answering
+- useContent mount hook: a store-riding page loads the live rows once per mount and re-renders when they land, with no first-paint flash
+- update blog: three seed posts with full bodies (ten sites one engine, one css one tree, no backend no tracking), the index sorted newest first and each post carrying date, tags, excerpt, body and the honest word count
+- app directory: the ten deploy units of the family, each card carrying the one-line role declared in its own devthink.toml and its spec accent
+- label store: every interface string rides the label manifest at revision 4, read through the typed accessors label and labelfill, seeded into the store with translated rows protected from overwrite
+- label seed lane: the label-seed workload lane is declared for the manifest walk the sqlite vault carries
+
+## support
+
+- two support channels: github sponsors and ko-fi, both presented as zero platform fee, read from the supportlinks record
+- honest channel state: an unconfigured channel renders the disabled button with the note link not configured yet, never a fake link
+- other ways to help: the section lists the public issue tracker, writing about the tools and linking the directory
+- invalid traffic policy: the site states no ad clicking, no traffic exchange, no bots, because automated traffic against an ad surface kills the ad account and the domain reputation
+- support strip on home: the landing carries the support call before the reserved ad slot
+
+## ui
+
+- one shared shell: the sticky acrylic nav with the active section indicator and the worked footer carrying the family row, the same surface at the direct url and inside the os power clip
+- routes: home on the bare root, apps, pricing, support, blog, legal inside the shell, the bare intro at /intro and the catch-all 404
+- intro splash: the akash opening with the mark spring, name rise and role fade, skippable by click, tap or key, honoring reduced motion and writing nothing to the visitor machine
+- brand mark: the drawn beaker svg in the dark amber gradient, the only seat of the identity accent, with a gentle hover tilt
+- home landing: left-aligned hero, the three steps (engine, static, honest), the four-card featured directory preview and the support strip
+- legal page: the privacy policy and terms with clause leads, disclosing the advertising plan and the analytics rule
+- notfound page: the 404 answer inside the site chrome with the way out to home and the directory
+- window captions: the shell carries the minimize, maximize and close caption labels for the os window seat
+- wouter routing on the declared vite base: deep links resolve against the pages subpath the build declaration owns
+- static deploys: netlify, vercel and cloudflare workers configs at the app root, plus robots.txt and sitemap.xml for the crawlers
+
+## Dependencies
+
+- synchronized dependency union — the eleven family apps share one dependency tree: identical `dependencies`, `devDependencies` and `peerDependencies` (same keys, same versions, nothing removed, highest semver wins on conflicts) and one `engines` catalog with node as maestro and the V 0.5.2 seat as catalog annotation (@family wave/depssync).

package/docs/monetization.md

@@ -0,0 +1,61 @@
+# cobaia monetization surface
+
+cobaia is the public monetization surface of the devthink family: the content site that carries the mrr plan table, the support channels and the honest advertisement slots while the ten family applications stay clean.
+
+## overview
+
+- a plain content site with no entry gate and no onboarding flow: every page is public and the home renders directly on the bare root
+- one window shell (header, footer) wraps every content route; the intro page mounts bare at /intro outside the chrome
+- every plan href and support href ships empty until the owner configures billing; the interface renders honest empty states instead of dead links
+- no ad network script is committed: the loader enters only after network approval, injected through the deploy environment
+- zero tracking: no cookies, no local storage, no analytics beacons, no keys committed
+- build tooling: vite static build, wouter router on the declared vite base, vitest suites, biome formatting
+
+## module inventory
+
+the pure logics at the app root, each one a typed accessor over the content lane:
+
+- adsconfig.ts: the honest ad slot registry. exports the adsslot type (slotid, format, ratio), the fixed label advertisement, the empty note ad slot not configured yet, the reserved slots per page (home display 728/90, apps in-feed 3/1, blog in-article 3/1) and the readers adsslotfor and adsslotlive
+- checkoutlinks.ts: the typed billing accessor. checkoutlinks answers the plan table, supportlinks the support channel record, isconfigured tests an href, planbyid finds one plan by id (free, pro, studio). only billing values ride here; the plan prose answers from the label store
+- content.ts: the content law. section 1 holds the manifest seed (seedPosts, seedRoster, seedPlans, seedSupportLinks, seedAdsSlots, seedAdsLabel, seedAdsEmpty); section 2 holds the live loader (loadcontent over GET /api/v1/ui/content), the accessors contenttable and contentvalue (live rows first, seed fallback) and the useContent mount hook
+- posts.ts: the blog accessor. posts answers the post table, postindex sorts it newest first, postwords counts the honest word total of one body
+- roster.ts: the family directory accessor. roster answers the ten deploy units with slug, accent and one-line role, in rail order with the os first
+- db.ts: the self-hosted sqlite runtime (better-sqlite3 through the vault storagelane). keeps the onboarding_states and labels tables with prepared, parameterized statements only
+- familyurl.ts: the family address book. familyurl resolves one sibling deploy unit to the relative url ../slug/ with the trailing slash, so the family links both ways
+- labels.ts: the copy law. the english manifest (LABEL_MANIFEST, revision 4) carries every interface string keyed by page.widget.key; label and labelfill read it; seedLabels mirrors the rows into the browser label store
+- sandboxmodality.ts: the workload lane declaration. mirrors the three lanes cobaia owns in the family catalog (plan-checkout, ads-slot, label-seed) and reads the COBAIA_SANDBOX_LANE seat (local, join, or a pinned modality id)
+- capacitor.config.ts, vite.config.ts, vitest.config.ts: the mobile conversion config, the static build and the test runner configs at the app root
+
+## data layer
+
+- the sqlite runtime opens one storage lane on the app-owned file cobaia.db (wal, foreign keys, patient locks) through openStorageLane of @wenathlan/vault
+- every statement is prepared and bound; no sql is assembled by string concatenation
+- the boot ddl is idempotent and mirrors schema.prisma, the documentation of record: the tables exist after the first open
+- onboarding_states holds the entry-flow flags per visitor (introseen, onboardingseen) with a seen-wins upsert; the platform gateway serves the same flags over /api/v1/onboarding
+- labels holds the interface copy store: id, text, revision, translated. the boot seed ingests the english manifest and never overwrites a translated row
+- the content rows (posts, roster, plans, supportlinks, ads.slots, ads.label, ads.empty) live in the site store and answer over the platform gateway at GET /api/v1/ui/content; the manifest seed in content.ts is the fallback the offline static build reads
+- the browser never imports db.ts: better-sqlite3 cannot ride the static bundle, so the browser pulls the live rows over the internal api (base from VITE_CATALOG_URL, 4 second abort window, one load per session)
+- the vitest suites (adsconfig, checkoutlinks, familyurl, posts, sandboxmodality) pin the module contracts: the slot registry, the placeholder prices, the empty hrefs and the plan prose keys
+
+## sol subapps
+
+the theme surface, one folder per page, mounted by the theme anchor sol/Sol.tsx on wouter:
+
+- home: the landing. left-aligned hero, the three steps (engine, static, honest), a four-card directory preview reading the one roster table (devthink, saddle, vault, cadria), the support strip and the reserved ad slot at the end of the content
+- apps: the directory. one card per deploy unit with the honest role and the deep link through familyurl, closed by the in-feed ad slot
+- pricing: the plan table. three honest plans (free, pro, studio), a configured href renders a live anchor, an empty one the disabled button plus the note checkout not configured yet, and the money section explains the us$15 a month floor. no ad slot on this page
+- support: the support channels. github sponsors and ko-fi cards with the same configured-or-honest rule, the other ways to help section and the invalid traffic line. no ad slot on this page
+- blog: the update blog. the sorted index and the full bodies of the posts as real articles with date, word count and tags in the meta line, closed by the in-article ad slot
+- legal: the privacy policy and the terms. discloses the advertising plan (labeled reserved slots, third-party cookies only once a network is live) and the analytics rule (none by default). no ad slot on this page
+- intro: the bare presentation page. the akash splash (plays per visit, writes nothing, skips on click, tap or key), the plans zone reading the one checkoutlinks table, the door panes and the footer doors
+- notfound: the 404 answer inside the site chrome
+- shell: the one chrome. the sticky acrylic nav with the active section indicator, the footer carrying the family row through familyurl, and the embedded contract that renders the same surface inside the devthink os power clip
+- wingets: the shared components (IntroSplash, IntroPlans, IntroFooter, ShellAdsslot, ShellBrand) re-exported through one index surface
+
+## family integration
+
+- the roster mirrors the ten deploy units: devthink the os, saddle the sandbox, forge the execution clone, foundry the complete clone, vault the storage clone, getry the ai workspace, cadria the video and image studio, debonair the audio daw, stealthhead the fps game platform, argan the dns toolkit, each with its spec section 12 accent
+- familyurl resolves every sibling one level above this deploy unit, so the directory links out and every sibling footer links back
+- the label store rides the shared vault labelstore; the sqlite lane rides the shared vault storagelane, the same mechanism the storage clone keeps
+- the deploy targets are static: netlify, vercel and cloudflare workers configs sit at the app root beside robots.txt and sitemap.xml; the capacitor mobile lane renders the same web bundle
+- the package identity is @wenathlan/cobaia inside the devthink monorepo; the devthink.toml declares the app role and the seven pages (home, pricing, support, apps, legal, blog, notfound)

package/eula.md

@@ -0,0 +1,7 @@
+# Cobaia end user license notice
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+Cobaia source code, scripts and covered binaries are licensed under the GNU General Public License version 3.0 only. The repository `LICENSE` file (the saddle seat carries the family copy) controls the copyright license and grants the permissions described there.
+
+This notice does not add a proprietary restriction to GPL-licensed code. Separate terms may apply to a hosted service, a third-party provider, a trademark, or data supplied by an operator. Those terms cannot remove rights granted by the GPL for the covered source code.

package/exportcontrol.md

@@ -0,0 +1,17 @@
+            COBAIA - EXPORT CONTROL NOTICE
+               Version 1.0, August 2026
+
+ Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors. Licensed under GPL-3.0-only.
+ Project: cobaia
+
+  Project Cobaia is open-source software under GPL-3.0-only. Export,
+  re-export and sanctions laws may still apply to a particular operator,
+  destination, service or use case.
+
+  You agree not to export, re-export, or transfer Project cobaia to any
+  prohibited destination, entity, or person, or for any prohibited end-use.
+
+  Operators are responsible for checking applicable rules before
+  transferring source, binaries, credentials or data across borders.
+
+             END OF EXPORT CONTROL NOTICE

package/governance.md

@@ -0,0 +1,9 @@
+# Cobaia governance
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+Cobaia is maintained as the public monetization surface of the family, an open-source project under GPL-3.0-only. The repository owner coordinates releases, security response, release approvals and provider integrations. Contributors retain copyright in their contributions unless a separate written agreement states otherwise.
+
+Changes should include focused reasoning, tests where practical, documentation for public behavior, and review of security-sensitive workflows. Release artifacts must be traceable to repository source and generated by the documented automation.
+
+Technical governance is recorded in the repository plans and workflow files. This document describes project responsibility and does not override the GPL or a contributor's applicable rights.

package/notice.md

@@ -0,0 +1,7 @@
+# Cobaia notice
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+Cobaia is open-source software licensed under the GNU General Public License version 3.0 only. The source code, generated artifacts and documentation may include work from third-party projects; each third-party component remains subject to its own license.
+
+The project name and logos are trademarks of their respective owner. The trademark policy does not restrict rights granted by GPL-3.0-only to the source code.

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@wenathlan/cobaia",
   "packageManager": "pnpm@12.3.4",
-  "version": "2.0.155",
+  "version": "2.0.159",
   "description": "cobaia is the monetization surface of the wenathlan family: the content site that carries the plans, the support rails and the honest advertisement slots while the family apps stay clean; the name is provisional until the owner picks the official one",
+  "bin": {
+    "cobaia": "./cli.ts"
+  },
   "type": "module",
   "repository": {
     "type": "git",
@@ -26,22 +29,23 @@
     "@fontsource-variable/inter": "^5.3.0",
     "@fontsource-variable/jetbrains-mono": "^5.3.0",
     "@fontsource-variable/outfit": "^5.3.0",
-    "@hono/node-server": "^2.1.5",
+    "@hono/node-server": "^2.1.6",
     "@libsql/client": "^0.18.0",
     "@prisma/adapter-libsql": "^7.10.1",
     "@prisma/client": "^7.10.1",
-    "@wenathlan/cadria": "^2.0.154",
-    "@wenathlan/debonair": "^2.0.154",
-    "@wenathlan/devthink": "^2.0.154",
-    "@wenathlan/getry": "^2.0.154",
-    "@wenathlan/saddle": "^2.0.154",
-    "@wenathlan/vault": "^2.0.154",
+    "@wenathlan/cadria": "~2.0.155",
+    "@wenathlan/debonair": "~2.0.155",
+    "@wenathlan/devthink": "~2.0.154",
+    "@wenathlan/getry": "~2.0.155",
+    "@wenathlan/saddle": "~2.0.155",
+    "@wenathlan/argan": "~2.0.155",
+    "@wenathlan/vault": "~2.0.155",
     "better-sqlite3": "^13.0.3",
     "drizzle-orm": "^0.45.4",
-    "gsap": "^3.15.0",
+    "gsap": "^3.15.1",
     "hono": "^4.13.16",
     "ink": "^7.1.1",
-    "lucide-react": "^1.67.0",
+    "lucide-react": "^1.68.0",
     "motion": "^12.43.0",
     "react": "^19.3.1",
     "react-devtools-core": "^8.0.0",
@@ -51,7 +55,7 @@
     "z-ai-web-dev-sdk": "^0.0.18"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.6.4",
+    "@biomejs/biome": "^2.6.5",
     "@capacitor/android": "^8.6.0",
     "@capacitor/cli": "^8.6.0",
     "@capacitor/core": "^8.6.0",
@@ -120,7 +124,7 @@
     "hono": "^4.13.16",
     "input-otp": "^1.5.0",
     "jsdom": "26.1.0",
-    "lucide-react": "^1.67.0",
+    "lucide-react": "^1.68.0",
     "mysql2": "^3.24.6",
     "nanoid": "^6.0.2",
     "next-themes": "^0.4.6",
@@ -158,7 +162,7 @@
   },
   "engines": {
     "bare": "^1.18.0",
-    "bun": "^1.4.2",
+    "bun": "^1.4.4",
     "cargo": ">=1.85.0",
     "chrome": "^16.0.912",
     "cnpm": "^9.4.0",
@@ -171,7 +175,7 @@
     "iojs": "^1.0.0",
     "java": ">=17",
     "node": ">=26.13.0 <27",
-    "npm": "^12.1.0",
+    "npm": "^12.2.1",
     "pnpm": "^12.6.0",
     "python": ">=3.11.0",
     "rust": ">=1.85.0",
@@ -181,6 +185,9 @@
     "vscode": "^1.118.0",
     "yarn": "^4.17.1"
   },
+  "peerDependencies": {
+    "playwright": "^1.63.0"
+  },
   "overrides": {
     "body-parser": "^2.4.0",
     "fast-uri": "^3.1.9",

package/pnpm-workspace.yaml

@@ -12,26 +12,34 @@ overrides:
   esbuild: ^0.28.2
   deepmerge-ts: ^8.0.0
   mysql2: ^3.23.1
+  postcss-selector-parser: ^7.1.6
 
 # the freshly published security fixes install before they age: pnpm 12
 # verifies the supply-chain age by default and these four corrections ride
 # the exclusion so the family heals now, not after the waiting window.
+# the native build law (the node 26 v8 gate): ssh2's optional c++ binding
+# speaks the removed v8 context api (GetIsolate), so the gyp lottery dies
+# here in the seat pnpm 12 reads - the pure-js engine answers the lanes
+# and no install ever compiles the broken binding.
+neverBuiltDependencies:
+  - ssh2
+
 minimumReleaseAgeExclude:
   - body-parser@2.4.0
   - fast-uri@3.1.9
   - follow-redirects@1.16.1
   - zod@4.6.6
-  - '@biomejs/biome@2.6.3 || 2.6.4'
-  - '@biomejs/cli-android-arm64@2.6.3 || 2.6.4'
-  - '@biomejs/cli-android-x64@2.6.3 || 2.6.4'
-  - '@biomejs/cli-darwin-arm64@2.6.3 || 2.6.4'
-  - '@biomejs/cli-darwin-x64@2.6.3 || 2.6.4'
-  - '@biomejs/cli-linux-arm64-musl@2.6.3 || 2.6.4'
-  - '@biomejs/cli-linux-arm64@2.6.3 || 2.6.4'
-  - '@biomejs/cli-linux-x64-musl@2.6.3 || 2.6.4'
-  - '@biomejs/cli-linux-x64@2.6.3 || 2.6.4'
-  - '@biomejs/cli-win32-arm64@2.6.3 || 2.6.4'
-  - '@biomejs/cli-win32-x64@2.6.3 || 2.6.4'
+  - '@biomejs/biome@2.6.3 || 2.6.4 || 2.6.5'
+  - '@biomejs/cli-android-arm64@2.6.3 || 2.6.4 || 2.6.5'
+  - '@biomejs/cli-android-x64@2.6.3 || 2.6.4 || 2.6.5'
+  - '@biomejs/cli-darwin-arm64@2.6.3 || 2.6.4 || 2.6.5'
+  - '@biomejs/cli-darwin-x64@2.6.3 || 2.6.4 || 2.6.5'
+  - '@biomejs/cli-linux-arm64-musl@2.6.3 || 2.6.4 || 2.6.5'
+  - '@biomejs/cli-linux-arm64@2.6.3 || 2.6.4 || 2.6.5'
+  - '@biomejs/cli-linux-x64-musl@2.6.3 || 2.6.4 || 2.6.5'
+  - '@biomejs/cli-linux-x64@2.6.3 || 2.6.4 || 2.6.5'
+  - '@biomejs/cli-win32-arm64@2.6.3 || 2.6.4 || 2.6.5'
+  - '@biomejs/cli-win32-x64@2.6.3 || 2.6.4 || 2.6.5'
   - '@types/node@26.6.6'
   - '@capacitor/android@8.6.0'
   - '@capacitor/cli@8.6.0'
@@ -40,13 +48,13 @@ minimumReleaseAgeExclude:
   - '@opencode-ai/sdk@1.19.5'
   - react-resizable-panels@4.15.1 || 4.15.2 || 4.15.3 || 4.16.0 || 4.16.1 || 4.17.0 || 4.18.0
   - '@types/google.maps@3.66.9'
-  - lucide-react@1.64.0 || 1.65.0 || 1.66.0 || 1.67.0
+  - lucide-react@1.64.0 || 1.65.0 || 1.66.0 || 1.67.0 || 1.68.0
   - '@fluentui/react-icons@2.0.345'
-  - '@wenathlan/vault@2.0.152 || 2.0.153 || 2.0.154 || 2.0.155 || 2.1.8'
+  - '@wenathlan/vault@2.0.152 || 2.0.153 || 2.0.154 || 2.0.155 || 2.0.156 || 2.1.8'
   - hono@4.13.16
-  - '@wenathlan/cadria@2.0.154 || 2.0.155 || 2.1.8'
-  - '@wenathlan/debonair@2.0.154 || 2.0.155 || 2.1.8'
-  - '@wenathlan/getry@2.0.154 || 2.0.155'
+  - '@wenathlan/cadria@2.0.154 || 2.0.155 || 2.0.156 || 2.1.8'
+  - '@wenathlan/debonair@2.0.154 || 2.0.155 || 2.0.156 || 2.1.8'
+  - '@wenathlan/getry@2.0.154 || 2.0.155 || 2.0.156'
   - '@tailwindcss/node@4.3.4'
   - '@tailwindcss/oxide-android-arm64@4.3.4'
   - '@tailwindcss/oxide-darwin-arm64@4.3.4'
@@ -68,15 +76,28 @@ minimumReleaseAgeExclude:
   - '@vitest/spy@5.1.0'
   - tailwindcss@4.3.4
   - vitest@5.1.0
-  - '@wenathlan/saddle@2.0.154 || 2.0.155 || 2.1.8'
-  - '@wenathlan/devthink@2.0.154 || 2.0.155'
+  - '@wenathlan/saddle@2.0.154 || 2.0.155 || 2.0.156 || 2.1.8'
+  - '@wenathlan/devthink@2.0.154 || 2.0.155 || 2.0.156 || 2.1.7'
+  - '@wenathlan/argan@2.0.155'
+  - gsap@3.15.1
 # the pnpm settings live here since pnpm 12 (the package.json pnpm field is
 # no longer read, and onlyBuiltDependencies died in pnpm 11 — the map below
-# is allowBuilds). the honest-site surface builds exactly the engines its db
-# layer and toolchain ride on; nothing else is granted a build script.
+# is allowBuilds). THE 2.0.155 BUILDS GATE HEAL: the four-entry map froze
+# the container install (ERR_PNPM_IGNORED_BUILDS on cpu-features, pnpm,
+# protobufjs and ssh2 — every build-carrying package the tree holds must
+# answer the map, true or false, or the frozen install refuses), so the
+# map rides the complete forge form: ssh2 answers false on purpose (the
+# native accelerator refuses the runner node, the pure js fallback carries
+# the line) and pnpm answers false the same way; everything else builds.
 allowBuilds:
   '@prisma/engines': true
+  '@tailwindcss/oxide': true
   better-sqlite3: true
+  cpu-features: true
   esbuild: true
+  pnpm: false
   prisma: true
+  protobufjs: true
+  ssh2: false
+  workerd: true
 dangerouslyAllowAllBuilds: false