@wenathlan/cobaia 2.0.166 → 2.0.168

package/cobaia.csproj

@@ -4,7 +4,7 @@
     <AssemblyName>cobaia</AssemblyName>
     <RootNamespace>cobaia</RootNamespace>
     <PackageId>cobaia</PackageId>
-    <Version>2.0.166</Version>
+    <Version>2.0.168</Version>
     <Authors>wenathlan</Authors>
     <Description>Distribution package containing the cobaia documentation set and the tests directory. cobaia is the monetization surface — the plans, the support rails and the honest advertisement slots.</Description>
     <PackageLicenseExpression>GPL-3.0-only</PackageLicenseExpression>
@@ -17,6 +17,6 @@
   <ItemGroup>
     <None Include="README.md" Pack="true" PackagePath="/" />
     <None Include="docs/**/*" Pack="true" PackagePath="contentFiles/any/any/docs/" />
-    <None Include="tests/**/*" Pack="true" PackagePath="contentFiles/any/any/tests/" />
+    <None Include="test/**/*" Pack="true" PackagePath="contentFiles/any/any/test/" />
   </ItemGroup>
 </Project>

package/cobaia.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |spec|
   spec.name = "cobaia"
-  spec.version = ENV.fetch("COBAIA_VERSION", "2.0.166")
+  spec.version = ENV.fetch("COBAIA_VERSION", "2.0.168")
   spec.authors = ["wenathlan"]
   spec.email = ["support@users.noreply.github.com"]
   spec.summary = "The cobaia documentation and tests envelope (the monetization surface — the plans, the support rails and the honest advertisement slots)."
@@ -8,7 +8,7 @@ Gem::Specification.new do |spec|
   spec.homepage = "https://github.com/wenathlan/devthink"
   spec.license = "GPL-3.0-only"
   spec.required_ruby_version = ">= 3.1"
-  spec.files = Dir["README.md", "docs/**/*", "tests/**/*"]
+  spec.files = Dir["README.md", "docs/**/*", "test/**/*"]
   spec.metadata["source_code_uri"] = "https://github.com/wenathlan/devthink"
   spec.metadata["homepage_uri"] = spec.homepage
 end

package/cobaia.java

@@ -10,7 +10,7 @@ package com.wenathlan.cobaia;
  */
 final class Cobaia {
   /** The version of the cobaia envelope (the six-distribution completeness wave). */
-  public static final String VERSION = "2.0.166";
+  public static final String VERSION = "2.0.168";
   private Cobaia() {
   }
 }

package/cobaia.rs

@@ -0,0 +1,8 @@
+//! The cobaia version envelope carrier.
+//!
+//! The carrier answers the lowercase file name doctrine: the envelope
+//! carries the version constant the metadata lockstep stamps, the cargo
+//! lane packages it, the registry lanes never compile it locally.
+
+/// The version of the cobaia envelope (the family tri-channel wave).
+pub const VERSION: &str = "2.0.167";

package/db.ts

@@ -8,6 +8,7 @@
  * tables over HTTPS (GET/POST /api/v1/onboarding, GET /api/v1/ui/content);
  * no server route lives here.
  */
+import { createOnboardingStore } from "@wenathlan/vault/onboardingstore";
 import { openStorageLane } from "@wenathlan/vault/storage";
 import { CONTENTKINDS, type contentrow, seedAdsLabel, seedAdsEmpty, seedAdsSlots, seedPlans, seedPosts, seedRoster, seedSupportLinks } from "./content";
 import { LABEL_MANIFEST, LABEL_REVISION } from "./labels";
@@ -70,6 +71,12 @@ export type OnboardingStateRow = {
 /** the stage flags the entry flow consults, as booleans. */
 export type OnboardingFlags = { introseen: boolean; onboardingseen: boolean };
 
+/** the onboarding store of the site: the vault factory over the site's own
+ * storage lane (the seen-flags table rides the app schema, the read and the
+ * seen-wins upsert ride the shared mechanism — never duplicated inside the
+ * app; the storage lane law of the family, the labelstore precedent). */
+const onboardingstore = createOnboardingStore(lane);
+
 /**
  * Reads the onboarding stage flags of one visitor (parameterized; undefined
  * before the first write). The browser accessor serves the same flags over
@@ -79,17 +86,13 @@ export type OnboardingFlags = { introseen: boolean; onboardingseen: boolean };
  * @returns the flags, or undefined when the visitor never wrote.
  */
 export function getOnboardingState(visitor: string): OnboardingFlags | undefined {
-  const row = queryOne<Pick<OnboardingStateRow, "introseen" | "onboardingseen">>(
-    "SELECT introseen, onboardingseen FROM onboarding_states WHERE visitor = ?",
-    [visitor],
-  );
-  if (!row) return undefined;
-  return { introseen: row.introseen === 1, onboardingseen: row.onboardingseen === 1 };
+  return onboardingstore.getOnboardingState(visitor);
 }
 
 /**
- * Marks one onboarding stage seen for a visitor — idempotent seen-wins
- * upsert (a stage seen anywhere stays seen), prepared and parameterized,
+ * Marks one onboarding stage seen for a visitor — the idempotent seen-wins
+ * upsert of the vault store (a stage seen anywhere stays seen; the later
+ * stage implies the earlier — the flow order), prepared and parameterized,
  * never concatenated SQL.
  *
  * @param visitor the visitor key of the row.
@@ -97,15 +100,7 @@ export function getOnboardingState(visitor: string): OnboardingFlags | undefined
  * @returns the flags after the write.
  */
 export function setOnboardingStage(visitor: string, stage: "intro" | "onboarding"): OnboardingFlags {
-  execute(
-    `INSERT INTO onboarding_states (visitor, introseen, onboardingseen, updatedAt)
-     VALUES (?, ?, ?, datetime('now'))
-     ON CONFLICT(visitor) DO UPDATE SET
-       introseen = MAX(introseen, excluded.introseen),
-       onboardingseen = MAX(onboardingseen, excluded.onboardingseen),
-       updatedAt = datetime('now')`,
-    [visitor, stage === "intro" ? 1 : 0, stage === "onboarding" ? 1 : 0],
-  );
+  onboardingstore.setOnboardingStage(visitor, stage);
   return getOnboardingState(visitor) ?? { introseen: false, onboardingseen: false };
 }
 

package/docker-compose.yml

@@ -0,0 +1,58 @@
+# cobaia docker-compose — the two-service deploy of the monetization face: the
+# static theme served by the cobaia-face nginx door beside the /api/* proxy lane
+# that carries every platform call to the cobaia engine. until this file the
+# app rode the registry image alone: no compose seated the pair, and every
+# /api call of the face answered the away rehearsal. this file wires the
+# pair the vault compose law standardizes:
+#
+#   cobaia-engine  the cobaia site container the publish lane builds from the staged
+#           family context (the app nested under app/ with the vault sibling
+#           the copy law carries): the built theme behind the unprivileged
+#           nginx, EXPOSE 8080, the wget listen probe the image carries
+#   cobaia-face  the nginx surface: the family conf (nginx.conf) mounted over
+#           the default conf — the resolver law, the security header law,
+#           the gzip and cache law, the /api/* proxy lane to the engine,
+#           the spa rewrite as try_files, host 8083 published on 8080.
+#
+# the engine image is the one the registry lane publishes (ghcr.io/wenathlan/cobaia:<version>
+# — the publish matrix); the publish matrix builds the same image from the staged family context (the app nested under app/ with the vault sibling the copy law carries):
+#
+#   rm -rf familybuildctx && mkdir -p familybuildctx/app
+#   cp -a cobaia/. familybuildctx/app/
+#   cp -a vault/. familybuildctx/vault/ && rm -rf familybuildctx/vault/node_modules
+#   docker build -f cobaia/Dockerfile familybuildctx
+#
+# the /api lane carries the platform calls same-origin: the face proxies
+# them to the cobaia container, and the data lanes the browser contract
+# demands ride the configured gateway base the build stamps (the https law
+# the modules carry).
+
+services:
+  cobaia-engine:
+    image: "ghcr.io/wenathlan/cobaia:${COBAIA_VERSION:-2.0.167}"
+    # the engine never publishes a port by default: the face proxies it on
+    # the private compose network (the vault precedent). uncomment to serve
+    # the engine lane directly behind your own door:
+    # ports:
+    #   - "3213:8080"
+    # the healthcheck rides the image (wget -qO- http://127.0.0.1:8080/ —
+    # the listen probe the site container carries): the face gates on it below.
+    init: true
+    restart: unless-stopped
+
+  cobaia-face:
+    image: "ghcr.io/wenathlan/cobaia:${COBAIA_VERSION:-2.0.167}"
+    volumes:
+      # the family conf over the default site conf: the resolver law, the
+      # security headers, the gzip and cache law, the /api proxy lane.
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      # the face starts only when the engine health lane answered — the
+      # proxy upstream is live before the first /api/* call arrives.
+      cobaia-engine:
+        condition: service_healthy
+    ports:
+      # the public door: host 8083 → the unprivileged nginx on 8080.
+      # remap freely ("8084:8080") when another service owns the host.
+      - "8083:8080"
+    restart: unless-stopped

package/docker.config

@@ -0,0 +1,74 @@
+{
+  "meta": {
+    "name": "docker.config",
+    "title": "cobaia - the container configuration of the monetization site (the compose pair, the nginx face, the site container)",
+    "version": "2.0.167",
+    "date": "2026-11-06",
+    "language": "en",
+    "sources": [
+      "app:Dockerfile [the cobaia site container — solbuild vite stage + the nginx-unprivileged face, EXPOSE 8080, the wget listen healthcheck]",
+      "app:docker-compose.yml [the pair: cobaia-engine + cobaia-face, host 8083:8080, the engine direct lane 3213:8080 unpublished by default]",
+      "app:nginx.conf [the vault pattern: resolver 127.0.0.11 valid=10s ipv6=off, location ^~ /api/, the _headers security law, the faun block, the root-emit seal]",
+      "app:vite.config.ts [the root-emit outDir law — the hashed bundles land at the application root]",
+      "app:package.json [the version stamp the compose args and this manifest carry]",
+      "vault:nginx.conf [the reference pattern the family standardizes — the resolver law, the proxy lane, the header law]",
+      "saddle:docker.config [the meta format this manifest follows — name, title, version, date, language, sources, mergeReport]",
+      "app:content.ts [the platform content lane the /api proxy carries — the https base law]"
+    ],
+    "mergeReport": {
+      "rootFiles": [
+        "Dockerfile",
+        "docker-compose.yml",
+        "nginx.conf",
+        "docker.config"
+      ],
+      "composeServices": [
+        "cobaia-engine",
+        "cobaia-face"
+      ],
+      "portMap": {
+        "face": "8083:8080",
+        "engineDirect": "3213:8080 (unpublished by default — the face proxies the private compose network)"
+      },
+      "healthLane": "the image healthcheck (wget -qO- http://127.0.0.1:8080/) — the listen probe",
+      "conflictResolution": "the vault nginx.conf pattern owns the conf law and the saddle docker.config meta format owns this manifest — one owner per law, the family consumes (the engineowners doctrine)",
+      "pinPatch": "the family base nginxinc/nginx-unprivileged:1.29-alpine@sha256:0c79d56aee561a1d81c63f00eee5fb5fe29279560cdc55e91425133104c7fbe6 rides the pattern faces; the static faces ride the registry site image the publish lane stamps"
+    }
+  },
+  "engine": {
+    "service": "cobaia-engine",
+    "surface": "the cobaia site container the publish lane builds (the staged family context the Dockerfile reads); the image healthcheck probes the listen port (wget http://127.0.0.1:8080/)",
+    "port": "8080",
+    "healthcheck": "wget -qO- http://127.0.0.1:8080/ (rides the image)",
+    "stateHome": "stateless — the site container carries no store",
+    "entry": "the site container (nginx serving the built theme)"
+  },
+  "face": {
+    "service": "cobaia-face",
+    "image": "ghcr.io/wenathlan/cobaia:2.0.167",
+    "surface": "the nginx face: the family conf (nginx.conf) mounted over the default site conf of the same cobaia image — resolver 127.0.0.11, the _headers security law, gzip, the hashed-asset cache, the ^~ /api proxy lane, the faun and root-emit seals, the try_files spa rewrite",
+    "listen": 8080,
+    "seals": [
+      "the faun db block (403)",
+      "the root-emit source seal (403)",
+      "the dotfile seal (403)",
+      "the tree seal (node_modules, tests, docs, sol — 403)"
+    ],
+    "spaRewrite": "try_files $uri $uri/ /index.html"
+  },
+  "apiLane": {
+    "route": "/api/*",
+    "upstream": "http://cobaia-engine:8080",
+    "resolver": "127.0.0.11 valid=10s ipv6=off (the docker embedded dns — request-time resolution, the vault law)",
+    "body": "client_max_body_size 0 — the engine quota gate is the only ceiling",
+    "timeouts": "read 300s / send 300s",
+    "carries": "the monetization console rides the platform content lanes (GET /api/v1/ui/content) through the configured https base the build stamps; the /api lane carries the same-origin calls to the cobaia container"
+  },
+  "ports": {
+    "faceHost": 8083,
+    "faceInternal": 8080,
+    "engineInternal": 8080,
+    "engineDirectCommented": 3213,
+    "collisionLaw": "every family face owns one distinct host door (80 for vault, 8081-8090 for the ten siblings) — no two composes ever claim the same host port"
+  }
+}

package/homebrew.rb

@@ -0,0 +1,25 @@
+# wenathlan-cobaia — the homebrew formula of the family (the homebrew channel).
+# The lane stamps the version and sha256 at push time (the sums derive from
+# the release tarball assets the release lane builds, never hardcoded).
+class WenathlanCobaia < Formula
+  desc "The monetization surface — the plans, the support rails and the honest advertisement slots"
+  homepage "https://github.com/wenathlan/devthink"
+  url "https://github.com/wenathlan/devthink/releases/download/v2.0.167/wenathlan-cobaia-2.0.167.tgz"
+  version "2.0.167"
+  # sha256 stamped by the lane from the release asset (never hardcoded)
+  sha256 "0000000000000000000000000000000000000000000000000000000000000000"
+
+  depends_on "node"
+
+  def install
+    libexec.install Dir["*"]
+    (bin/"wenathlan-cobaia").write <<~SH
+      #!/bin/bash
+      exec "#{libexec}/cli.js" "$@"
+    SH
+  end
+
+  test do
+    assert_match "2.0.167", shell_output("#{bin}/wenathlan-cobaia --version")
+  end
+end

package/keywords.txt

@@ -0,0 +1 @@
+cobaia, cobaia app, cobaia devthink, cobaia monetization, devthink os, wenathlan, monetization surface, monetization app, mrr plans, subscription plans, honest ads, ad slots, ad inventory, ad placements, checkout links, github sponsors, ko-fi, support links, donation links, open source funding, creator monetization, posts feed, content publishing, public content, roster page, team roster, pricing page, plan comparison, free plan, pro plan, business plan, revenue dashboard, monetization dashboard, static monetization site, vite monetization app, react monetization app, open source monetization, developer tools monetization, monetization strategy, passive income, funding goals, sponsor tiers, transparent revenue, wenathlan cobaia, devthink family, monetization app 2026

package/monetization.ts

@@ -0,0 +1,248 @@
+// # monetization.ts — the one keyword file of the monetization domain: the
+// consolidation law of the root (PR3 of the uploaded rules — one keyword
+// file per domain, "unifique num único módulo as lógicas variantes +
+// correlacionadas que hoje encontram-se espalhadas") merged the four
+// monetization doors of the cobaia site into this seat — the honest ad slot
+// registry (the former adsconfig.ts body below), the typed billing accessor
+// (checkoutlinks.ts), the seed blog accessor (posts.ts) and the family
+// directory accessor (roster.ts) — every export preserved verbatim, zero
+// logic changes, zero behavior changes. The consolidation notes: the doors
+// shared no duplicated helper (each rode its own thin accessors over the
+// content lane), so the one import the four sources repeated — the
+// content.ts door of the uistore chain — rides once at the top; and no two
+// sources double-declared a const or a decl under one name, so every export
+// keeps the exact name the importers always read (the wingets index
+// re-exports the roster pair by name so its surface stays identical). The
+// four source files are deleted; every importer reads this one seat.
+
+import {
+  type blogpost,
+  type checkoutplan,
+  contenttable,
+  contentvalue,
+  type familymember,
+  seedPlans,
+  seedPosts,
+  seedRoster,
+  seedSupportLinks,
+  type supportlinks as supportlinkstable,
+} from "./content.ts";
+
+export type { blogpost, checkoutplan, familymember, supportlinkstable as supportlinks };
+
+/* ════════════════════════════════════════════════════════════════════ */
+/* SECTION: adsconfig.ts — the honest ad slot registry (the ad seat).   */
+/* ════════════════════════════════════════════════════════════════════ */
+
+// # adsconfig.ts — the honest ad slot registry of the family site, pure data
+// at the app root. The family site carries ONE reserved ad container per
+// content page (home, the app directory, the blog index), always at the end
+// of the content, always labeled "advertisement", always a fixed aspect
+// ratio so the page never shifts when a real unit arrives.
+//
+// THE SCRIPT RULE: no ad network script lives in this repository. The
+// AdSense (or equivalent) loader is injected AFTER the network approves the
+// site, through the deploy environment only. Until then the slot ids stay
+// empty and the container renders the honest empty note. No network call,
+// no click encouragement, no automated traffic ever touches an ad surface —
+// invalid traffic is the one thing that kills both the ad account and the
+// domain reputation, so the family does not do it.
+
+/** one reserved ad slot: the config id and the reserved shape. */
+export type adsslot = {
+  /** the ad network slot id — empty until the owner configures it after approval */
+  slotid: string;
+  /** the display format the reserved box mimics */
+  format: string;
+  /** the css aspect-ratio value the container reserves (never shifts layout) */
+  ratio: string;
+};
+
+/** the fixed label every ad container renders, visible and honest. */
+export const ADS_LABEL = "advertisement";
+
+/** the honest note the container renders while no slot id is configured. */
+export const ADS_EMPTY = "ad slot not configured yet";
+
+/** the reserved slots per content page, keyed by the page folder name. */
+export const ADSSLOTS: Readonly<Record<string, adsslot>> = {
+  home: { slotid: "", format: "display", ratio: "728 / 90" },
+  apps: { slotid: "", format: "in-feed", ratio: "3 / 1" },
+  blog: { slotid: "", format: "in-article", ratio: "3 / 1" },
+};
+
+/**
+ * Reads the reserved slot of one content page.
+ *
+ * @param page the page folder name (home, apps, blog).
+ * @returns the slot, or undefined when the page carries no slot.
+ */
+export function adsslotfor(page: string): adsslot | undefined {
+  return ADSSLOTS[page];
+}
+
+/**
+ * Answers whether a slot is configured with a real network id. An empty
+ * (or whitespace) slot id means the container stays an honest placeholder.
+ *
+ * @param slot the reserved slot entry.
+ * @returns true only when the slot id carries a value.
+ */
+export function adsslotlive(slot: adsslot | undefined): boolean {
+  return slot !== undefined && slot.slotid.trim().length > 0;
+}
+
+/* ════════════════════════════════════════════════════════════════════ */
+/* SECTION: checkoutlinks.ts — the typed billing accessor (the plans     */
+/* seat).                                                                */
+/* ════════════════════════════════════════════════════════════════════ */
+
+// # checkoutlinks.ts — the typed accessor of the billing configuration of
+// the family site: the thin door the pricing page, the support page and
+// the intro plans zone import, answering the plan table and the support
+// channels of the content lane (content.ts — the manifest; db.ts — the
+// content_rows table; the platform gateway — GET /api/v1/ui/content). The
+// data never lives here anymore: checkoutlinks() and supportlinks() answer
+// the live rows the platform served, the manifest seed otherwise (the
+// uistore chain). The payment links themselves are configuration, never
+// code: the owner pins the checkout hrefs (Stripe Payment Links or Paddle
+// overlays) into the store once billing goes live. Until then every href
+// ships empty and the interface renders the honest empty state — "checkout
+// not configured yet" — instead of pretending.
+//
+// The words never ride here: every plan sentence (name, billing period,
+// blurb, features) answers from the label store (labels.ts — the manifest
+// the seed carries into the site database), so the pricing cards and the
+// intro plans zone read their prose through the typed accessor and this
+// lane keeps only the billing values — ids, prices and links.
+//
+// No network call ever happens here: the links are plain hrefs the visitor
+// chooses to follow, no key is committed (not even a placeholder that looks
+// real) and no script is loaded. The prices are placeholders (US$0 / 5 / 19
+// per month) until the billing platform decision lands.
+
+/**
+ * The typed accessor of the pricing table: the live db rows when the
+ * platform answered, the manifest seed otherwise — in display order (the
+ * prose answers from the label store; only the billing values ride this
+ * lane).
+ *
+ * @returns the plans of the /pricing page.
+ */
+export function checkoutlinks(): readonly checkoutplan[] {
+  return contenttable("plans", seedPlans);
+}
+
+/**
+ * The typed accessor of the support channels: the live db row when the
+ * platform answered, the manifest seed otherwise — the same rule as the
+ * plans: hrefs stay empty until the owner configures them.
+ *
+ * @returns the support channels of the /support page.
+ */
+export function supportlinks(): Readonly<supportlinkstable> {
+  return contentvalue("supportlinks", seedSupportLinks);
+}
+
+/**
+ * Answers whether a configured link is live. An empty (or whitespace) href
+ * means the feature is not configured yet and the interface must say so.
+ *
+ * @param href the configured link href.
+ * @returns true only when the href carries a real target.
+ */
+export function isconfigured(href: string): boolean {
+  return href.trim().length > 0;
+}
+
+/**
+ * Finds one plan of the table by its stable id.
+ *
+ * @param id the plan id (free, pro, studio).
+ * @returns the plan, or undefined when no plan carries the id.
+ */
+export function planbyid(id: string): checkoutplan | undefined {
+  return checkoutlinks().find((plan) => plan.id === id);
+}
+
+/* ════════════════════════════════════════════════════════════════════ */
+/* SECTION: posts.ts — the seed blog accessor (the blog seat).          */
+/* ════════════════════════════════════════════════════════════════════ */
+
+// # posts.ts — the typed accessor of the seed blog: the thin door the blog
+// page and the tests import, answering the posts of the content lane
+// (content.ts — the manifest; db.ts — the content_rows table; the platform
+// gateway — GET /api/v1/ui/content). The data never lives here anymore:
+// posts() answers the live rows the platform served, the manifest seed
+// otherwise (the uistore chain), the index sort and the honest word count
+// stay exactly where they rode, and the blog index (/blog) renders the
+// sorted index and the full bodies through this door — real, written
+// content about how the family is built, so the site is useful on its own
+// merits (the ad networks approve content, not containers). New posts
+// append to the manifest; the index sorts by date, so the manifest order
+// never matters.
+
+/**
+ * The typed accessor of the blog: the live db rows when the platform
+ * answered, the manifest seed otherwise.
+ *
+ * @returns the posts of the blog.
+ */
+export function posts(): readonly blogpost[] {
+  return contenttable("posts", seedPosts);
+}
+
+/**
+ * Builds the blog index: the posts sorted by date, newest first. The ISO
+ * date sort is lexicographic and stable, so the index order never depends
+ * on the row order the store answers.
+ *
+ * @returns the posts of the blog, newest first.
+ */
+export function postindex(): readonly blogpost[] {
+  return [...posts()].sort((a, b) => {
+    if (a.date < b.date) return 1;
+    if (a.date > b.date) return -1;
+    return 0;
+  });
+}
+
+/**
+ * Counts the words of one post's body — the honest length measure the tests
+ * and the page footer can both read.
+ *
+ * @param post the post to measure.
+ * @returns the total word count across the body paragraphs.
+ */
+export function postwords(post: blogpost): number {
+  return post.body.join(" ").split(/\s+/).filter(Boolean).length;
+}
+
+/* ════════════════════════════════════════════════════════════════════ */
+/* SECTION: roster.ts — the family directory accessor (the directory    */
+/* seat).                                                                */
+/* ════════════════════════════════════════════════════════════════════ */
+
+// # roster.ts — the typed accessor of the family directory data: the thin
+// door the /apps page, the shell footer, the home preview and the intro
+// footer import, answering the roster of the content lane (content.ts —
+// the manifest; db.ts — the content_rows table; the platform gateway — GET
+// /api/v1/ui/content). The data never lives here anymore: roster() answers
+// the live rows the platform served, the manifest seed otherwise (the
+// uistore chain). Every deploy unit beside the cobaia, with the one accent
+// each carries (the spec §12 table, mirrored from the argan contract; the
+// devthink OS rides the family sun) and the honest role each app declares
+// in its own devthink.toml — condensed to one line, nothing embellished:
+// the page and the tests read the same table through this door, so the
+// directory can never drift from the family.
+
+/**
+ * The typed accessor of the directory: the live db rows when the platform
+ * answered, the manifest seed otherwise — rail order, the OS first, then
+ * the applications.
+ *
+ * @returns the directory roster.
+ */
+export function roster(): readonly familymember[] {
+  return contenttable("roster", seedRoster);
+}

package/nginx.conf

@@ -0,0 +1,106 @@
+# cobaia face — the monetization face: the nginx surface of the cobaia container pair.
+# the static theme of the cobaia container pair: the ads and plans console
+# the vite build assembles into the site container, served beside the /api/*
+# proxy lane that carries every platform call to the cobaia container.
+# until this conf the app rode the registry image alone: no compose seated
+# the pair, and every /api call of the theme answered the away rehearsal.
+#
+# the resolver is the docker embedded dns (127.0.0.11) — the vault face law
+# the family standardizes: the engine hostname resolves at request time, so
+# this container starts even while the engine recovers and keeps answering
+# after an engine recreation changes its address (an upstream block would
+# pin the address at config load and die with the first engine restart).
+
+resolver 127.0.0.11 valid=10s ipv6=off;
+
+server {
+    listen 8080;
+    server_name _;
+
+    # the staged theme surface (the shell, the hashed bundles, the fonts,
+    # the icons and the crawler files the build stages).
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # the security header set the netlify _headers file declares — one
+    # header law across every deploy surface of the family.
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options DENY always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+
+    # the transport law: the text faces ride compressed, the proxied
+    # answers included (gzip_proxied any — the engine lanes compress the
+    # same way).
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 1024;
+    gzip_types text/plain text/css text/javascript application/javascript application/json application/xml image/svg+xml text/webmanifest;
+
+    # the api lane — every /api/* call rides the engine upstream (the
+    # compose `cobaia-engine` service, port 8080): the ^~ law keeps the lane
+    # ahead of every regex block below (a hashed asset pattern never steals
+    # an api path), the platform headers pass verbatim, the raw bodies ride
+    # un-sized (client_max_body_size 0 — the engine's own quota gate is the
+    # only ceiling a call answers), and the generous read window covers the
+    # slow platform lanes.
+    location ^~ /api/ {
+        set $cobaia_engine http://cobaia-engine:8080;
+        proxy_pass $cobaia_engine;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        client_max_body_size 0;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+
+    # the faun block of the face lane (the vault law): a database face
+    # inside the staged tree answers 403 — the raw store never ships over
+    # the face, the data flows through /api only.
+    location ~* \.(db|sqlite|sqlite3)(-wal|-shm|-journal)?$ {
+        return 403;
+    }
+
+    # the root-emit seal: the staged tree carries the sources beside the
+    # built faces (the family root-emit law), so the faces the platform
+    # lanes never publish answer the refusal here — the engine sources,
+    # the manifests and the lockfiles never leave the tree.
+    location ~* \.(ts|tsx|mts|cts|sql|prisma|lock|gemspec|csproj|java|go|kts|jsonc|json|toml|xml)(-wal|-shm|-journal)?$ {
+        return 403;
+    }
+
+    # the dotfile seal: the environment faces (.env, the editor seats)
+    # never answer over the face.
+    location ~* /\. {
+        return 403;
+    }
+
+    # the tree seal: the source homes the build never assembles refuse the
+    # same way (the modules, the suites, the docs, the sol sources).
+    location ~* ^/(node_modules|tests|docs|sol)(/|$) {
+        return 403;
+    }
+
+    # the hashed-asset cache law: the bundles the build stamps carry the
+    # content hash in the name, so the long lease is honest — the security
+    # header set repeats inside the lease the way the nginx inheritance law
+    # demands (an add_header at the location level would drop the server set).
+    location ~* \.(js|css|svg|woff2?|png|jpg|jpeg|webp|avif|ico|webmanifest)$ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options nosniff always;
+        add_header X-Frame-Options DENY always;
+        add_header Referrer-Policy strict-origin-when-cross-origin always;
+    }
+
+    # the SPA rewrite the vercel/netlify configs declare: every deep link
+    # serves the shell, the router resolves it (the former site container
+    # had no fallback — a deep link answered 404).
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}