openvibers/openvibe.deals Commits

openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0

OP OpenVibers committed 23 Sept 2026 · 603ff5bcaf · 7 files, +27 −22

- /release.json is mounted with release.mount(app, { registry }): POST /release-metrics takes open
  tabs' update reports into /metrics (release_client_updates_total). On contracts 0.32.0 the
  manifest carries the release-manifest 1.1.0 fields; no components are declared, so every
  release still prompts a reload. test/pages.test.js validates the served manifest against the
  contracts.
- identity.service-token-claims 1.2.0 (contracts 0.26.0) requires project_id and env on app tokens:
  the mock Network's app tokens carry them, as Network's do. serviceAuth now refuses a sandbox app
  token itself with token.sandbox_refused, the code Deals already answered; no deals.* capability
  can be granted to a developer app (all first-party).
- SDK 0.4.0 -> 0.5.0 only adds the Media objects client. README and STATUS list the new pins.

Changes

ddiff --git a/README.md b/README.md
iindex 9195592..c0dc0ca 100644
---- a/README.md
++++ b/README.md
@@@ -219,8 +219,8 @@ render time, so the cache stays short); signed-in views, forms, API responses, e
  ## Depends on
  
  - **Packages** (pinned release tarballs): `openvibe-publishing` v0.2.1 (seo gate, JSON-LD, feeds,
--  sitemaps, index-hooks, discussion, ssr), `openvibe-contracts` v0.23.0, `openvibe-shared` v1.3.0
--  (chrome, app icon, footer, legal, release, metrics, ready), `openvibe-sdk` v0.4.0 (outbox, inbox,
++  sitemaps, index-hooks, discussion, ssr), `openvibe-contracts` v0.32.0, `openvibe-shared` v1.5.0
++  (chrome, app icon, footer, legal, release, metrics, ready), `openvibe-sdk` v0.5.0 (outbox, inbox,
    webhook signatures v2, service tokens).
  - **OpenVibe.Network:** SSO (OAuth client `deals`, registered in production), JWKS,
    `identity.subject.resolve`.
ddiff --git a/STATUS.json b/STATUS.json
iindex 7d926e0..9827a9c 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -9,9 +9,9 @@
    "domain": "openvibe.deals",
    "packages": [
      "openvibe-publishing v0.2.1",
--    "openvibe-contracts v0.23.0",
--    "openvibe-shared v1.3.0",
--    "openvibe-sdk v0.4.0"
++    "openvibe-contracts v0.32.0",
++    "openvibe-shared v1.5.0",
++    "openvibe-sdk v0.5.0"
    ],
    "capabilities": [
      "deals.offer.submit",
ddiff --git a/package-lock.json b/package-lock.json
iindex 7c99bcf..9b13465 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -15,10 +15,10 @@
          "express": "^4.21.2",
          "express-rate-limit": "^7.5.0",
          "helmet": "^8.1.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.23.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.32.0",
          "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v0.2.1",
--        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.4.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.3.0"
++        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.5.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.0"
        },
        "devDependencies": {
          "jsonwebtoken": "^9.0.2"
@@@ -1015,9 +1015,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.23.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.23.0",
--      "integrity": "sha512-UN2JZavxgLbGkD7HHiZKQPYSGM1ufPp+xErNyUMmIDEqaotUDwnwOzGJ7fiXhjuCOQpzTQaJU3L/w1Vih7MQzQ==",
++      "version": "0.32.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.32.0",
++      "integrity": "sha512-ntN58SIG03YDxbhsiIzOM5GRH19jRMHZUYWI3xU2VwovExagF5DdwApLVfezsu84UTJ+V2Jfn+LWDc+Oz8ab+g==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
@@@ -1060,18 +1060,18 @@
        }
      },
      "node_modules/openvibe-sdk": {
--      "version": "0.4.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.4.0",
--      "integrity": "sha512-Hyz55YOMIs0xwCQ1NXsN0sUYhlbKXAX3uWY2fPCdEEL18FXUYVhK8wlG/5JMMypFHnjDiSd9VHzBNG12hWsmkQ==",
++      "version": "0.5.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.5.0",
++      "integrity": "sha512-QVJkR5iazQX0ZwIrDp2A88ZeYYBSXEmSzhpgURPUSnzezIM3jz0HBhVKowyhkvg2aBO61XNf77eb4zJGkMjZiw==",
        "license": "MIT",
        "engines": {
          "node": ">=20"
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "1.3.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.3.0",
--      "integrity": "sha512-w8yl/5+9eend8I2O/DzAJnEAL2N3GTUY7c7pzK+MLJuLAGD8FmJJQ9gwbgyrq70Snjt3ebrg3TlpORhRAp2kgA==",
++      "version": "1.5.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.0",
++      "integrity": "sha512-cehnscuYMkJwuCYGcI6wPSswbUn0bhTyGAaD5feNCoO//2e9gyC7cgjkEcIOtM8DQF3yTuUNyXnOwckIeM4fUg==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
ddiff --git a/package.json b/package.json
iindex 0651c88..94411bb 100644
---- a/package.json
++++ b/package.json
@@@ -20,10 +20,10 @@
      "express": "^4.21.2",
      "express-rate-limit": "^7.5.0",
      "helmet": "^8.1.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.23.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.32.0",
      "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v0.2.1",
--    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.4.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.3.0"
++    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.5.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.0"
    },
    "devDependencies": {
      "jsonwebtoken": "^9.0.2"
ddiff --git a/server/app.js b/server/app.js
iindex 25285b0..3cb3636 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -111,7 +111,8 @@ function createApp(opts = {}) {
  
      // ── Machine endpoints ───────────────────────────────────
      app.get('/api/health', (_req, res) => res.json({ status: 'ok', service: 'openvibe-deals', version: VERSION }));
--    app.get('/release.json', release.handler);
++    // GET /release.json (ADR-016) and POST /release-metrics: open tabs' update reports into /metrics.
++    release.mount(app, { registry: metrics.registry });
      const readiness = createDealsReadiness({ store, auth, outbox, importer, worker, limits, release: release.release });
      app.get('/api/ready', readiness.handler);
  
ddiff --git a/test/helpers/mocks.js b/test/helpers/mocks.js
iindex 25444fa..41a7335 100644
---- a/test/helpers/mocks.js
++++ b/test/helpers/mocks.js
@@@ -65,8 +65,10 @@ async function startNetwork() {
          return json(404, { error: 'not found' });
      });
      issuer = srv.url;
++    // An app token carries its developer project and env, as Network's do (identity.service-token-claims 1.2.0).
      function signService({ sub, aud, cap, ns, actorType = 'service', extra = {} }) {
--        return serviceAuth.signServiceToken({ iss: issuer, sub, actor_type: actorType, aud, cap, ...(ns ? { ns } : {}), iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 300, jti: crypto.randomUUID(), ...extra }, privatePem);
++        const app = actorType === 'app' ? { project_id: 'prj_01J8ZQ4Y7N3M2K1H0G9F8E7D6C', env: 'production' } : {};
++        return serviceAuth.signServiceToken({ iss: issuer, sub, actor_type: actorType, aud, cap, ...(ns ? { ns } : {}), iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 300, jti: crypto.randomUUID(), ...app, ...extra }, privatePem);
      }
      /** extra.mintedAt: the time embedded in the usr_ ULID (default: long ago, i.e. an established account). */
      function addUser(username, extra = {}) {
ddiff --git a/test/pages.test.js b/test/pages.test.js
iindex 4b2fcd0..31a0f77 100644
---- a/test/pages.test.js
++++ b/test/pages.test.js
@@@ -186,6 +186,8 @@ const { boot, check, done, robotsOf, jsonLd, HOUR } = require('./helpers/boot');
          const rel = await t.get('/release.json');
          assert.strictEqual(rel.status, 200);
          assert.strictEqual(rel.json().service, 'deals');
++        assert.deepStrictEqual(require('openvibe-contracts').validate('registry.release-manifest@1', rel.json()).errors, []);
++        assert.strictEqual(rel.json().metrics_url, '/release-metrics');
          const m = await t.get('/metrics');
          assert.strictEqual(m.status, 200);
          assert.match(m.text, /http_requests_total|openvibe_/);