Commits

main · README.md

openvibe-shared v2.21.1 (was v2.21.0) (#26)OpenVibers · 10 Oct 2026 63a0718
openvibe-shared v2.21.0 (was v2.20.4) (#25)OpenVibers · 10 Oct 2026 239aef8
openvibe-shared v2.20.4 (was v2.20.3) (#24)OpenVibers · 10 Oct 2026 35db0ba
openvibe-contracts v0.127.0 (was v0.126.0) (#23)OpenVibers · 10 Oct 2026 2d1ce61
openvibe-shared v2.20.3 (was v2.20.0) (#22)OpenVibers · 10 Oct 2026 e282f09
openvibe-contracts v0.126.0 (was v0.122.1) (#19)OpenVibers · 10 Oct 2026 3b71ce5
openvibe-shared v2.20.0 (was v2.17.0) (#18)OpenVibers · 9 Oct 2026 f69167c
openvibe-contracts v0.122.1 (was v0.112.0) (#17)OpenVibers · 9 Oct 2026 7a4bfe4
openvibe-shared v2.17.0 (was v2.15.0) (#16)OpenVibers · 9 Oct 2026 b4e5877
Blog: account export and deletion (ADR-033) — a person's own blog closed with its posts removed as its owner would, memberships and drafts deleted, posts elsewhere made authorless (append-only rows only inside the erasure transaction), reviews kept; loopback /internal/events; subscriptions at boot (SDK v0.37.0) (#15)OpenVibers · 9 Oct 2026 c97f7df
openvibe-shared v2.15.0 (was v2.13.2) (#14)OpenVibers · 8 Oct 2026 0dca4f6
openvibe-shared v2.13.2 (was v2.13.0) (#12)OpenVibers · 8 Oct 2026 7f13ce0
openvibe-contracts v0.112.0 (was v0.97.0) (#11)OpenVibers · 7 Oct 2026 3387540
Events moves to openvibe.events: connect-src, stream URLs and shared 2.13.0 / sdk 0.35.0 in one change (plan T7) (#10)OpenVibers · 7 Oct 2026 633c3c2
openvibe-shared 2.12.0: the showcase home and the Frame footer set their font (they rendered serif) (#9)OpenVibers · 7 Oct 2026 2a7bcef
Pin openvibe-contracts v0.97.0 and drop the proposed-capability shim (#8)OpenVibers · 5 Oct 2026 deae9d2
Render every Blog page through openvibe-publishing/layout on shellOpenVibers · 4 Oct 2026 281b384
The Blog home opens with what OpenVibe.Blog is for (plan T11, D92; openvibe-shared v2.3.1 showcase): 'Write on OpenVibe', where to start (Start writing, or read the OpenVibe blog below), and the six things a blog really gets today (drafts and revisions, scheduling, feeds, Community comments, themes, VIP members-only posts); the official blog's posts follow unchanged. The kit's stylesheet is linked only on the home (cached; loaded styles-first on a boost swap). Home budgets raised as a decision (html 29 KB, css 17.5 KB). Suites green.OpenVibers · 29 Sept 2026 05b8bbb
Blog tells search engines when a page changes (plan T11, IndexNow): with INDEXNOW_KEY set the key file is served at /<key>.txt and an indexable page appearing, changing or going away pings the engines (its path and the sitemap); drafts, private and noindex pages never; unset, nothing is mounted or sent. A home-page performance budget runs in CI where there was none. Tests green (verified).OpenVibers · 29 Sept 2026 9d00e2b
Blog moves between its pages without a reload (plan T11): openvibe-shared v2.2.0 boost swaps <main> styles-first with the shared transition, prefetching on intent, and does a normal load across a deploy (the ov-boost marker carries the release). The navbar's sign-in returns to the current page. The SSRF ratchet's lower bound follows the deleted sso.js. Both suites 25/25.OpenVibers · 29 Sept 2026 12380d2
Blog on the service kit (plan T1): sign-in is openvibe-sdk/sso createSsoClient (state + PKCE S256, server-side exchange, next limited to this site and the Network), service tokens are checked by openvibe-sdk/auth verifyServiceToken (the key their kid names), the outbox is createServiceOutbox; server/auth/sso.js and server/events/outbox.js are deleted. Pins: openvibe-sdk v0.25.0, openvibe-contracts v0.79.0, openvibe-shared v2.0.0. Both suites green (verified).OpenVibers · 29 Sept 2026 f3fac6a
The rest of the SQLite-era cleanup (the previous commit carried only its deletions): *_DB_PATH/dbPath out of config, .env.example, the systemd unit and test helpers; the unused better-sqlite3 dependency and its lockfile entries; docs, docstrings and STATUS lines that still described SQLite or its rollback window. Reviewed independently (VERDICT: SHIP). npm test 25/25 test files passed.OpenVibers · 29 Sept 2026 32773c6
openvibe-shared v1.27.0 (from v1.25.0): an async route handler's rejection now reaches the error handler instead of ending the process. Express 4 leaves such a promise unhandled and Node 22 exits on it; instrument() now applies openvibe-shared/express-async. 1.26.0 adds async gauge collects. npm test: 25/25 test files passed.OpenVibers · 28 Sept 2026 f145325
Blog moves to PostgreSQL and Valkey (ADR-035, roadmap WS-X2, repository-pass group G1), async from end to end.OpenVibers · 28 Sept 2026 8c8259f
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner through run() (same files, one at a time as before, 60 s timeout per file, VERBOSE=1 still prints every file's output): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; README and STATUS.json follow). npm test (Node 22) 25/25.OpenVibers · 28 Sept 2026 9f339e3
README and STATUS.json are current (roadmap WS-U task 3): Capabilities is now a level-2 section and lists the grants Blog uses elsewhere, including network.integration.github.read (changelog) and ai.run.create/ai.run.read (AI drafts), which the grants list lacked; Deploy says production deploys with sudo ovhost deploy blog (unit, port, env file, vhost, rollback) and keeps the first-install steps; Security points to SECURITY.md; Depends on names the current pins (publishing v0.4.0, contracts v0.53.0, shared v1.22.0, sdk v0.12.0); the status line no longer says nothing is published (Patch notes posts are). STATUS.json gains contracts and features, drops the stale VIP and one-post claims, and is updated 2026-09-28.OpenVibers · 28 Sept 2026 8a7f8eb
Per-actor rate limits on Blog's /api/v1, the editor and comment posts (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/http/actor-limits.js makes one limiter per app and counts requests once req.viewer is resolved. A person counts as user:usr_…, whether they use their own token or cookie, a service names them in X-OV-Subject, or an app acts for them through on_behalf_of. A first-party service relaying a signed-out visitor counts by the address it forwards. A service or app acting as itself counts by its principal. A signed-out caller counts by address. A first-party service reading for itself is not counted on reads. Neither is GET /api/v1/changelog: OpenVibe.Network reads it for every site's "shipped" widget from loopback without a token, so counting it would treat the whole network as one caller (Network caches each answer for 60 s, and the per-address limit still applies). Past a limit a route answers 429 problem+json rate_limited with Retry-After before any work, including before the body is read, logs one [Limits] line and counts blog_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 21d537c
Moderation audit (ADR-022, WS-D task 1): blog.moderation.action from the outbox in the same transaction when staff unpublish (post.unpublished) or delete (post.deleted) a post only their staff powers allow, with the author as owner_subject; an author or blog editor doing the same reports nothing. Pins: openvibe-contracts 0.49.0 → 0.53.0OpenVibers · 26 Sept 2026 ee4a607
changelog: every site's updates log — commit authors, a page cursor (before), a one-time import of each site's last CHANGELOG_HISTORY commits (never pending, never in a post), the recent patch notes posts and a per-site summary in the feed; polls every 5 minutesOpenVibers · 24 Sept 2026 dc3f3a1
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 d9c7005

More commits