Commits

main · package-lock.json

Size budgets for the home page (WS-T task 1): openvibe-shared/perf-budget 1.15.0 measures / as the server answers it (a fresh database, no browser) in npm test; budgets a little above the 2026-09-26 measurement (html 88 KB, js 6 files 228 KB / 54 KB brotli)OpenVibers · 26 Sept 2026 71cf9577
Site settings as revisioned configuration (WS-C task 7): network.site_settings on openvibe-shared/config 1.14.0 journals every admin change (PUT /api/admin/settings, /email, /discord) as a revision with who and why, rows keep their type (a new row takes the caller's), rows written around it are recorded as a sync revision first, history with secrets as keyed fingerprints and owner-only rollback (GET/POST /api/admin/config…); readers unchanged; migration flags and the push key pair stay outsideOpenVibers · 26 Sept 2026 cc405d58
Moderation audit: media.moderation.action too (Media's staff holds), in the consumer, the subscription topics and the admin filter; contracts 0.54.0OpenVibers · 26 Sept 2026 ce7596b1
Moderation audit log (WS-D task 1): records tools, games, wiki, blog, news, reviews, deals, coupons, trade and codes .moderation.action (common.moderation-action@1, Contracts 0.53.0), one row each with the service from the event's prefix (action, actor_subject, target type/id/owner, reason, details); the consumer's TOPICS (and so scripts/subscribe-events.js) cover them; the admin Moderation log filters by each. Pins: openvibe-contracts 0.49.0 → 0.53.0OpenVibers · 26 Sept 2026 89f3eee4
Pins: openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 ca7b6f0d
Platform blocks (WS-E task 5, Contracts 0.49.0): user_blocks by subject with a per-pair revision, /api/v1/me/blocks to list, block and unblock (never yourself or a guest; staff blockable, staff actions never hidden), network.block.changed in the outbox in the same transaction, GET /internal/blocks for Chat and Community (network.blocks.read, token only), no notification from a person the recipient blocked, Blocked people on the account page, and scripts/import-blocks.js for Chat's dm_blocks exportOpenVibers · 25 Sept 2026 ccbffa75
Audited service grants and staff APIs (WS-D tasks 3 and 4, Contracts 0.48.0): the owner grants, changes or revokes a service principal's capability at /api/admin/grants (and the admin Service grants tab), always with a reason and optionally an expiry; the audience is the capability owner's; each change writes principal_grant_changes and network.principal_grant.changed in one transaction; an expired grant leaves tokens at once and its expiry is recorded once; the seed stays DEFAULT_GRANTS. GET /api/v1/staff/capabilities (the caller's role and staff capabilities) and GET /api/v1/staff/moderators[?service=] (staff with staff.moderation.logs, or a service token with network.staff.read)OpenVibers · 25 Sept 2026 8b480077
Moderation audit log (WS-D task 1): records live.moderation.action (Contracts 0.46.0; Live's staff actions outside chat) as service live; filters by action and a since/until range beside service, actor and target; format=csv exports up to 5,000 matching rows (formula-looking cells kept as text); the admin tab gains the filters, Live as its own service and an Export CSV buttonOpenVibers · 25 Sept 2026 d3c370ec
Pins: openvibe-contracts 0.42.0 → 0.44.0, openvibe-sdk 0.5.0 → 0.9.1; test/registry-topics.test.js expects the live manifest's two new topics (live.index_document.upserted|deleted, Contracts 0.44.0); CI runs the pin-drift checkOpenVibers · 25 Sept 2026 7c4b37b6
Manifest-derived registry (WS-C task 1, Contracts 0.42.0): the loopback addresses, exposure states and the frame's site list come from the service manifests (internalOrigin, exposure, site); INTERNAL, READY_PATHS, EXPOSURE and RAW_SITES are no longer written here, OV_<ID>_INTERNAL_URL still overrides; test/registry-manifest-fixture.test.js: a new manifest appears in discovery, the registry, the status page and the site list with no code edit; npm test also runs staff-claims.test.js, which it had missedOpenVibers · 25 Sept 2026 ca0b63ef
Contracts 0.41.1 (plain-language module descriptions); the AI & Data tab names who keeps each record (OpenVibe.Chat, OpenVibe.Tools…)OpenVibers · 25 Sept 2026 c47ad2fc
User modules (Contracts 0.41.0, WS-B task 9): a service reading another's namespace sees only the fields readers lists for it; stored records read at the current version through the namespace's migrations and are stored at it on the next write; grants for chat.tts_defaults/dm_settings/presence_prefs (Chat), live.stats (Live, which loses its chat.* grants), ai.preferences/ai.usage_summary (AI), community.profile, wiki.projects; my.openvibe.network stars favourite tools (tools.usage v2)OpenVibers · 25 Sept 2026 707504c2
Contracts 0.40.0: openvibe.chat joins the first-party origins (the shared navbar on the new Chat site talks to Network)OpenVibers · 24 Sept 2026 ee78598d
Revocation propagation (WS-B task 4, Contracts 0.39.0): revokeTokens() moves token_valid_after, ends Network sessions and queues network.user.token_valid_after in the same transaction; password change and reset, bans, POST /api/auth/sign-out-everywhere and admin POST /users/:id/sign-out use it. 'Revoke All Sessions' only deactivated session rows while every token stayed valid: it is now 'Sign out other devices' (all tokens end, this browser gets a fresh one), next to 'Sign out everywhere, this device too'. test/revocation.test.jsOpenVibers · 24 Sept 2026 8033d016
User tokens carry staff_map (the staff map version their staff_caps come from; Contracts 0.38.0, map 1.1.0), so services judge capabilities added later by the role instead of waiting for new tokensOpenVibers · 24 Sept 2026 196c76ef
The GitHub token is configurable in admin (Settings → GitHub, owner-only): GITHUB_TOKEN in the environment first, else the saved value; admin shows its source and last four characters and a Test that asks GitHub for the rate limit, never the value. The registry's library tags read it at call time; OpenVibe.Blog reads it over GET /internal/integrations/github-token with capability network.integration.github.read (Contracts 0.37.0, granted to blog only, no shared key). test/github-integration.test.jsOpenVibers · 24 Sept 2026 8c9fa757
The moderation audit log (ADR-022): Network records chat.moderation.action (Chat and Live), community.moderation.action, tips.interaction.moderated and billing.staff.action from Events, once each inside the consumer's inbox transaction and never as notifications; staff with staff.moderation.logs list them at GET /api/v1/staff/moderation-audit (service/actor/target filters, paged) and in admin's Moderation log tab; openvibe-contracts 0.36.0OpenVibers · 24 Sept 2026 b1b9f92c
openvibe-shared 1.12.0 (the navbar loads its siblings from its own origin)OpenVibers · 24 Sept 2026 6be99391
openvibe-shared 1.11.1: the footer's shipped line follows each site's own serviceOpenVibers · 24 Sept 2026 b95d2d0f
The OpenVibe Frame: server/chrome is server/frame; /api/frame and /api/frame/hit (the /api/chrome names stay as aliases for openvibe-shared older than 1.11.0); chrome_cache/chrome_hits are renamed frame_cache/frame_hits once on boot, rows kept (tested); openvibe-shared 1.11.0 (openvibe-shared/frame)OpenVibers · 24 Sept 2026 7571ba73
What shipped, network-wide: /api/v1/changelog proxies OpenVibe.Blog's changelog (60 s cache, stale on failure, public CORS) so every site's shared widget reads it from openvibe.network; /updates renders the whole network's log (server-side first page, then openvibe-shared shipped.js: days, Load more, a filter per site, Patch notes). openvibe-shared 1.9.0 (footer 'shipped X ago' line and Updates link on every site, navbar stale-token fallback to the site session, footer empty-bar fix); home links All updatesOpenVibers · 24 Sept 2026 0b3b2e36
Recently shipped across OpenVibe on the home page: openvibe-shared v1.8.0 (served as /shared/shipped.js for every site) renders the network changelog from openvibe.blog, each change linked to its commit and the latest Patch notes post; connect-src allows openvibe.blog; a no-JS link to the Patch notes seriesOpenVibers · 24 Sept 2026 6e794b93
Community may publish its events (events.event.publish on openvibe.events); openvibe-contracts v0.35.0 (community.* payload contracts)OpenVibers · 24 Sept 2026 1837cb89
openvibe-contracts v0.34.1 (Tools platform S7): sandbox apps hold tools.tool.read and tools.tool.run by default (the run API is live); the self-service catalog lists public capabilities only (partner ones like tools.net.probe are staff-granted); the publishing library joins the registry's libraries; realtime is retired (ADR-005) in the registry testsOpenVibers · 24 Sept 2026 1664d042
openvibe-contracts v0.33.1: tools.tool.read is active (Tools serves GET /api/v1/tools on the gateway and every satellite), so the registry and /status show it as such; tools.tool@1 1.1.0 adds optional keywords and examples. Additive; pins only (npm install on the host rewrites package-lock.json with npm 9: git checkout -- package-lock.json after)OpenVibers · 24 Sept 2026 9a59212a
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 f76130d5
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0OpenVibers · 23 Sept 2026 0b756833
Analytics comes from openvibe-shared/analytics (v1.4.0; retires C-80): server/analytics/ keeps only network.js, the service specifics (SERVICE, PARAM_PREFIXES, PATH_RULES, and PATH_OPTS = { paramPrefixes, pathRules }); openAnalytics keeps its own connection to network.db and returns the package's AnalyticsTracker with retention: false and those path options, so the NetworkAnalyticsTracker subclass, preReducePath and prescrub are gone (the package applies pathRules in the tracker and in the scrub); schedulePrune is retention.schedulePrune. The hand-copied index/privacy/retention/schema/tracker files are deleted. scripts/analytics-prune.js is a wrapper over openvibe-shared/analytics/prune-cli with Network's path options, repo-root-relative paths, the defaultDbPath export and the VACUUM warning in its help. test/analytics-privacy.test.js tests the package with Network's options, checks every written row against analytics/event.v1, and sends a Sec-GPC and a DNT request through Network's routers that leave nothing. New with v1.4.0: a request with Sec-GPC: 1 or DNT: 1 is not recorded at all (no raw row, visitor hash, session id or rate counter); README notes itOpenVibers · 23 Sept 2026 9bbd90f7
openvibe-contracts v0.28.0 -> v0.30.1: realtime is the only placeholder manifest left (AI, SDK, Shared and Examples are alpha), so the exposure overlay's comment says how each exists instead of correcting a placeholder label, the contracts library row reads v0.30.1, and AI is polled on its manifest's own /api/health and /api/ready (the READY_PATHS/HEALTH_PATHS stand-ins are gone). Footer site copy reads the answering model from run.provenance.model (ai.run@1; run.route is { key, version }, there is no run.model), and test/chrome.test.js answers with the contract's shape and checks the stored modelOpenVibers · 23 Sept 2026 692c7751
Notifications from Events: POST /internal/events turns deals.watch.matched (payload.recipient) and trade.alert.triggered (subject user) into inbox notifications (DEAL_WATCH_MATCH / TRADE_ALERT, category service, so the person's mute and email choices apply). openvibe-sdk v0.4.0 parseDelivery with requireV2 (v1-only, stale or forged deliveries are refused), exactly once per event_id through the SDK inbox (network_event_inbox), unknown types acknowledged and ignored, links only to sites whose domain serves the service. Inert until NETWORK_EVENTS_SECRET is set and scripts/subscribe-events.js has created the two subscriptions (consumer network, endpoint http://127.0.0.1:4000/internal/events). Coupons publishes no watch event yet, so there is nothing of it to consumeOpenVibers · 23 Sept 2026 07cd98c7

More commits