openvibe-shared v4.107.0 (was v4.106.2) (#139)

ddiff --git a/README.md b/README.md
iindex 6522379..6c6ba2c 100644
---- a/README.md
++++ b/README.md
@@@ -229,6 +229,6 @@ Part of the [OpenVibe network](https://openvibe.network). Built in the open by
  <!-- versions:start -->
  - openvibe-contracts: v0.275.0
  - openvibe-sdk: v0.82.0
--- openvibe-shared: v4.106.2
++- openvibe-shared: v4.107.0
  - openvibe-publishing: v1.5.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex 1306e9d..ed0adf3 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -10,12 +10,12 @@
    "domain": "openvibe.design",
    "contracts": "openvibe-contracts v0.275.0",
    "sdk": "openvibe-sdk v0.82.0",
--  "shared": "openvibe-shared v4.106.2",
++  "shared": "openvibe-shared v4.107.0",
    "packages": [
      "openvibe-contracts v0.275.0",
      "openvibe-publishing v1.5.0",
      "openvibe-sdk v0.82.0",
--    "openvibe-shared v4.106.2"
++    "openvibe-shared v4.107.0"
    ],
    "summary": "The service skeleton for openvibe.design: Network sign-in as OAuth client `design` (PKCE S256, httpOnly design_at/design_rt cookies) and a theme API proxy to OpenVibe.Network's /api/themes. The proxy serves the public catalogue (cached 5 minutes), one theme, the person's active theme and custom variables, saving a theme with source 'studio', its history and a restore by id, and a submission to the gallery. Writes need this site's own Origin; Network 4xx answers pass through and a Network failure is 502. The studio is designed: a gallery, previews on a Live channel, a Chat room and a shop's grid (with colour-vision views), a six-colour editor that derives the full token set, WCAG checks that gate Use, sharing to the gallery, and History with Restore. The Arena queues one prompt for three models through OpenVibe.AI (client credentials, ai.run.create), stores sanitized HTML with reported model/provider/cost/time/tokens, renders it only in sandboxed CSP-capped iframes, draws blind pairs, records one vote per person per round, and keeps Elo ratings per category plus median cost and time. The prompts, outputs and votes are an open JSONL dataset; rounds and votes follow ADR-033 export and deletion.",
    "works": [
@@@ -71,5 +71,5 @@
      "Design Studio versions and undo/redo",
      "Design tokens as files (JSON, CSS, Tailwind, Style Dictionary, Swift, Kotlin, Android XML)"
    ],
--  "updated": "2026-11-02"
++  "updated": "2026-11-03"
  }
ddiff --git a/package-lock.json b/package-lock.json
iindex d5ec8b5..5715c03 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -18,7 +18,7 @@
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.275.0",
          "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.5.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.82.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.106.2",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.107.0",
          "pg": "^8.23.1",
          "subset-font": "^2.9.0"
        },
@@@ -1384,9 +1384,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "4.106.2",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.106.2",
--      "integrity": "sha512-sKq3TnkO0IaaKdgR5sLfkEwRL9DGYdT6etxTw4/9NKrp2HECvaDrPtOQw/xsrS0vtYwIm5z5BSp2+EVRt5MLQg==",
++      "version": "4.107.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.107.0",
++      "integrity": "sha512-S0Um9G8a0jl/yL8Sox4e+xZtLHyMjiv1WcwUIlml6hgMKAPq9aGIzcUA9Cb/d6SppJaxCKIAKmsF5Slbz6UyZg==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0",
ddiff --git a/package.json b/package.json
iindex dfe7bf8..d0a3155 100644
---- a/package.json
++++ b/package.json
@@@ -24,7 +24,7 @@
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.275.0",
      "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.5.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.82.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.106.2",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.107.0",
      "pg": "^8.23.1",
      "subset-font": "^2.9.0"
    },
ddiff --git a/server/app.js b/server/app.js
iindex 25084d4..49168b7 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -168,6 +168,22 @@ async function createApp(opts = {}) {
  
      // ── Static assets (content-hashed ?v= → immutable) ──────
      app.use('/shared', serve.handler());
++    // Terms, Privacy and DMCA in this site's own words (openvibe-shared/legal, profile 'service'; 11-03: the footer's
++    // legal links answered 404 here). The facts must match the code: change both together.
++    const legal = require('openvibe-shared/legal');
++    app.get(legal.PATHS, legal.handler({
++        "host": "openvibe.design",
++        "name": "OpenVibe.Design",
++        "id": "design",
++        "service": "design",
++        "profile": "service",
++        "what": "Try any OpenVibe theme on a Live channel, a Chat room and a shop at once, change its colours with contrast checks that must pass, use it on every site, and step back to any earlier look.",
++        "makes": [
++                "your themes and designs, with each earlier version",
++                "the designs you publish, which are public"
++        ],
++        "ai": true
++    }));
      const setAssetHeaders = (res, filePath) => {
          const rel = path.relative(PUBLIC_DIR, filePath).split(path.sep).join('/');
          const v = res.req && res.req.query && res.req.query.v;