openvibers/openvibe.news Commits

openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0

OP OpenVibers committed 23 Sept 2026 · 2c4d395ea1 · 7 files, +26 −21

- /release.json is mounted with release.mount(app, { registry }): POST /release-metrics takes open
  tabs' update reports into /metrics (release_client_updates_total). On contracts 0.32.0 the
  manifest carries the release-manifest 1.1.0 fields; no components are declared, so every
  release still prompts a reload. test/ops.test.js validates the served manifest against the
  contracts.
- identity.service-token-claims 1.2.0 (contracts 0.26.0) requires project_id and env on app tokens:
  the mock Network's app tokens carry them, as Network's do. serviceAuth now refuses a sandbox app
  token itself with token.sandbox_refused, the code News already answered; no news.* capability
  can be granted to a developer app (all first-party).
- SDK 0.4.0 -> 0.5.0 only adds the Media objects client. README and STATUS list the new pins.

Changes

ddiff --git a/README.md b/README.md
iindex ca09e55..b80cc0f 100644
---- a/README.md
++++ b/README.md
@@@ -217,9 +217,9 @@ are the proposals they were released from.
  ## Depends on
  
  - **Packages** (pinned by release tarball): `openvibe-publishing` v0.2.1 (revisions, citations,
--  authorship, seo, index-hooks, ssr, taxonomy slugify), `openvibe-contracts` v0.21.0,
--  `openvibe-shared` v1.3.0 (chrome, app icon, footer, legal, release, metrics, ready, seo),
--  `openvibe-sdk` v0.4.0 (events outbox and inbox, webhook signatures v2, service tokens).
++  authorship, seo, index-hooks, ssr, taxonomy slugify), `openvibe-contracts` v0.32.0,
++  `openvibe-shared` v1.5.0 (chrome, app icon, footer, legal, release, metrics, ready, seo),
++  `openvibe-sdk` v0.5.0 (events outbox and inbox, webhook signatures v2, service tokens).
  - **OpenVibe.Sources** (4720): `sources.item.read`; optionally `sources.source.read` (outlet
    names and source health; without it the outlet is the URL's host).
  - **OpenVibe.Events** (4300): `events.event.publish`; `events.subscription.manage` to create the
ddiff --git a/STATUS.json b/STATUS.json
iindex c06e218..9faeb63 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -7,7 +7,7 @@
    "runtime": "node 22, express 4, better-sqlite3 11",
    "port": 4820,
    "domain": "openvibe.news",
--  "packages": ["openvibe-publishing v0.2.1", "openvibe-contracts v0.21.0", "openvibe-shared v1.3.0", "openvibe-sdk v0.4.0"],
++  "packages": ["openvibe-publishing v0.2.1", "openvibe-contracts v0.32.0", "openvibe-shared v1.5.0", "openvibe-sdk v0.5.0"],
    "capabilities": ["news.story.create", "news.story.read", "news.story.revise", "news.story.publish", "news.story.retract", "news.cluster.read", "news.cluster.manage", "news.source.attach", "news.timeline.update", "news.perspective.update", "news.topic.manage"],
    "capabilitiesRegistered": true,
    "serviceManifestRegistered": true,
ddiff --git a/package-lock.json b/package-lock.json
iindex e6b9bfa..fd95a31 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -15,10 +15,10 @@
          "express": "^4.21.2",
          "express-rate-limit": "^7.5.0",
          "helmet": "^8.1.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.21.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.32.0",
          "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v0.2.1",
--        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.4.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.3.0"
++        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.5.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.0"
        },
        "devDependencies": {
          "jsonwebtoken": "^9.0.2"
@@@ -1015,9 +1015,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.21.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.21.0",
--      "integrity": "sha512-ckLekaz2IKYmMcapGCeHs85ztxtqr3BGkXXAY/7rQjlzfBHSugSDwsZ/v1SCASG2CnyV/NsRyRojCZWGAB3Gew==",
++      "version": "0.32.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.32.0",
++      "integrity": "sha512-ntN58SIG03YDxbhsiIzOM5GRH19jRMHZUYWI3xU2VwovExagF5DdwApLVfezsu84UTJ+V2Jfn+LWDc+Oz8ab+g==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
@@@ -1060,18 +1060,18 @@
        }
      },
      "node_modules/openvibe-sdk": {
--      "version": "0.4.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.4.0",
--      "integrity": "sha512-Hyz55YOMIs0xwCQ1NXsN0sUYhlbKXAX3uWY2fPCdEEL18FXUYVhK8wlG/5JMMypFHnjDiSd9VHzBNG12hWsmkQ==",
++      "version": "0.5.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.5.0",
++      "integrity": "sha512-QVJkR5iazQX0ZwIrDp2A88ZeYYBSXEmSzhpgURPUSnzezIM3jz0HBhVKowyhkvg2aBO61XNf77eb4zJGkMjZiw==",
        "license": "MIT",
        "engines": {
          "node": ">=20"
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "1.3.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.3.0",
--      "integrity": "sha512-w8yl/5+9eend8I2O/DzAJnEAL2N3GTUY7c7pzK+MLJuLAGD8FmJJQ9gwbgyrq70Snjt3ebrg3TlpORhRAp2kgA==",
++      "version": "1.5.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.0",
++      "integrity": "sha512-cehnscuYMkJwuCYGcI6wPSswbUn0bhTyGAaD5feNCoO//2e9gyC7cgjkEcIOtM8DQF3yTuUNyXnOwckIeM4fUg==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
ddiff --git a/package.json b/package.json
iindex 4db9cda..2266ffe 100644
---- a/package.json
++++ b/package.json
@@@ -22,10 +22,10 @@
      "express": "^4.21.2",
      "express-rate-limit": "^7.5.0",
      "helmet": "^8.1.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.21.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.32.0",
      "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v0.2.1",
--    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.4.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.3.0"
++    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.5.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.5.0"
    },
    "devDependencies": {
      "jsonwebtoken": "^9.0.2"
ddiff --git a/server/app.js b/server/app.js
iindex efa4aa2..23cae79 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -104,7 +104,8 @@ function createApp(opts = {}) {
  
      // ── Machine endpoints ───────────────────────────────────
      app.get('/api/health', (_req, res) => res.json({ status: 'ok', service: 'openvibe-news', version: VERSION }));
--    app.get('/release.json', release.handler);
++    // GET /release.json (ADR-016) and POST /release-metrics: open tabs' update reports into /metrics.
++    release.mount(app, { registry: metrics.registry });
      const readiness = createNewsReadiness({ store, auth, outbox, ingest, config, release: release.release });
      app.get('/api/ready', readiness.handler);
  
ddiff --git a/test/helpers/mocks.js b/test/helpers/mocks.js
iindex a4767f8..be96372 100644
---- a/test/helpers/mocks.js
++++ b/test/helpers/mocks.js
@@@ -68,8 +68,10 @@ async function startNetwork() {
          return json(404, { error: 'not found' });
      });
      issuer = srv.url;
++    // An app token carries its developer project and env, as Network's do (identity.service-token-claims 1.2.0).
      function signService({ sub, aud, cap, ns, actorType = 'service', extra = {} }) {
--        return serviceAuth.signServiceToken({ iss: issuer, sub, actor_type: actorType, aud, cap, ...(ns ? { ns } : {}), iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 300, jti: crypto.randomUUID(), ...extra }, privatePem);
++        const app = actorType === 'app' ? { project_id: 'prj_01J8ZQ4Y7N3M2K1H0G9F8E7D6C', env: 'production' } : {};
++        return serviceAuth.signServiceToken({ iss: issuer, sub, actor_type: actorType, aud, cap, ...(ns ? { ns } : {}), iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 300, jti: crypto.randomUUID(), ...app, ...extra }, privatePem);
      }
      function addUser(username, extra = {}) {
          const subject = ids.newId('user');
ddiff --git a/test/ops.test.js b/test/ops.test.js
iindex df3f12a..2f53ea1 100644
---- a/test/ops.test.js
++++ b/test/ops.test.js
@@@ -24,6 +24,8 @@ const { boot, check, done } = require('./helpers/boot');
          const rel = await t.get('/release.json');
          assert.strictEqual(rel.status, 200);
          assert.strictEqual(rel.json().service, 'news');
++        assert.deepStrictEqual(require('openvibe-contracts').validate('registry.release-manifest@1', rel.json()).errors, []);
++        assert.strictEqual(rel.json().metrics_url, '/release-metrics');
          const m = await t.get('/metrics');
          assert.ok([200, 404].includes(m.status));
      });