Commits

main · .env.example

A recording in progress is its own DVR: /v/:id/dvr.m3u8 names its fragments as slices of the growing file (no seekable copy needed); VOD_DVR_SNAPSHOT_MP4=0 stops the MP4 copy (#168)OpenVibers · 20 days ago 9b03178
Under VOD_DISK_STOP_GB free (3) the recorder stops the largest running recording, one per minute, so a long stream cannot fill the disk PostgreSQL shares (#162)OpenVibers · 20 days ago 895a390
Media: the S3 surface and zones (ADR-031) — SigV4, access keys, zone projection and deletion, one object for two doors (#108)OpenVibers · 29 days ago 9a6c2ed
Media: H.264/AAC timelines for WebM and other incompatible recordings (MEDIA_CMAF_TRANSCODE), capped and niced (#95)OpenVibers · 12 Oct 2026 6e2a16c
Media: a local timeline-cache budget (eviction of verified durable copies, backfill pacing) before HLS goes on (#94)OpenVibers · 12 Oct 2026 2b50681
Media: no per-app webhooks; outcomes are OpenVibe.Events events only (C-75) (#87)OpenVibers · 11 Oct 2026 bdfd5d8
Media: no app-key seeding; every first-party tenant is token-only (C-71) (#86)OpenVibers · 11 Oct 2026 4d5bd72
Media: /p/:slug and /p/:slug/raw are unconditional 301s to Community; the local paste row-serving is deleted (T4/T10). (#46)OpenVibers · 7 Oct 2026 c3dc888
Materialized clips: a clip names its source's interior segments and re-encodes only its two edges, behind MEDIA_MATERIALIZED_CLIPS (off by default; F3.6) (#44)OpenVibers · 5 Oct 2026 706c2de
Compose Media's pages through openvibe-shared/shell; add /llms-full.txt and IndexNow; pin openvibe-shared v2.10.0 (#41)OpenVibers · 5 Oct 2026 8d41bca
Queue an object.pack after every finished CMAF cut (#31)OpenVibers · 5 Oct 2026 d5deebb
Queue the CMAF timeline at finalize and sign playlists for longerOpenVibers · 4 Oct 2026 76f8590
Index video objects as CMAF segments and serve HLS from the timelineOpenVibers · 4 Oct 2026 214a810
Alert when a placement move fails three times; hold dry-run ceilings (#24)OpenVibers · 4 Oct 2026 0b0ca81
Record per-object demand in Valkey and stage hourly media.object.hotOpenVibers · 3 Oct 2026 7970a3a
Align version pins and declare shield, lineage and paste-route env vars (#13)OpenVibers · 2 Oct 2026 fa04eb8
Plan T4: steps 7 and 8 of the ordered cleanup brief in… (#10)OpenVibers · 2 Oct 2026 aab4b07
X-Internal-Key is gone from Media (plan T2, the last step): POST /internal/avatar-ingest takes only a Network service token holding media.avatar.ingest, loopback only; guardOrKey, config.network.internalApiKey and INTERNAL_API_KEY are deleted (production no longer sets it), and the visitor-hash secret is VIEW_HASH_SECRET or MEDIA_SECRET with a named warning when neither is set in production. Tests: token with the capability passes, without it 403, wrong audience and sandbox 401, no credential or a forged Bearer refused. npm test and test:pg 75/76, 1 skipped (verified).OpenVibers · 29 Sept 2026 809b06b
Media Fabric F1a: every read goes through one placement router (docs/media-fabric.md).OpenVibers · 29 Sept 2026 b2bdc44
The SQLite era is gone (on PostgreSQL since 2026-09-28; no compatibility kept): the one-time migrate-to-postgres script, the *_DB_PATH settings (config, .env.example, systemd unit, test helpers), the unused better-sqlite3 dependency and its lockfile entries, and docs, docstrings and STATUS lines about SQLite or its rollback window. observability.test.js waits up to 30 s for the real server to boot (a cold PGlite boot plus migrations missed the 10 s window on a loaded machine). Reviewed independently (VERDICT: SHIP). npm test 64/65 test files passed, 1 skipped (n-1.test.js: N-1 SQL: skipped (the recorded N-1 releas.OpenVibers · 29 Sept 2026 dbdcbee
Media on PostgreSQL (ADR-035, roadmap WS-X2): openvibe-sdk/db, async throughout, jobs and quotas safe under concurrency.OpenVibers · 28 Sept 2026 e3f2239
Per-actor rate limits at Media's capability boundaries (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/actor-limits.js makes one limiter that counts each caller: the Network token's principal (svc:community, app:app_… of a developer project), the person signed in to /api/v2/me, or an app acting for one of its users (X-OV-User-Id, counted per user). An app's own API key is not counted, since that first-party server speaks for every visitor of its site and limits them itself; a browser with only an upload token is counted by address. Past a limit the route answers 429 problem+json rate_limited with Retry-After before any work, logs one [Limits] line and counts media_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 1125a3c
Owner subjects: every media object that names an app-local owner (owner_app + owner_user_id) gets the owner's canonical Network subject in owner_subject, so Live's lineage resolver and other consumers read owner.subject instead of translating Live user ids (roadmap D01/D20; 0 of 3,032 user-owned objects had one). scripts/backfill-owner-subject.js resolves the owners through Network's POST /internal/identity/resolve-batch (500 ids per call). It is a dry run by default and prints per tenant the objects to fill, already set, unresolvable, in an unsupported tenant and with no owner. --apply requires --backup <file.json>: it takes an online backup to <file>.media.db and checks it with integrity_check, writes the rows it will change to <file.json>, then fills them 500 per transaction. It never writes over a non-null owner_subject or a row whose owner changed. --rollback <file.json> [--apply] clears only the rows that still carry the subject the backfill wrote. The script opens SQLite directly, so none of the service's boot work (marking in-progress clip cuts failed) runs. New objects: X-OV-Subject is still stored at creation, and a reconcile job (every MEDIA_OWNER_SUBJECT_INTERVAL_MIN, default 10; MEDIA_OWNER_SUBJECT_SYNC=0 stops it) fills every object that names only an owner id: projections, and v2 uploads that send only user_id. It asks Network only when something is missing, and uploads never wait on it. A re-projection to a different owner drops the subject until the job resolves the new one. Network is asked with a service token (identity.subject.resolve, Network c3b7cf3), and with INTERNAL_API_KEY until Network grants it. Only live ids are resolved (SOURCE_SYSTEMS); no other tenant stores owner ids todayOpenVibers · 23 Sept 2026 31c2899
Restore drills: MEDIA_DRILL=1 makes Media a read-only instance on a restored copy of media.db, so `ovhost drill media` can boot one next to production. It refuses to start unless DB_PATH is set and outside the checkout and /opt/openvibe.media, HOST is loopback and PORT is not 4100, before the database is opened. It then starts only its HTTP server: no app seeding or JWKS refresh, no tiering sweep, health job, junk sweep, clip re-cuts, copy verification, jobs worker, disk guardian, thumbnail cleanup, object purge, backfill, orphan-recording finalize or Events relay, and webhooks are never sent (their URLs in the apps table are production's). It writes no file and creates no directory, and never opens a file path from the database: every byte route (/v and /c bytes, /t, /a, /f, /o, paste screenshots, live frames, legacy thumbnails) answers 503 while watch pages and /browse still render. Everything but GET/HEAD/OPTIONS answers 403, /auth/* 503, and net/fetch/child_process/dgram/listen are guarded so nothing leaves the process (only git runs: no ffmpeg or ffprobe). /api/ready drops the storage and remote-tier checks and says mode: drill. test/drill-mode.test.js boots the real server that way against a copy whose app has a webhook URL and checks each pointOpenVibers · 23 Sept 2026 6e74eb0
Wave 4: media job system, multipart and presigned uploads, R2 eviction drillOpenVibers · 23 Sept 2026 d006749
Developer-project tenants (Wave 20, ADR-014): app tokens get a Media tenant per projectOpenVibers · 23 Sept 2026 bfc9e1b
Media outcomes as durable events: vod/clip ready|failed, object uploaded and storage alerts also go to OpenVibe.Events through an outbox (openvibe-sdk 0.2.2); webhooks unchanged; openvibe-contracts v0.8.0OpenVibers · 23 Sept 2026 1122f52
Initial OpenVibe releaseOpenVibers · 17 Aug 2026 065dac9