openvibers/openvibe.contracts Commits

v0.40.0: the chat manifest names openvibe.chat (domains, publicOrigin): OpenVibe.Chat serves its own site, and Network's manifest-derived first-party origins include it

OP OpenVibers committed 24 Sept 2026 · bdb4ebfdeb · 4 files, +10 −5





Changes
ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 0f11a097..27ec2017 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -4,6 +4,10 @@ All notable changes to `openvibe-contracts`. Releases are git tags (`vX.Y.Z`) th
  from `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/<tag>`. Before v0.30.0,
  the notes were in the tag and commit messages (`git tag -n1`).
  
++## 0.40.0 — 2026-09-24
++
++The chat manifest names its own domain: **openvibe.chat** (`domains`, `publicOrigin`). OpenVibe.Chat serves the site itself (global chat, messages, settings, sign-in with the Network), and Network's first-party CORS list, which comes from these manifests, now includes it. Additive.
++
  ## 0.39.0 — 2026-09-24
  
  **`network.user.token_valid_after`** (revocation propagation, roadmap WS-B task 4): when a person's tokens stop being good (a password change or reset, sign out everywhere, a ban, an account deletion or staff ending their sessions), Network moves their cutoff and emits this event in the same transaction. Every service that accepts Network user tokens refuses one whose `iat * 1000 < Date.parse(valid_after)` (Network's own rule), drops what it cached for those tokens and closes the sockets they opened. Consumers keep the latest cutoff per subject. Network produces it; Chat, Community, Live, Media, Tools and Games consume it. Fixtures cover valid and invalid payloads. Additive.
ddiff --git a/manifests/services/chat.json b/manifests/services/chat.json
iindex 1f4baec8..ab9b86d7 100644
---- a/manifests/services/chat.json
++++ b/manifests/services/chat.json
@@@ -7,7 +7,8 @@
    "name": "OpenVibe.Chat",
    "status": "alpha",
    "repository": "OpenVibers/OpenVibe.Chat",
--  "domains": [],
++  "domains": ["openvibe.chat"],
++  "publicOrigin": "https://openvibe.chat",
    "capabilities": [
      "chat.live_bridge.write",
      "chat.message.send",
@@@ -25,7 +26,7 @@
    "namespacesOwned": [
      "chat.preferences"
    ],
--  "notes": "Wave 6: Live's chat (WebSocket, DMs, history, TTS, sounds, moderation) behind a service boundary on 127.0.0.1:4400. Alpha: runs beside Live; authority moves only when Live runs with CHAT_AUTHORITY=chat and nginx routes the chat paths (see OpenVibe.Chat docs/cutover.md).",
++  "notes": "Wave 6: Live's chat (WebSocket, DMs, history, TTS, sounds, moderation) behind a service boundary on 127.0.0.1:4400, serving Live's chat paths since 2026-09-23. Since 2026-09-24 also its own site, openvibe.chat (global chat, messages, settings, sign-in with the Network), which works while Live is down.",
    "health": "/health",
    "ready": "/ready"
  }
ddiff --git a/package-lock.json b/package-lock.json
iindex 27e5bdf1..7f53bd9d 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.39.0",
++  "version": "0.40.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-contracts",
--      "version": "0.39.0",
++      "version": "0.40.0",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex 2b7c37c4..8e2e1808 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.39.0",
++  "version": "0.40.0",
    "description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
    "main": "index.js",
    "types": "generated/typescript/index.d.ts",