openvibers/openvibe.blog Commits

openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0

OP OpenVibers committed 23 Sept 2026 · c64bc8338b · 7 files, +27 −22

- /release.json is mounted with release.mount(app, { registry }): POST /release-metrics takes open
  tabs' update reports into /metrics (release_client_updates_total). On contracts 0.32.0 the
  manifest carries the release-manifest 1.1.0 fields; no components are declared, so every
  release still prompts a reload. test/seed-ops.test.js validates the served manifest against the
  contracts.
- identity.service-token-claims 1.2.0 (contracts 0.26.0) requires project_id and env on app tokens:
  the mock Network's app tokens carry them, as Network's do. serviceAuth now refuses a sandbox app
  token itself (token.sandbox_refused, the code Blog's own check already answered); no blog.*
  capability can be granted to a developer app (all first-party).
- SDK 0.2.2 -> 0.5.0: Blog uses the token client, createClient and the events outbox, none of which
  changed behaviour. README and STATUS list the new pins.

Changes

ddiff --git a/README.md b/README.md
iindex e92518f..a45a230 100644
---- a/README.md
++++ b/README.md
@@@ -200,8 +200,8 @@ repo pins v0.19.0.
  
  - **Packages** (all pinned by release tarball): `openvibe-publishing` v0.2.1 (revisions, schedule,
    taxonomy, citations, media, discussion, seo, authorship, index-hooks, ssr), `openvibe-contracts`
--  v0.19.0, `openvibe-shared` v1.3.0 (chrome, app icon, footer, legal, release, metrics, ready,
--  theme presets), `openvibe-sdk` v0.2.2 (events outbox, service tokens).
++  v0.32.0, `openvibe-shared` v1.5.0 (chrome, app icon, footer, legal, release, metrics, ready,
++  theme presets), `openvibe-sdk` v0.5.0 (events outbox, service tokens).
  - **OpenVibe.Network:**
    - SSO: the OAuth client `blog` is already seeded with redirect
      `https://openvibe.blog/auth/callback`.
ddiff --git a/STATUS.json b/STATUS.json
iindex c3d6cf2..531ce12 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -9,9 +9,9 @@
    "domain": "openvibe.blog",
    "packages": [
      "openvibe-publishing v0.2.1",
--    "openvibe-contracts v0.19.0",
--    "openvibe-shared v1.3.0",
--    "openvibe-sdk v0.2.2"
++    "openvibe-contracts v0.32.0",
++    "openvibe-shared v1.5.0",
++    "openvibe-sdk v0.5.0"
    ],
    "capabilities": [
      "blog.blog.create",
ddiff --git a/package-lock.json b/package-lock.json
iindex 9b9fc0d..01e9b65 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -15,10 +15,10 @@
          "express": "^4.21.2",
          "express-rate-limit": "^7.5.0",
          "helmet": "^8.1.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.19.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.32.0",
          "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v0.2.1",
--        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.2.2",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.3.0"
++        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.5.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.0"
        },
        "devDependencies": {
          "jsonwebtoken": "^9.0.2"
@@@ -1015,9 +1015,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.19.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.19.0",
--      "integrity": "sha512-5DjPvXIfc68wZhFXgKlCzDarbbFD5dUV4yYQIKEK1qD+VIuR+4twbON1brdyM9rYZyRyYClPigAqReocmRGytg==",
++      "version": "0.32.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.32.0",
++      "integrity": "sha512-ntN58SIG03YDxbhsiIzOM5GRH19jRMHZUYWI3xU2VwovExagF5DdwApLVfezsu84UTJ+V2Jfn+LWDc+Oz8ab+g==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
@@@ -1060,18 +1060,18 @@
        }
      },
      "node_modules/openvibe-sdk": {
--      "version": "0.2.2",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.2.2",
--      "integrity": "sha512-kDifUp3EcmnTWzElAmaCZnX659WErcnm4+qVEoAiYQWX/w/1p4TWvoHbUPsrX65TSROVR3tiyVkl801n/0yyCw==",
++      "version": "0.5.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.5.0",
++      "integrity": "sha512-QVJkR5iazQX0ZwIrDp2A88ZeYYBSXEmSzhpgURPUSnzezIM3jz0HBhVKowyhkvg2aBO61XNf77eb4zJGkMjZiw==",
        "license": "MIT",
        "engines": {
          "node": ">=20"
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "1.3.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.3.0",
--      "integrity": "sha512-w8yl/5+9eend8I2O/DzAJnEAL2N3GTUY7c7pzK+MLJuLAGD8FmJJQ9gwbgyrq70Snjt3ebrg3TlpORhRAp2kgA==",
++      "version": "1.5.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.0",
++      "integrity": "sha512-cehnscuYMkJwuCYGcI6wPSswbUn0bhTyGAaD5feNCoO//2e9gyC7cgjkEcIOtM8DQF3yTuUNyXnOwckIeM4fUg==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
ddiff --git a/package.json b/package.json
iindex c0f82a3..07f235d 100644
---- a/package.json
++++ b/package.json
@@@ -21,10 +21,10 @@
      "express": "^4.21.2",
      "express-rate-limit": "^7.5.0",
      "helmet": "^8.1.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.19.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.32.0",
      "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v0.2.1",
--    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.2.2",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.3.0"
++    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.5.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.0"
    },
    "devDependencies": {
      "jsonwebtoken": "^9.0.2"
ddiff --git a/server/app.js b/server/app.js
iindex 9c3c876..55796f4 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -105,7 +105,8 @@ function createApp(opts = {}) {
  
      // ── Machine endpoints ───────────────────────────────────
      app.get('/api/health', (_req, res) => res.json({ status: 'ok', service: 'openvibe-blog', version: VERSION }));
--    app.get('/release.json', release.handler);
++    // GET /release.json (ADR-016) and POST /release-metrics: open tabs' update reports into /metrics.
++    release.mount(app, { registry: metrics.registry });
      const readiness = createBlogReadiness({ store, auth, outbox, release: release.release });
      app.get('/api/ready', readiness.handler);
  
ddiff --git a/test/helpers/mocks.js b/test/helpers/mocks.js
iindex 363268e..a0ee0e2 100644
---- a/test/helpers/mocks.js
++++ b/test/helpers/mocks.js
@@@ -65,8 +65,10 @@ async function startNetwork() {
          return json(404, { error: 'not found' });
      });
      issuer = srv.url;
++    // An app token carries its developer project and env, as Network's do (identity.service-token-claims 1.2.0).
      function signService({ sub, aud, cap, ns, actorType = 'service', extra = {} }) {
--        return serviceAuth.signServiceToken({ iss: issuer, sub, actor_type: actorType, aud, cap, ...(ns ? { ns } : {}), iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 300, jti: crypto.randomUUID(), ...extra }, privatePem);
++        const app = actorType === 'app' ? { project_id: 'prj_01J8ZQ4Y7N3M2K1H0G9F8E7D6C', env: 'production' } : {};
++        return serviceAuth.signServiceToken({ iss: issuer, sub, actor_type: actorType, aud, cap, ...(ns ? { ns } : {}), iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 300, jti: crypto.randomUUID(), ...app, ...extra }, privatePem);
      }
      function addUser(username, extra = {}) {
          const subject = ids.newId('user');
ddiff --git a/test/seed-ops.test.js b/test/seed-ops.test.js
iindex 3975bbc..c890fe8 100644
---- a/test/seed-ops.test.js
++++ b/test/seed-ops.test.js
@@@ -65,6 +65,8 @@ const { seedOfficialPost, loadFacts, SLUG } = require('../server/seed');
          const rel = await t.get('/release.json');
          assert.strictEqual(rel.status, 200);
          assert.strictEqual(rel.json().service, 'blog');
++        assert.deepStrictEqual(require('openvibe-contracts').validate('registry.release-manifest@1', rel.json()).errors, []);
++        assert.strictEqual(rel.json().metrics_url, '/release-metrics');
      });
  
      await check('robots.txt names the sitemap and the automated-consumer policy; llms.txt orients machines', async () => {