openvibers/openvibe.codes Commits

Events moves to openvibe.events: connect-src, stream URLs and shared 2.13.0 / sdk 0.35.0 in one change (plan T7) (#22)

OP OpenVibers committed 7 Oct 2026 · b59cb4f232 · 10 files, +20 −20

Changes

ddiff --git a/.env.example b/.env.example
iindex 7ff1d15..2a73169 100644
---- a/.env.example
++++ b/.env.example
@@@ -37,7 +37,7 @@ CODES_FORM_SECRET=
  CODES_STAFF_SUBJECTS=
  
  # Playgrounds call these with the APP's own token (defaults: the public origins in openvibe-contracts).
--# CODES_PLAYGROUND_EVENTS_URL=https://events.openvibe.network
++# CODES_PLAYGROUND_EVENTS_URL=https://openvibe.events
  # CODES_PLAYGROUND_MEDIA_URL=https://openvibe.media
  # CODES_PLAYGROUND_MAX_UPLOAD_BYTES=1048576
  # CODES_PLAYGROUND_RUNS_PER_HOUR=60
ddiff --git a/README.md b/README.md
iindex 8c69ea9..6bca6e5 100644
---- a/README.md
++++ b/README.md
@@@ -52,7 +52,7 @@ Everything is server-rendered and usable without JavaScript. The only scripts of
  - **OpenVibe.Events** — the outbox relay publishes `codes.app.*` with Codes' service token (`events.event.publish`); the Events playground calls it with the app's token (`events.app.publish`); the project archive pulls the project's app events with a Network export token (`events.app.read`).
  - **OpenVibe.Media** — the Media playground uploads with the app's token into the project's namespace; the project archive lists the project's objects, namespaces and download URLs with a Network export token (`media.object.list`, `media.object.read`).
  - **PostgreSQL 18 and Valkey 9** (OpenVibe.Host `roles/data/`, ADR-035): every read and write is async through `openvibe-sdk/db`; Valkey holds the per-actor limit counters (optional).
--- **openvibe-contracts** v0.107.0, **openvibe-sdk v0.26.0**, **openvibe-shared v2.12.0** (pinned tag tarballs; the docs show the tag and the package version, and say so when they differ).
++- **openvibe-contracts** v0.107.0, **openvibe-sdk v0.35.0**, **openvibe-shared v2.13.0** (pinned tag tarballs; the docs show the tag and the package version, and say so when they differ).
  
  No path in Codes sends or accepts a shared loopback key (tested by grep and at runtime).
  
ddiff --git a/STATUS.json b/STATUS.json
iindex dbb39f0..1ab7306 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -10,8 +10,8 @@
    "contracts": "openvibe-contracts v0.107.0",
    "packages": [
      "openvibe-contracts v0.107.0",
--    "openvibe-sdk v0.26.0",
--    "openvibe-shared v2.12.0"
++    "openvibe-sdk v0.35.0",
++    "openvibe-shared v2.13.0"
    ],
    "summary": "Deployed and public since 2026-09-23: https://openvibe.codes is served by this portal (deployed with `sudo ovhost deploy codes`, unit openvibe-codes on 127.0.0.1:4900 behind nginx), and the domain left OpenVibe.Sites. Sign-in uses the registered Network OAuth client `codes` (PKCE S256); the principal `codes` holds events.event.publish and the Events relay is configured. On 2026-09-23 production held 0 manifests, 0 releases and 0 playground runs. The external-developer path (account, project, sandbox app, grants, Media upload, app events) was run once on production on 2026-09-23 with public endpoints and curl, not through these playgrounds; that check is not committed to a repository or CI.",
    "works": [
ddiff --git a/package-lock.json b/package-lock.json
iindex 2a9e4bd..8e9a055 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -17,8 +17,8 @@
          "helmet": "^8.1.0",
          "iovalkey": "^0.4.0",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.107.0",
--        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.12.0",
++        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.35.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.13.0",
          "pg": "^8.23.0"
        },
        "devDependencies": {
@@@ -899,9 +899,9 @@
        }
      },
      "node_modules/openvibe-sdk": {
--      "version": "0.26.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
--      "integrity": "sha512-+RK89ZG4WAKIRh89yr3ieIvnyJVNSOI+dsbBqGNcr9UHsJStdxtM75zSDq8cUNpBPQ1X6ElatZrjU9S3s0aEkg==",
++      "version": "0.35.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.35.0",
++      "integrity": "sha512-IF7XB97tU7Q+ccwssGx6QXXcfDPcVpl+mX3BjIr7C6NJlcmoqj9DbHiKrBxlVav0eG44Jf8zuXEwokrHDq3J0w==",
        "license": "MIT",
        "engines": {
          "node": ">=20"
@@@ -928,9 +928,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "2.12.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.12.0",
--      "integrity": "sha512-GQpNFs2h61OKKNLexQwCfSJTLzNQ7fSbwqvrerB4oNdoxUgDvmdD43SELWycrb9DX8lkje4cR3ARznYIINnR8Q==",
++      "version": "2.13.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.13.0",
++      "integrity": "sha512-0Lvo+bBWVGWREkp92tY4cGI32ZO124WTOjthDNTB96U161odl+npnYEWy3dV2IcgZC4HAX5DSzx4ThgNS2V/sA==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
ddiff --git a/package.json b/package.json
iindex ffd87c0..ee58764 100644
---- a/package.json
++++ b/package.json
@@@ -29,8 +29,8 @@
      "helmet": "^8.1.0",
      "iovalkey": "^0.4.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.107.0",
--    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.12.0",
++    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.35.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.13.0",
      "pg": "^8.23.0"
    },
    "engines": {
ddiff --git a/server/app.js b/server/app.js
iindex 8216a8b..b583481 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -109,8 +109,8 @@ async function createApp(opts = {}) {
                  styleSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://fonts.googleapis.com', 'https://cdnjs.cloudflare.com'],
                  fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com', 'https://cdnjs.cloudflare.com'],
                  imgSrc: ["'self'", 'data:', 'https://openvibe.network', 'https://openvibe.media'],
--                // events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
--                connectSrc: ["'self'", 'https://openvibe.network', 'https://cloudflareinsights.com', 'https://events.openvibe.network'],
++                // openvibe.events: release notifications (release-watch's EventSource, openvibe-shared 1.17).
++                connectSrc: ["'self'", 'https://openvibe.network', 'https://cloudflareinsights.com', 'https://openvibe.events'],
                  frameSrc: ["'self'", 'https://openvibe.network'],
                  frameAncestors: ["'none'"],
                  objectSrc: ["'none'"],
ddiff --git a/server/config.js b/server/config.js
iindex 266fb82..096d08f 100644
---- a/server/config.js
++++ b/server/config.js
@@@ -71,7 +71,7 @@ function load(env = process.env) {
          // Where playgrounds call, with the APP's own token (never Codes' credentials). Defaults are
          // the public origins published in openvibe-contracts' service manifests.
          playground: {
--            eventsUrl: trim(env.CODES_PLAYGROUND_EVENTS_URL || originOf('events', 'https://events.openvibe.network')),
++            eventsUrl: trim(env.CODES_PLAYGROUND_EVENTS_URL || originOf('events', 'https://openvibe.events')),
              mediaUrl: trim(env.CODES_PLAYGROUND_MEDIA_URL || originOf('media', 'https://openvibe.media')),
              maxUploadBytes: int(env.CODES_PLAYGROUND_MAX_UPLOAD_BYTES, 1024 * 1024),
              runsPerHour: int(env.CODES_PLAYGROUND_RUNS_PER_HOUR, 60),
ddiff --git a/server/domain/limits.js b/server/domain/limits.js
iindex dce63bd..543a6de 100644
---- a/server/domain/limits.js
++++ b/server/domain/limits.js
@@@ -12,7 +12,7 @@ function limitSources(env = process.env) {
      return [
          // public: null until openvibe.host serves Host itself (WS-N task 10, Stage B step 2); read internally meanwhile.
          { service: 'host', name: 'OpenVibe Host', internal: env.OV_HOST_INTERNAL_URL || 'http://127.0.0.1:4910', public: null },
--        { service: 'events', name: 'OpenVibe Events', internal: env.OV_EVENTS_INTERNAL_URL || 'http://127.0.0.1:4300', public: 'https://events.openvibe.network/limits.json' },
++        { service: 'events', name: 'OpenVibe Events', internal: env.OV_EVENTS_INTERNAL_URL || 'http://127.0.0.1:4300', public: 'https://openvibe.events/limits.json' },
          { service: 'media', name: 'OpenVibe Media', internal: env.OV_MEDIA_INTERNAL_URL || 'http://127.0.0.1:4100', public: 'https://openvibe.media/limits.json' },
      ];
  }
ddiff --git a/test/docs-limits.test.js b/test/docs-limits.test.js
iindex 17e71d9..c7d5932 100644
---- a/test/docs-limits.test.js
++++ b/test/docs-limits.test.js
@@@ -58,7 +58,7 @@ function serve(body) {
          const r = await t.get('/docs/limits');
          assert.strictEqual(r.status, 200, r.text.slice(0, 300));
          for (const s of ['1 GB', '100 MB', '50 in 24 hours', '120 a minute', '30 a minute', '7 days', 'quota.custom_domains', 'events.quota_exceeded',
--            'events.openvibe.network/limits.json', 'openvibe.media/limits.json', '72 hours', 'media.quota.exceeded', 'per project and environment (ADR-014)']) {
++            'openvibe.events/limits.json', 'openvibe.media/limits.json', '72 hours', 'media.quota.exceeded', 'per project and environment (ADR-014)']) {
              assert.ok(r.text.includes(s), `the page says ${s}`);
          }
          assert.match(r.text, /Custom domains<\/td><td[^>]*>[^<]*<a[^>]*><code>host\.site\.manage<\/code><\/a><\/td><td[^>]*>none<\/td>/, 'sandbox 0 reads "none"');
ddiff --git a/test/docs.test.js b/test/docs.test.js
iindex 86f0a8f..3380cb9 100644
---- a/test/docs.test.js
++++ b/test/docs.test.js
@@@ -22,7 +22,7 @@ const sdkPkg = require('openvibe-sdk/package.json');
          assert.strictEqual(tag('openvibe-contracts'), 'v0.107.0');
          assert.strictEqual(tag('openvibe-sdk'), `v${sdkPkg.version}`);
          assert.strictEqual(tag('openvibe-shared'), `v${require('openvibe-shared/package.json').version}`);
--        assert.strictEqual(sdkPkg.version, '0.26.0');
++        assert.strictEqual(sdkPkg.version, '0.35.0');
          // The contracts tag v0.107.0 carries the released codes manifest, codes.app-manifest@1 and codes.resource.read.
          assert.ok(contracts.services.get('codes') && contracts.services.get('codes').status === 'alpha');
          assert.ok(contracts.resolve('codes.app-manifest@1'));