/openapi.json: the service's public API as OpenAPI 3.1 (SEO-3) (#201)

ddiff --git a/server/app.js b/server/app.js
iindex 645a940..5d59386 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -110,6 +110,25 @@ async function createApp(opts = {}) {
      const ctx = { config, store, accountData, accountSend, outbox, publication, clusters, sources, ai, community, discussion, ingest, stories, topics, people, reading, auth, viewers, worker, indexnow, briefs };
  
      const app = express();
++    // GET /openapi.json (SEO-3): this service's public API as OpenAPI 3.1, generated from the contracts
++    // (openvibe-contracts); the operations they mark internal-only are left out.
++    app.get('/openapi.json', (_req, res) => {
++        const doc = require('openvibe-contracts').openapi.document('news');
++        if (!doc) return res.status(404).type('text/plain').send('No API document.');
++        const METHODS = new Set(['get', 'put', 'post', 'delete', 'patch', 'head', 'options']);
++        const paths = {};
++        for (const [p, item] of Object.entries(doc.paths || {})) {
++            const kept = {};
++            for (const [k, op] of Object.entries(item || {})) {
++                if (!METHODS.has(k)) { kept[k] = op; continue; }
++                const vis = [].concat((op && op['x-openvibe-visibility']) || []);
++                if (vis.length && vis.every((v) => v === 'internal')) continue;
++                kept[k] = op;
++            }
++            if (Object.keys(kept).some((k) => METHODS.has(k))) paths[p] = kept;
++        }
++        res.set('Cache-Control', 'public, max-age=3600').set('Access-Control-Allow-Origin', '*').json({ ...doc, paths });
++    });
      app.disable('x-powered-by');
      app.set('trust proxy', config.trustProxy);
      const release = require('openvibe-shared/release').createRelease({ service: 'news', root: path.join(__dirname, '..') });
ddiff --git a/test/openapi-json.test.js b/test/openapi-json.test.js
nnew file mode 100644
iindex 0000000..e13300f
---- /dev/null
++++ b/test/openapi-json.test.js
@@@ -0,0 +1,13 @@
++'use strict';
++// SEO-3: /openapi.json answered 404 here (11-03). It is the contracts' OpenAPI 3.1 document for this service
++// (openvibe-contracts), without the operations they mark internal-only.
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++const doc = require('openvibe-contracts').openapi.document('news');
++assert.ok(doc && doc.openapi && /^3\.1/.test(doc.openapi), 'the contracts carry an OpenAPI 3.1 document for news');
++const src = fs.readFileSync(path.join(__dirname, '..', 'server/app.js'), 'utf8');
++assert.match(src, /app\.get\('\/openapi\.json'/, 'the route is mounted');
++assert.match(src, /openapi\.document\('news'\)/);
++assert.match(src, /vis\.every\(\(v\) => v === 'internal'\)\) continue;/, 'internal-only operations are left out');
++console.log('openapi.json: ok');