openvibers/openvibe.billing Commits

Bump openvibe-shared v2.3.1 → v2.5.0 (#4)

OP OpenVibers committed 3 Oct 2026 · 691d53807d · 4 files, +31 −6

local checks ✓ 3/3 · CI ✓ 3/3 · review SHIP by DeepSeek harness

https://github.com/OpenVibers/OpenVibe.Billing/pull/4

Changes

ddiff --git a/README.md b/README.md
iindex 9ff819d..7fae8f4 100644
---- a/README.md
++++ b/README.md
@@@ -48,7 +48,7 @@ webhooks land here and nowhere else.
  - OpenVibe.Network (JWKS for service tokens; SSO with PKCE for the staff console; `identity.subject.resolve` for the Live import)
  - OpenVibe.Events (the outbox relay, only when `EVENTS_URL` is set)
  - the payment providers whose secrets are configured (none in production today)
--- `openvibe-contracts` v0.76.0, `openvibe-sdk` v0.21.2 (service tokens, per-person limits, `openvibe-sdk/db`), `openvibe-shared` v1.28.0, pinned by release tarball
++- `openvibe-contracts` v0.76.0, `openvibe-sdk` v0.21.2 (service tokens, per-person limits, `openvibe-sdk/db`), `openvibe-shared` v2.5.0, pinned by release tarball
  - **PostgreSQL 18 and Valkey 9** (OpenVibe.Host `roles/data/`, ADR-035): every read and write is async through
    `openvibe-sdk/db`; Valkey holds the per-person limit counters (optional: without `VALKEY_URL` they count in the process)
  
ddiff --git a/package-lock.json b/package-lock.json
iindex 04cb651..977ddcd 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -15,7 +15,7 @@
          "iovalkey": "^0.4.0",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.21.2",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.3.1",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.5.0",
          "pg": "^8.23.0"
        },
        "devDependencies": {
@@@ -1104,12 +1104,15 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "2.3.1",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.3.1",
--      "integrity": "sha512-K+MXnB4O+8xIFi+NQGC2SDTvDq3RkzfxQ3bTVx76Y/Rbuq7kC/L5kL3c/06xr9sPYcjyzF3Bhpv5yH2YNfR4Zw==",
++      "version": "2.5.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.5.0",
++      "integrity": "sha512-fHuUS6SXM7ezatfAyqLm1V8B6puV9YXSnz6aG6XQbWx28qghRCCHeUF3lr4nxiCGdn9SyikYtIyLGL5r1ycp9Q==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
++      },
++      "bin": {
++        "openvibe-build-assets": "scripts/build-assets.js"
        }
      },
      "node_modules/parseurl": {
ddiff --git a/package.json b/package.json
iindex e791068..9f36868 100644
---- a/package.json
++++ b/package.json
@@@ -28,7 +28,7 @@
      "iovalkey": "^0.4.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.21.2",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.3.1",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.5.0",
      "pg": "^8.23.0"
    },
    "engines": {
ddiff --git a/test/dependency-pins.test.js b/test/dependency-pins.test.js
nnew file mode 100644
iindex 0000000..c3b86f5
---- /dev/null
++++ b/test/dependency-pins.test.js
@@@ -0,0 +1,22 @@
++'use strict';
++// The README's "Depends on" versions the shared libraries by the same release tag package.json pins: the
++// latest bump (openvibe-shared v1.28.0 -> v2.5.0) left the prose behind, so a bump no longer touches the
++// pin and the lockfile only. Each pinned tag URL names the version the README must print.
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++
++const root = path.join(__dirname, '..');
++const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
++const readme = fs.readFileSync(path.join(root, 'README.md'), 'utf8');
++
++let checked = 0;
++for (const spec of Object.values(pkg.dependencies || {})) {
++    const m = /codeload\.github\.com\/OpenVibers\/(OpenVibe\.[A-Za-z]+)\/tar\.gz\/refs\/tags\/v(\d+\.\d+\.\d+)$/.exec(String(spec));
++    if (!m) continue;
++    const name = m[1].toLowerCase().replace(/^openvibe\./, 'openvibe-'); // OpenVibe.Shared -> openvibe-shared
++    assert.ok(readme.includes('`' + name + '` v' + m[2]), `the README pins ${name} at v${m[2]}`);
++    checked++;
++}
++assert.ok(checked >= 3, 'the three shared libraries are pinned by tag');
++console.log('dependency pins: the README matches every pinned library');