Commits

main · package.json

openvibe-contracts v0.127.0 (was v0.126.0) (#23)OpenVibers · 10 Oct 2026 2d1ce61
openvibe-shared v2.20.3 (was v2.20.0) (#22)OpenVibers · 10 Oct 2026 e282f09
openvibe-contracts v0.126.0 (was v0.122.1) (#19)OpenVibers · 10 Oct 2026 3b71ce5
openvibe-shared v2.20.0 (was v2.17.0) (#18)OpenVibers · 9 Oct 2026 f69167c
openvibe-contracts v0.122.1 (was v0.112.0) (#17)OpenVibers · 9 Oct 2026 7a4bfe4
openvibe-shared v2.17.0 (was v2.15.0) (#16)OpenVibers · 9 Oct 2026 b4e5877
Blog: account export and deletion (ADR-033) — a person's own blog closed with its posts removed as its owner would, memberships and drafts deleted, posts elsewhere made authorless (append-only rows only inside the erasure transaction), reviews kept; loopback /internal/events; subscriptions at boot (SDK v0.37.0) (#15)OpenVibers · 9 Oct 2026 c97f7df
openvibe-shared v2.15.0 (was v2.13.2) (#14)OpenVibers · 8 Oct 2026 0dca4f6
openvibe-shared v2.13.2 (was v2.13.0) (#12)OpenVibers · 8 Oct 2026 7f13ce0
openvibe-contracts v0.112.0 (was v0.97.0) (#11)OpenVibers · 7 Oct 2026 3387540
Events moves to openvibe.events: connect-src, stream URLs and shared 2.13.0 / sdk 0.35.0 in one change (plan T7) (#10)OpenVibers · 7 Oct 2026 633c3c2
openvibe-shared 2.12.0: the showcase home and the Frame footer set their font (they rendered serif) (#9)OpenVibers · 7 Oct 2026 2a7bcef
Pin openvibe-contracts v0.97.0 and drop the proposed-capability shim (#8)OpenVibers · 5 Oct 2026 deae9d2
Pin openvibe-shared v2.9.0 (from v2.6.0): showcase ring icons fill their slot (#7)OpenVibers · 5 Oct 2026 1919a9e
Add /llms-full.txt and the home AI summary, bump openvibe-publishing…OpenVibers · 4 Oct 2026 de148d0
Render every Blog page through openvibe-publishing/layout on shellOpenVibers · 4 Oct 2026 281b384
Bump openvibe-shared v2.3.1 → v2.5.0 (#4)OpenVibers · 3 Oct 2026 4cd52ac
Plan T1: move OpenVibe.Blog onto openvibe-sdk/service from… (#2)OpenVibers · 2 Oct 2026 17832d8
The Blog home opens with what OpenVibe.Blog is for (plan T11, D92; openvibe-shared v2.3.1 showcase): 'Write on OpenVibe', where to start (Start writing, or read the OpenVibe blog below), and the six things a blog really gets today (drafts and revisions, scheduling, feeds, Community comments, themes, VIP members-only posts); the official blog's posts follow unchanged. The kit's stylesheet is linked only on the home (cached; loaded styles-first on a boost swap). Home budgets raised as a decision (html 29 KB, css 17.5 KB). Suites green.OpenVibers · 29 Sept 2026 05b8bbb
Blog moves between its pages without a reload (plan T11): openvibe-shared v2.2.0 boost swaps <main> styles-first with the shared transition, prefetching on intent, and does a normal load across a deploy (the ov-boost marker carries the release). The navbar's sign-in returns to the current page. The SSRF ratchet's lower bound follows the deleted sso.js. Both suites 25/25.OpenVibers · 29 Sept 2026 12380d2
Blog on the service kit (plan T1): sign-in is openvibe-sdk/sso createSsoClient (state + PKCE S256, server-side exchange, next limited to this site and the Network), service tokens are checked by openvibe-sdk/auth verifyServiceToken (the key their kid names), the outbox is createServiceOutbox; server/auth/sso.js and server/events/outbox.js are deleted. Pins: openvibe-sdk v0.25.0, openvibe-contracts v0.79.0, openvibe-shared v2.0.0. Both suites green (verified).OpenVibers · 29 Sept 2026 f3fac6a
The rest of the SQLite-era cleanup (the previous commit carried only its deletions): *_DB_PATH/dbPath out of config, .env.example, the systemd unit and test helpers; the unused better-sqlite3 dependency and its lockfile entries; docs, docstrings and STATUS lines that still described SQLite or its rollback window. Reviewed independently (VERDICT: SHIP). npm test 25/25 test files passed.OpenVibers · 29 Sept 2026 32773c6
openvibe-shared v1.29.2 (from its earlier pin): navbar dropdowns are no longer clipped by the links row, changing the theme repaints the page background, bright accents get dark button text (WCAG), the navbar brand is more compact. npm test: 25/25 test files passedOpenVibers · 29 Sept 2026 01f8c05
openvibe-shared v1.28.1 (from its earlier pin): the account panel keeps its sections' height on phones, the codes mark at rest shows its V, no empty space under the footer on phones. npm test: 25/25 test files passedOpenVibers · 29 Sept 2026 8167e40
openvibe-shared v1.27.0 (from v1.25.0): an async route handler's rejection now reaches the error handler instead of ending the process. Express 4 leaves such a promise unhandled and Node 22 exits on it; instrument() now applies openvibe-shared/express-async. 1.26.0 adds async gauge collects. npm test: 25/25 test files passed.OpenVibers · 28 Sept 2026 f145325
WIP postgres: db, outbox, config, migrationOpenVibers · 28 Sept 2026 6df97e6
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner through run() (same files, one at a time as before, 60 s timeout per file, VERBOSE=1 still prints every file's output): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; README and STATUS.json follow). npm test (Node 22) 25/25.OpenVibers · 28 Sept 2026 9f339e3
Per-actor rate limits on Blog's /api/v1, the editor and comment posts (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/http/actor-limits.js makes one limiter per app and counts requests once req.viewer is resolved. A person counts as user:usr_…, whether they use their own token or cookie, a service names them in X-OV-Subject, or an app acts for them through on_behalf_of. A first-party service relaying a signed-out visitor counts by the address it forwards. A service or app acting as itself counts by its principal. A signed-out caller counts by address. A first-party service reading for itself is not counted on reads. Neither is GET /api/v1/changelog: OpenVibe.Network reads it for every site's "shipped" widget from loopback without a token, so counting it would treat the whole network as one caller (Network caches each answer for 60 s, and the per-address limit still applies). Past a limit a route answers 429 problem+json rate_limited with Retry-After before any work, including before the body is read, logs one [Limits] line and counts blog_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 21d537c
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 79e9e15
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 236bdba

More commits