openvibers/openvibe.codes Commits

openvibe-shared v1.5.1, openvibe-contracts v0.33.0

OP OpenVibers committed 23 Sept 2026 · 241cce37b8 · 6 files, +20 −20

Shared 1.5.1 adds touch and keyboard feedback to the shared chrome (no tap-highlight flash, a slight
press, one accent focus ring; CSS in the navbar and footer only). Contracts 0.33.0 is additive: the
Tools platform API (ADR-027) with the tools.* descriptor/run/job contracts, whose new capabilities
are planned. The docs generated at boot now come from contracts v0.33.0 (so they include the new
tools contracts and ADR-027): test/docs.test.js and test/contracts.test.js pin that tag, and README
and STATUS list the new pins. The tests and the contracts check pass.

Changes

ddiff --git a/README.md b/README.md
iindex d7f9c18..31fa7b9 100644
---- a/README.md
++++ b/README.md
@@@ -47,7 +47,7 @@ Everything is server-rendered and usable without JavaScript. The only scripts of
  - **OpenVibe.Network** — SSO (OAuth client `codes`, PKCE S256), JWKS, `/api/v1/projects` (called server-side with the person's Network access token), the registry (`/api/v1/registry/services`, `/.well-known/openvibe`), client-credentials tokens (Codes' own for the events relay; the app's own in playgrounds).
  - **OpenVibe.Events** — the outbox relay publishes `codes.app.*` with Codes' service token (`events.event.publish`); the Events playground calls it with the app's token (`events.app.publish`).
  - **OpenVibe.Media** — the Media playground uploads with the app's token into the project's namespace.
--- **openvibe-contracts** v0.32.0, **openvibe-sdk v0.5.0**, **openvibe-shared v1.5.0** (pinned tag tarballs; the docs show the tag and the package version, and say so when they differ).
++- **openvibe-contracts** v0.33.0, **openvibe-sdk v0.5.0**, **openvibe-shared v1.5.1** (pinned tag tarballs; the docs show the tag and the package version, and say so when they differ).
  
  No path in Codes sends or accepts a shared loopback key (tested by grep and at runtime).
  
@@@ -58,7 +58,7 @@ In Network (`server/identity/principals.js` / `server/db/database.js`, as for co
  - OAuth client `codes`, name `OpenVibe.Codes`, redirect URI `https://openvibe.codes/auth/callback`.
  - Service grant `['codes', 'events.event.publish', 'openvibe.events', []]` (the outbox relay).
  
--The Codes service manifest, `codes.release.manage|read` and `codes.app-manifest@1` are released in openvibe-contracts (tag v0.27.0; this repository pins v0.32.0); the CI contracts check is blocking.
++The Codes service manifest, `codes.release.manage|read` and `codes.app-manifest@1` are released in openvibe-contracts (tag v0.27.0; this repository pins v0.33.0); the CI contracts check is blocking.
  
  For the playgrounds to succeed end to end (not Codes' code; configuration elsewhere): Network `DEV_SANDBOX_AUDIENCES` including `openvibe.media` and `openvibe.events`, a staff-set allowance containing `media.object.upload` and `events.app.publish` for the project, a Media tenant keyed by the project id, and OpenVibe.Events serving `events.app.publish` for app tokens. On 2026-09-23 these were in place on production: a sandbox app uploaded to Media (tenant `prj_…-sandbox`) and published and read app events through public endpoints. That run used curl, not the Codes playgrounds, and it is not yet a committed, repeatable check.
  
ddiff --git a/STATUS.json b/STATUS.json
iindex 63dfb63..f4f3acb 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -8,9 +8,9 @@
    "port": 4900,
    "domain": "openvibe.codes",
    "packages": [
--    "openvibe-contracts v0.32.0",
++    "openvibe-contracts v0.33.0",
      "openvibe-sdk v0.5.0",
--    "openvibe-shared v1.5.0"
++    "openvibe-shared v1.5.1"
    ],
    "summary": "Deployed and public since 2026-09-23: https://openvibe.codes is served by this portal (openvibe-ovh, unit openvibe-codes on 127.0.0.1:4900 behind nginx, release a9371c3), and the domain left OpenVibe.Sites. Sign-in uses the registered Network OAuth client `codes` (PKCE S256); the principal `codes` holds events.event.publish and the Events relay is configured. It is barely used yet: production holds 0 manifests, 0 releases and 0 playground runs. The external-developer path (account, project, sandbox app, grants, Media upload, app events) was run once on production on 2026-09-23 with public endpoints and curl, not through these playgrounds; that check is not committed to a repository or CI.",
    "works": [
ddiff --git a/package-lock.json b/package-lock.json
iindex 2c17af0..58306df 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -16,9 +16,9 @@
          "express": "^4.21.2",
          "express-rate-limit": "^7.5.0",
          "helmet": "^8.1.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.32.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.33.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.5.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.0"
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.1"
        },
        "engines": {
          "node": ">=22.0.0"
@@@ -1023,9 +1023,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.32.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.32.0",
--      "integrity": "sha512-ntN58SIG03YDxbhsiIzOM5GRH19jRMHZUYWI3xU2VwovExagF5DdwApLVfezsu84UTJ+V2Jfn+LWDc+Oz8ab+g==",
++      "version": "0.33.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.33.0",
++      "integrity": "sha512-7q8NUhcPxgb8lxrVdC3pFbiPdjzliJM1mMP/1G5a2PmOr2tJVAXwYa8+a8YgCJvYeMSeMHWijLkIEiZ9IhllOg==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
@@@ -1048,9 +1048,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "1.5.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.0",
--      "integrity": "sha512-cehnscuYMkJwuCYGcI6wPSswbUn0bhTyGAaD5feNCoO//2e9gyC7cgjkEcIOtM8DQF3yTuUNyXnOwckIeM4fUg==",
++      "version": "1.5.1",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.1",
++      "integrity": "sha512-1XWRFwN8br3iiy2Z8fmnXQMgR76VlfMpHjP1xr5uKLCJmtvtNSWO1BgA1kQmVtyBY7g+1n6YFIjahaD4qWbD/Q==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
ddiff --git a/package.json b/package.json
iindex 6af6498..b99f7e8 100644
---- a/package.json
++++ b/package.json
@@@ -27,9 +27,9 @@
      "express": "^4.21.2",
      "express-rate-limit": "^7.5.0",
      "helmet": "^8.1.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.32.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.33.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.5.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.0"
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.1"
    },
    "engines": {
      "node": ">=22.0.0"
ddiff --git a/test/contracts.test.js b/test/contracts.test.js
iindex 938c511..4fbb039 100644
---- a/test/contracts.test.js
++++ b/test/contracts.test.js
@@@ -1,6 +1,6 @@
  'use strict';
  /**
-- * The released contracts (openvibe-contracts tag v0.32.0) describe what the code does: the codes
++ * The released contracts (openvibe-contracts tag v0.33.0) describe what the code does: the codes
   * service manifest's events are exactly what the outbox can produce, its capabilities are the ones
   * the API guards with requireCapability, and the release API answers with the contracts' problems.
   */
ddiff --git a/test/docs.test.js b/test/docs.test.js
iindex 24d3329..9b301d7 100644
---- a/test/docs.test.js
++++ b/test/docs.test.js
@@@ -19,11 +19,11 @@ const sdkPkg = require('openvibe-sdk/package.json');
  
      await check('package.json pins the contracts, SDK and shared tags that are installed', async () => {
          const tag = (dep) => (pkg.dependencies[dep].match(/refs\/tags\/(v[0-9.]+)$/) || [])[1];
--        assert.strictEqual(tag('openvibe-contracts'), 'v0.32.0');
++        assert.strictEqual(tag('openvibe-contracts'), 'v0.33.0');
          assert.strictEqual(tag('openvibe-sdk'), `v${sdkPkg.version}`);
          assert.strictEqual(tag('openvibe-shared'), `v${require('openvibe-shared/package.json').version}`);
          assert.strictEqual(sdkPkg.version, '0.5.0');
--        // The contracts tag v0.32.0 carries the released codes manifest and codes.app-manifest@1.
++        // The contracts tag v0.33.0 carries the released codes manifest and codes.app-manifest@1.
          assert.ok(contracts.services.get('codes') && contracts.services.get('codes').status === 'alpha');
          assert.ok(contracts.resolve('codes.app-manifest@1'));
      });
@@@ -33,13 +33,13 @@ const sdkPkg = require('openvibe-sdk/package.json');
              const r = await t.get(p);
              assert.strictEqual(r.status, 200, p);
              assert.ok(r.text.includes(`openvibe-contracts v${contractsVersion}`), `${p} names the installed contracts version`);
--            assert.ok(r.text.includes('OpenVibe.Contracts/tree/v0.32.0'), `${p} links the pinned tag`);
--            if (contractsVersion !== '0.32.0') assert.ok(r.text.includes('(tag v0.32.0)'), `${p} says the tag differs from the package version`);
++            assert.ok(r.text.includes('OpenVibe.Contracts/tree/v0.33.0'), `${p} links the pinned tag`);
++            if (contractsVersion !== '0.33.0') assert.ok(r.text.includes('(tag v0.33.0)'), `${p} says the tag differs from the package version`);
              assert.ok(r.text.includes(`openvibe-sdk v${sdkPkg.version}`), `${p} names the SDK version`);
          }
          const v = (await t.get('/api/v1/docs/versions')).json();
          assert.strictEqual(v.contracts, contractsVersion);
--        assert.strictEqual(v.contracts_tag, 'v0.32.0');
++        assert.strictEqual(v.contracts_tag, 'v0.33.0');
          assert.strictEqual(v.sdk, sdkPkg.version);
      });