Commits

main · package-lock.json

Opaque cursors beside the global seq (plan T7, ADR-042 decision 7; openvibe-contracts v0.81.0): every answer that carries a seq also carries its cursor (publish results, pulls with next_cursor, single events, checkpoints with epoch and carrier), pull accepts after=<cursor>, the SSE id is the cursor and Last-Event-ID accepts a cursor or, for this release, a bare seq; a cursor from another retention epoch answers the gap shape, never a silent restart (migration 0003: store_epoch, consumer_checkpoints.epoch/carrier). seq, next_after_seq, latest_seq and X-OpenVibe-Seq are unchanged this release. test/cursor.test.js; answers validated against the contracts; npm test and test:pg 19/19 (verified).OpenVibers · 29 Sept 2026 2863954
One inbox (plan T7, ADR-042 decision 9): lib/client.js re-exports openvibe-sdk's PostgreSQL outbox and inbox (createPgOutbox, createPgInbox, outboxSchema, inboxSchema) and its own SQLite copies are gone, with better-sqlite3; the README shows the async, transaction-handle usage. test/outbox-inbox.test.js runs producer and consumer on embedded PostgreSQL: a rolled-back enqueue publishes nothing, a resend is a duplicate, a poisoned row is isolated, a down Events is retried after backoff, and a consumer crash before or after commit plus redelivery and replay yields exactly one effect. npm test and test:pg 18/18.OpenVibers · 29 Sept 2026 9b8b2b6
Events on current pins (plan T7, A1 + A2): openvibe-contracts v0.80.0, openvibe-sdk v0.25.1, openvibe-shared v2.2.0 (no removed export was in use; behaviour unchanged); docs/replay-window-rollout.md and docs/capabilities-proposal/ deleted (superseded by Contracts' capability manifests; nothing linked them).OpenVibers · 29 Sept 2026 d42168e
Events: iovalkey is a dependency, test:pg boots with Valkey, drain() waits for mid-pass completions.OpenVibers · 28 Sept 2026 7bccceb
Events on PostgreSQL (ADR-035, roadmap WS-X2, repository pass G3).OpenVibers · 28 Sept 2026 f71906e
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner (same files, one at a time as before, 60 s timeout per file): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs). npm test (Node 22) 18/18.OpenVibers · 28 Sept 2026 7c575cd
Per-actor rate limits at Events' capability routes (roadmap WS-R task 4): openvibe-sdk v0.12.0 is now a dependency, and server/actor-limits.js makes one limiter per app that counts each verified principal (svc:live, app:app_…) after its guard and before any work. Past a limit a route answers 429 problem+json rate_limited with Retry-After, logs one [limits] line and counts events_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 7530c2f
Project usage rollups (roadmap WS-N task 4; Contracts v0.63.0 events.usage.recorded, common.usage-recorded@1): each developer project's use is counted per environment and UTC hour in the transaction that does the work (server/usage.js, table app_usage): events.app.publish in events (events stored in insertBatch; a repeated event_id is not counted), every refused publish request as an error with its problem code, status, trace id and the refused event id; events.app.subscribe in deliveries (webhook attempts to the project's subscriptions, recorded with the delivery row in recordAttempt), an attempt without a 2xx as events.delivery.http_<status>, .timeout or .failed with the event id and its trace. A minute after an hour closes, each rollup is stored once as an events.usage.recorded event (source events, subject the project, visibility internal, priority low) in the transaction that marks it sent, so Events is its own outbox; first-party subscribers (Network's project usage) get it like any event, apps never see it; a count landing in an hour already sent re-sends it as revision 2. EVENTS_USAGE=off counts nothing; EVENTS_USAGE_FLUSH_MS (300000). Pins: openvibe-contracts 0.61.0 -> 0.63.0. test/usage.test.jsOpenVibers · 26 Sept 2026 bb78877
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 eb98f8c
Pins: openvibe-contracts -> 0.61.0 (network.notification.created@1, identity.realtime-ticket-claims@1, network.realtime-ticket-result@1)OpenVibers · 26 Sept 2026 3252f62
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 a38de79
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 390f1cd
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 5f1eafb
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 dfa5e12
Pins: openvibe-shared 1.13.0 -> 1.16.0OpenVibers · 26 Sept 2026 39eba17
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0OpenVibers · 25 Sept 2026 e2cb9ea
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026 4a83adc
Pins: openvibe-contracts 0.33.0 → 0.42.0, openvibe-shared 1.6.0 → 1.12.0; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 7074fb6
App-endpoint guard on openvibe-shared 1.6.0: the public-address rule and internal-name list come from openvibe-shared/egress (shared with Live and Tools; adds *.home.arpa); endpoint syntax rules and the connect-time guarded POST stay hereOpenVibers · 24 Sept 2026 3879798
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 d71f6fd
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0OpenVibers · 23 Sept 2026 039e203
Developer apps (Wave 20, ADR-014): events.app.publish|read|subscribe with app tokens on the existing routes — app.<project_key>.* types only (project_key = p + lowercased project ULID, source app-<lowercased app ULID>), reads scoped to the own project and env plus public first-party events, subscriptions to public https endpoints only (SSRF guard at subscribe and delivery, pinned lookup, no redirects); sandbox tokens accepted on these routes only, events stored with project_id and env and never crossing environments; per-project publish-rate, retained-bytes and subscription quotas; network.app.revoked / network.grant.changed disable an app's subscriptions and old tokens; public nginx locations for the app routes; openvibe-contracts v0.28.0OpenVibers · 23 Sept 2026 06af758
Observability (Track O): GET /metrics (loopback only) with HTTP golden signals by route template, process metrics, release_info and Events gauges (deliveries by status, DLQ depth, latest seq, SSE connections, delivery latency, attempts by outcome); /api/ready built on openvibe-shared/ready (db, network_jwks, delivery_worker required; dlq optional -> degraded); GET /release.json; openvibe-shared v1.3.0OpenVibers · 23 Sept 2026 0c7f9c5
Capability ids with three segments (events.event.publish, events.event.read, events.subscription.manage, events.delivery.admin); openvibe-contracts v0.6.0; contract check in CIOpenVibers · 23 Sept 2026 5082c38
Events service: durable store, publish API, signed delivery with retry/DLQ/replay, SSE realtime gateway, client libraryOpenVibers · 23 Sept 2026 f8c2e24