CHANGELOG.md

Changelog

What changed in OpenVibe.Cam, newest first.

0.1.0 — 2026-10-28

The first version: the camera app, my cameras and revocable viewer grants, and the API Live's cam button calls.

• The camera app. /app runs a live preview in the browser; the timer, the 3-shot burst, the grid and the
  colour/light/softness filter are all on the device. The picture is posted as raw bytes to POST /api/v1/photos,
  forwarded to OpenVibe.Pics with the person's own Network token, and recorded as a Pics slug, page link, direct
  link, filter name and caption. No image bytes, no face template and no classification are stored here.
• My cameras. cam_cameras pairs a phone, a browser, a Pi or an IP camera. A Live stream id is read from
  OpenVibe.Live's public API and must be on the owner's channel; the slot defaults to the stream's managed slot.
  The owner can rename it, set the slot and status, and unpair it. /my/cameras/:id is the owner's page.
• Viewer grants. cam_grants names one canonical viewer and an expiry (7 days by default, 90 at most), with a
  partial unique index for one unrevoked grant per camera and viewer. @username is resolved through
  OpenVibe.Network with identity.subject.resolve; a subject id works without Network. A re-grant extends the row;
  a revocation writes revoked_at and the wall checks it on every read, so the next request is refused.
• The private wall. /w/:id and GET /api/v1/cameras/:id/wall answer the owner and an active grantee, and 404
  to everyone else. Staff have no bypass. A grantee never sees the owner's note. An attached photo is unlisted and
  appears on the wall; a photo without a camera is private.
• The Live cam button. POST /api/v1/stills reads OpenVibe.Media's public GET /live/:slot/frame.jpg, accepts
  only a JPEG (never an offline SVG card or HTML), uploads it to OpenVibe.Pics as the viewer, records the still and
  returns share.text, the exact line Live posts in the stream's chat. A still is unlisted by default and private
  on request.
• The service. Network sign-in as OAuth client cam (PKCE S256, cam_at/cam_rt/cam_oauth), truthful
  readiness, Prometheus metrics on loopback, discovery, deploy files, and server-rendered pages with stable cm-
  ids. public/css/cam.css is a one-comment placeholder for the main session.
• Account data. Export and deletion cover cameras, grants given and received, photos and stills; a deleted
  owner's camera and its grants go, a deleted viewer's grants go and the owner's camera stays. Pictures themselves
  are OpenVibe.Pics' and are erased on the same Network event.
• The first proof. scripts/seed-proof.js pairs a test camera, grants a viewer, opens the wall, revokes the
  grant and proves the next wall request is refused.
• Tests. Migration and constraints, pairing and stream ownership, grants and their refusals, the still path,
  the photo upload, pages and cache headers, SSO, and account export/deletion, each in its own process on a
  temporary PGlite database with a mock Network and a Media/Live/Pics fixture server.