Commits

main · package-lock.json

openvibe-shared v1.28.1 (from its earlier pin): the account panel keeps its sections' height on phones, the codes mark at rest shows its V, no empty space under the footer on phones. npm test: 46/46 test files passedOpenVibers · 28 Sept 2026 a630c24
Community on PostgreSQL (ADR-035, roadmap WS-X2, repository pass G3).OpenVibers · 28 Sept 2026 8f021e6
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner (same files, one at a time as before, 60 s timeout per file): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; the README follows). npm test (Node 22) 49/49.OpenVibers · 28 Sept 2026 581d805
Per-actor rate limits at Community's API routers (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/actor-limits.js makes one limiter per app, used by the paste, comment, forum (spaces, posts, groups), Pulse and relay APIs once each resolves its viewer and checks the route's capability. It counts a person as user:usr_… whether they call with their own token or a service or app names them in X-OV-Subject; a first-party service relaying a signed-out visitor by the address it forwards (as the per-address /api/ limit already does for Live's calls); a service or app acting as itself (moderation, AI output such as Live's AI pastes, Pulse) by its principal; a signed-out browser by address. A first-party service reading for itself is not counted on reads, since its pages speak for all its visitors and the per-address limit already bounds it. Past a limit a route answers 429 problem+json rate_limited with Retry-After before any work, logs one [Limits] line and counts community_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 52d923a
Community takes part in account export and deletion (roadmap WS-B task 7, ADR-033; openvibe-contracts 0.49.0 -> 0.71.0). The pulse consumer takes network.account.export_requested and network.account.deleted (subscribed at boot). server/identity/account-data.js applies each once per export or deletion (account_data_events) and answers after Network took the part or confirmation, so a failure is redelivered without erasing twice.OpenVibers · 27 Sept 2026 82e2bb9
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 19441aa
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 d511da5
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 6a855de
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 9a468fb
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 be15c21
Pins: openvibe-shared 1.15.0 -> 1.16.0OpenVibers · 26 Sept 2026 1bac6a9
Size budgets for the home page (WS-T task 1): openvibe-shared/perf-budget (shared 1.15.0) measures / as the server answers it on a fresh database, no browser, in npm test; budgets a little above the 2026-09-26 measurementOpenVibers · 26 Sept 2026 5bf0400
Pins: openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 077d7be
Platform blocks (WS-E task 5, Contracts 0.49.0): Community consumes network.block.changed into a newest-revision projection and refuses (403 community.blocked, plain message on the no-JS forms) a reply in a thread whose author blocked you, a reply to a comment whose author blocked you, and a comment on a paste or post whose owner blocked youOpenVibers · 25 Sept 2026 0cce476
Pins: openvibe-contracts 0.41.0 → 0.44.0; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 adbfd8b
community.profile on Network (Contracts 0.41.0 user module, WS-B task 9): threads, replies, comments and public pastes a person wrote (deleted, AI and private not counted), first and last activity; a 5-minute scan of authors whose rows changed writes it as the owning service, only when it changedOpenVibers · 25 Sept 2026 8be21c2
Revocation propagation (WS-B task 4, Contracts 0.39.0, SDK 0.9.1): Community subscribes to network.user.token_valid_after, applies it once through the inbox into openvibe-sdk createRevocationStore, and the viewer resolver treats a token issued before the person's cutoff as anonymous. test/revocation.test.jsOpenVibers · 24 Sept 2026 6b5f6e1
Staff actions on someone else's content publish community.moderation.action for the network's moderation audit log (ADR-022): paste edit, visibility change, delete, censor, bulk and fork cleanup, comment and post removal, thread delete, lock and unlock — in the same transaction as the change, never the content; an owner acting on their own content is not audited; openvibe-contracts 0.36.0OpenVibers · 24 Sept 2026 bd3a551
The OpenVibe Frame from this site's own pinned copy: /shared/* is served by openvibe-shared/serve (1.12.0) and every page references it by content hash (/shared/<file>?v=<hash>), so this site's pin decides what its pages run and its navbar and footer keep working while openvibe.network is downOpenVibers · 24 Sept 2026 8772c78
The OpenVibe Frame and the shared update system on openvibe.community: the home shows what shipped and /updates is the shared log (openvibe-shared/frame 1.11.1), the footer links it, and the shared navbar signs out through this site (logoutUrl)OpenVibers · 24 Sept 2026 58f1b3b
VIP client from openvibe-sdk/vip (v0.7.0): the copy of openvibe-vip/client is replaced by the SDK's published seam, same API and fail-closed behaviour; server/vip/vip-client.js re-exports it so callers are unchangedOpenVibers · 24 Sept 2026 d692a51
Community publishes events (openvibe-contracts 0.35.0): community.paste.created|updated|deleted, community.thread.created, community.post.created and community.comment.created, each queued in the transaction of the write through the openvibe-sdk outbox and relayed with Community's service token. Payloads carry ids, owner/author subject, visibility and the public URL, never a title, body or content; items that are not public (unlisted pastes, members-only or staff spaces, hidden threads) travel as internal events without a URL. Off unless EVENTS_URL and the client secret are set. test/events.test.jsOpenVibers · 24 Sept 2026 c8a70c7
openvibe-shared v1.5.1 (Track R release manifest), openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 78f2f9b
Observability (Track O): GET /metrics (loopback only) with HTTP golden signals by route template, process metrics and release_info; /api/ready built on openvibe-shared/ready (db required; Network key, Live or Media optional -> degraded) instead of an unconditional {ready:true}; nginx refuses /metrics; openvibe-shared v1.3.0OpenVibers · 23 Sept 2026 b492398
GET /release.json (ADR-016); openvibe-shared v1.2.0, openvibe-contracts v0.11.0OpenVibers · 23 Sept 2026 2787010
openvibe-shared is the pinned OpenVibe.Shared v1.0.0 release (vendor/ is gone); openvibe-contracts v0.7.0 knows the Wave 5 capabilitiesOpenVibers · 23 Sept 2026 458d44b
Pastes: Community becomes the authority (PASTES_AUTHORITY=community)OpenVibers · 22 Sept 2026 786e6f8
Scaffold the Community app: package, vendored openvibe-shared, config, env exampleOpenVibers · 18 Sept 2026 66c11ab