openvibers/openvibe.reviews Commits

Reviews: pins current (contracts 0.107.0, shared 2.11.0, sdk 0.34.0). (#13)

OP OpenVibers committed 7 Oct 2026 · 14fca9783e · 5 files, +22 −21

**Old → new pins (one line per change):**

- `package.json:27` — openvibe-contracts v0.96.0 → v0.107.0
- `package.json:29` — openvibe-sdk v0.26.0 → v0.34.0
- `package.json:30` — openvibe-shared v2.10.1 → v2.11.0
- `package.json:28` — openvibe-publishing v1.3.0 (unchanged; already newest tag)
- `package-lock.json:17,19,20` (and resolved blocks `:863,897,926`) — same three pins regenerated; publishing unchanged
- `README.md:159` — contracts (pinned at v0.107.0)
- `README.md:231` — packages line: contracts v0.107.0, shared v2.11.0, sdk v0.34.0
- `README.md:309` — acceptance item 5: contracts v0.107.0
- `STATUS.json:10` — contracts v0.107.0
- `STATUS.json:13,14` — shared v2.11.0, sdk v0.34.0
- `CHANGELOG.md:5` — new Unreleased entry for the three moves

`STATUS.json` `updated` already reads `2026-10-07`, so it was left as-is. Not committed or pushed.

**Full test result line:** `21 passed in 73 s.` (`nice -n 15 ov test --no-cache --shards 1 --all`, Node 22.23.3, 1 shard, all 21 files ✓)

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex f520e27..f665c2a 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -2,5 +2,6 @@
  
  ## Unreleased
  
++- Library pins brought current (pin, lockfile and `node_modules`): openvibe-contracts v0.96.0 → v0.107.0, openvibe-shared v2.10.1 → v2.11.0, openvibe-sdk v0.26.0 → v0.34.0; openvibe-publishing stays v1.3.0 (already newest). Nothing in the ranges breaks Reviews — the whole suite is green with no test or budget changes. README and STATUS.json name the new versions.
  - openvibe-contracts moves from v0.76.0 to v0.96.0 (pin, lockfile and `node_modules`); nothing in the range breaks Reviews, and the contracts' own service check is green. All eight `reviews.*` ids are now defined by the release, so `server/auth/capabilities.js` drops its local fallback for proposed ids and sends every check through the library's grant rule; `test/capabilities.test.js` pins that every guarded id is defined and that exact, prefix, denied and unknown ids answer as `capabilities.check()` does. README and STATUS.json name v0.96.0.
  - Every page is rendered through `openvibe-publishing/layout` (v1.2.0, on `openvibe-shared/shell` v2.6.0): the head, the Frame, the noscript navigation, the footer and its init come from the shared document; robots is still exactly what each route passes (the entity page now passes the indexability gate's decision instead of a prebuilt head block). The shell adds `web-runtime.js`, so the home page's JS budget is raised to 257 KB, 61.5 KB brotli (measured 239.1 / 56.3, was 212.2 / 49.9).
ddiff --git a/README.md b/README.md
iindex cbc10aa..44d276c 100644
---- a/README.md
++++ b/README.md
@@@ -156,7 +156,7 @@ A write carried by the `ov_token` cookie that another site started is 403 `reque
  | `reviews.summary.publish` | `POST /entities/:ref/summary/revisions` (`correction_note`, `correction_id`: a correction, published at once), `…/revisions/:n/review`, `…/summary/publish`, `…/summary/unpublish` |
  | `reviews.correction.submit` | `POST /entities/:ref/corrections` |
  
--The ids and the service manifest are released in openvibe-contracts (pinned at v0.96.0; the source
++The ids and the service manifest are released in openvibe-contracts (pinned at v0.107.0; the source
  proposals stay in [docs/capabilities-proposal/](docs/capabilities-proposal/) and
  [docs/service-manifest-proposal.json](docs/service-manifest-proposal.json)); `server/auth/capabilities.js`
  decides them with the contracts grant rule. `reviews.entity.manage` and
@@@ -228,7 +228,7 @@ by editors; signals arrive only from Sources.
  - OpenVibe.AI — optional, proposes summaries through `reviews.summary.propose`
  - OpenVibe.Search — consumes the index events
  - PostgreSQL 18 and Valkey 9 (OpenVibe.Host `roles/data/`, ADR-035): every read and write is async through `openvibe-sdk/db`; Valkey holds the per-actor limit counters (optional)
--- packages: openvibe-publishing v1.3.0, openvibe-contracts v0.96.0, openvibe-shared v2.10.1, openvibe-sdk v0.26.0
++- packages: openvibe-publishing v1.3.0, openvibe-contracts v0.107.0, openvibe-shared v2.11.0, openvibe-sdk v0.34.0
  
  ## Capabilities
  
@@@ -306,7 +306,7 @@ following hold (plan §12.12):
  2. canonical identity/auth integration (Network subjects, a scoped service principal) — **built** and provisioned in production;
  3. server-rendered public routes useful without JavaScript — **built**;
  4. real persistence and end-to-end workflows — **built** and deployed on the host (loopback only, empty database); no Sources review source is enabled yet;
--5. capability and event registration against OpenVibe.Contracts — **done** (openvibe-contracts v0.96.0);
++5. capability and event registration against OpenVibe.Contracts — **done** (openvibe-contracts v0.107.0);
  6. a migration/seed strategy (schema migrations in [migrations/](migrations/); nothing seeded), a security/threat review, sitemap/robots/feed behaviour — discovery **built**; threat review **written**: [docs/threat-review.md](docs/threat-review.md) (the service authors' own, from the code: controls with file:line references, the gaps fixed in that pass and the ones that remain; an independent review is still to come);
  7. acceptance tests proving the advertised functionality — **built** (`npm test`).
  
ddiff --git a/STATUS.json b/STATUS.json
iindex 2058fb8..01b2482 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -7,11 +7,11 @@
    "runtime": "node 22, express, postgresql",
    "port": 4830,
    "domain": "openvibe.reviews",
--  "contracts": "openvibe-contracts v0.96.0",
++  "contracts": "openvibe-contracts v0.107.0",
    "packages": [
      "openvibe-publishing v1.3.0",
--    "openvibe-shared v2.10.1",
--    "openvibe-sdk v0.26.0"
++    "openvibe-shared v2.11.0",
++    "openvibe-sdk v0.34.0"
    ],
    "capabilities": [
      "reviews.entity.resolve",
ddiff --git a/package-lock.json b/package-lock.json
iindex 5d97524..630ef56 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -14,10 +14,10 @@
          "express": "^4.21.2",
          "express-rate-limit": "^7.5.0",
          "iovalkey": "^0.4.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.96.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.107.0",
          "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.3.0",
--        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.10.1",
++        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.34.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.11.0",
          "pg": "^8.23.0"
        },
        "devDependencies": {
@@@ -859,9 +859,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.96.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.96.0",
--      "integrity": "sha512-QEXfNYNkK6n49sXokgbP2FTKaIEawRJOS7Xij9g20fBFSqiVv14voZ60LqECPl1VMZedoSGuYLa8doVlnSxH0w==",
++      "version": "0.107.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.107.0",
++      "integrity": "sha512-bttjTDLzCfHFtq5h0EkBaPspVV6U934jj5Hz7RViIh2UTiC2Xzy3d6AnHLsEomVyTwaiwg9veNiO+eZTZ0lxsg==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
@@@ -893,9 +893,9 @@
        }
      },
      "node_modules/openvibe-sdk": {
--      "version": "0.26.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
--      "integrity": "sha512-+RK89ZG4WAKIRh89yr3ieIvnyJVNSOI+dsbBqGNcr9UHsJStdxtM75zSDq8cUNpBPQ1X6ElatZrjU9S3s0aEkg==",
++      "version": "0.34.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.34.0",
++      "integrity": "sha512-vDwnDV1e2xbWqShjTr4p6sNehoUAQwW8RyQKrwvoqX1pJbxks86u2DjF9LGSlAoAdMZhmJbgVaAEm0r18Qmt5g==",
        "license": "MIT",
        "engines": {
          "node": ">=20"
@@@ -922,9 +922,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "2.10.1",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.10.1",
--      "integrity": "sha512-6fUOw22bSvxg0K33BefAyAkNRkETe9euLNT0CHs2mLIvzYR1q38KiHRUQIWj8FESbVANF0pXMojhBz5TeqpMtg==",
++      "version": "2.11.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.11.0",
++      "integrity": "sha512-F4P+3fZ1IslEA5Vmv5GKdL3TwuNjJ//52XNp+46BnZL3NzVTd6dl/jmdRgIWjlKN+YHKf69zqVWhWFJZG0EafA==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
ddiff --git a/package.json b/package.json
iindex cd7ea75..de99064 100644
---- a/package.json
++++ b/package.json
@@@ -24,10 +24,10 @@
      "express": "^4.21.2",
      "express-rate-limit": "^7.5.0",
      "iovalkey": "^0.4.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.96.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.107.0",
      "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.3.0",
--    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.10.1",
++    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.34.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.11.0",
      "pg": "^8.23.0"
    },
    "engines": {