0.57.0: openvibe-sdk/reviews and openvibe-sdk/wiki (Reviews' entity reads and corrections, the Wiki's reads and search) (#68)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 50f94e9..cfcff10 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -3,6 +3,15 @@
  All notable changes to `openvibe-sdk`. The package follows semver; while it is `0.x`, a minor
  release may change an API and says so here.
  
++## 0.57.0 (2026-10-20)
++
++- **`openvibe-sdk/reviews`** (`createReviewsClient`): OpenVibe.Reviews for apps, whose reads became public in
++  openvibe-contracts 0.207.0: resolve a business, product or place from its identifiers (a match or candidates), list
++  and read entities with their aggregate, signals, summary and history, and send a correction to the editors for the
++  person (never retried on its own).
++- **`openvibe-sdk/wiki`** (`createWikiClient`): OpenVibe.Wiki's reads: search, spaces, and pages with their revisions,
++  diffs and citations, as the person may read them (without one, public pages only).
++
  ## 0.56.0 (2026-10-20)
  
  - **`openvibe-sdk/blog`** (`createBlogClient`): OpenVibe.Blog, the first product whose API only its own site could use
ddiff --git a/README.md b/README.md
iindex 77eb5e0..1213790 100644
---- a/README.md
++++ b/README.md
@@@ -2,14 +2,14 @@
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.56.0 (roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat and AI clients from WS-F task 4; per-actor limits from WS-R task 4). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.57.0 (roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat and AI clients from WS-F task 4; per-actor limits from WS-R task 4). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
  **If a capability is not in the SDK, it is not public.** Apps call services through `openvibe-sdk` and never build internal routes themselves. A route with no SDK wrapper is internal, even when you can reach it, and it can change without notice. To make a capability public, first define it in OpenVibe.Contracts, then wrap it here.
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.56.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.57.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from Contracts v0.86.0, a devDependency the tests check them against).
@@@ -191,6 +191,8 @@ Until OpenVibe.Tools serves the gateway facade (Tools S6), point the jobs client
  | `openvibe-sdk/inventory` | server | `createInventoryClient(client)`: OpenVibe.Inventory, the network-wide inventory (ADR-054). Public reads: `kinds.list/get`, `definitions.list({kind, issuer})/get`, `people.items(subject)`, `people.equipped(subject)`, `equipped([subjects])` (≤ 100, for chat renders). The person's own: `me.items()`, `me.equip({kind, slot, instance_id | null})`. An issuer's: `definitions.create/update`, `grants.create({definition_id, subject, idempotency_key})` → `{ instance, created }` (retry-safe on the key), `instances.consume/revoke`. `forPerson(usr_…)` sends `X-OV-Subject` for a service acting for a person. Audience `openvibe.inventory` |
  | `openvibe-sdk/tips` | server | `createTipsClient(client)`: OpenVibe.Tips' `/api/v1`. A creator's page: `profiles.get/update/totals/sounds/supporters`. Tipping: `tip({creator, amount, message?, goal_id?, pay_with})` → `{ interaction, checkout_url, checkout_ref }`, `send.message/tts/media/sound`. Receipts: `interactions.get/list/recordExternal/hide/restore`. `goals.list/get/create/update/close`, `moderation.queue/log/moderators.*`, `overlays.tokens.*/configs.*/simulate`, `me.export/erase`. Every write carries an Idempotency-Key, which Tips replays once, so retries are safe. Audience `openvibe.tips` |
  | `openvibe-sdk/blog` | server | `createBlogClient(client)`: OpenVibe.Blog for the person who authorized the app. `blogs.get/posts(handle, {limit, offset, all})/feed` (JSON Feed), `posts.create(handle, {title, body, summary, visibility, …})` → `{ post, revision }`, `posts.get/update(id, {…, expected_revision})/publish(id, {revision})/unpublish/schedule(id, {at, revision, action})/cancelSchedule/revert/remove/revisions/revision(id, n)`. Public capabilities since openvibe-contracts 0.206.0; publish, unpublish, schedule and delete are sensitive. Creating and reverting are never retried on their own. Audience `openvibe.blog` |
++| `openvibe-sdk/reviews` | server | `createReviewsClient(client)`: OpenVibe.Reviews. `resolve({name, url, gtin, sku, mpn, source, external})` (a match or candidates; a name alone never matches), `entities.list({q, limit, offset})/get(ref)/history/aggregate/summaryRevision(ref, n)`, `corrections.submit(ref, {body, target_type, target_id, evidence_url})` (to the editors' queue for the person, never retried on its own). Public capabilities since openvibe-contracts 0.207.0. Audience `openvibe.reviews` |
++| `openvibe-sdk/wiki` | server | `createWikiClient(client)`: OpenVibe.Wiki's reads. `search(q, {space, limit})`, `spaces.list/get(space)`, `pages.get(id, {revision})/revisions(id, {before, limit})/revision(id, n)/diff(id, {from, to, mode})/citations(id, n)`: what the person may read (without one, public pages). Public capabilities since openvibe-contracts 0.207.0. Audience `openvibe.wiki` |
  | `openvibe-sdk/food` | server | `createFoodClient(client)`: OpenVibe.Food. Public: `places({kind, q, lat, lon, radius})` (food banks, pantries, free meals from OpenStreetMap), `foods.list/get` (the food list with store prices). The caller's own: `plans.create({people, days, budget, title})/list/get` (deterministic meal plans with a shopping list and costs), `pantry.get/set(items)` (with "what can I make" matches), `recipes.suggest({ask, people})/list` (AI recipe ideas, 10 a day). Plans and recipe ideas are never retried on their own. Audience `openvibe.food` |
  | `openvibe-sdk/actor` | server | `createActorClient(client)`: OpenVibe.Actor. `agents.list()` and `route({task, mode})` (a dry run) are public. `tasks.create({task, mode, budget, agent, idempotency_key, webhooks})` (retried only with an idempotency_key; `webhook_secret` comes back once), `tasks.list/get/cancel`, `tasks.events(id, {lastEventId})` (SSE until the task ends). A person's own agents: `me.agents.list/create/get/update/remove/run/runs` and `me.agents.memory.list/add/update/remove/clear`. Audience `openvibe.actor` |
  | `openvibe-sdk/run` | server | `createRunClient(client, {project?})`: OpenVibe.Run, jobs on worker nodes. `jobs.submit({class, artifact, args, limits, …})` (Idempotency-Key, so retried safely) → `{ created, job }`, `jobs.list({state, limit, cursor})`, `jobs.get/cancel`, `jobs.events(id, {lastEventId})` (SSE until `end`), `jobs.streamTicket(id)` (a one-use URL for a browser's EventSource); `forProject(prj_…)` sends X-OV-Project. Audience `openvibe.run` |
@@@ -477,7 +479,7 @@ Install the drivers the service uses: `pg` and `iovalkey` (production), `@electr
  - **Media:** the v1 files API, the object API v2 (`createObjectsClient`) and the public URL helpers are wrapped. Retention holds on v2 objects are not (app keys only). VOD, clip, thumbnail and admin-storage routes are not wrapped because apps reach them only through Live and Media's own servers. Media's own paste API is not wrapped because pastes moved to Community (ADR-011). The mock platform (`openvibe-sdk/testing`) models Media's v1 files only, not v2 objects.
  - **Media from the browser:** Media refuses user JWTs on `/api/v1/:app/files`, so a browser uploads through its own app server. That server holds the app key and names the user with `actingUserId`.
  - **Network coins, notifications and legacy-map writes** are internal service-to-service routes with no public capability, so they are not wrapped. Staff-only paste routes are also internal: admin stats, bulk, censor and the AI pass.
--- **Billing and Games** from the original charter come when those services publish their capabilities in Contracts (Live has its module since v0.52.0). Products whose capabilities are all first-party (Coupons, Deals, News, Reviews, Space, Trade, Watch, Wiki and others) have no module yet: there is nothing an outside app may call. Blog was the first to open its posts to apps (openvibe-contracts 0.206.0, `openvibe-sdk/blog`). Chat is wrapped over REST as the token's person (`openvibe-sdk/chat`, v0.11.0), but it has no app principal (`chat.message.send` is `first-party`) and the mock platform has no Chat.
++- **Billing and Games** from the original charter come when those services publish their capabilities in Contracts (Live has its module since v0.52.0). Products whose capabilities are all first-party (Coupons, Deals, News, Space, Trade, Watch and others) have no module yet: there is nothing an outside app may call. Blog opened its posts to apps (openvibe-contracts 0.206.0, `openvibe-sdk/blog`), then Reviews and the Wiki their reads (0.207.0). News' published stories need no capability, but its editorial reads stay first-party. Chat is wrapped over REST as the token's person (`openvibe-sdk/chat`, v0.11.0), but it has no app principal (`chat.message.send` is `first-party`) and the mock platform has no Chat.
  - **Tools** are not wrapped one by one: `openvibe-sdk/tools` runs any tool with `api: true` by id, and its descriptor (`tools.get(id)`) gives the input schema, files and limits. `openvibe-sdk/jobs` still submits any job `type` directly. The YouTube downloader is page-only (`api: false`), so it is not in the SDK.
  - **Realtime over WebSocket and presence** don't exist in Events yet (ADR-005). SSE is the only transport.
  - **Bot:** the REST robots, public kits/profiles and pairing routes are wrapped (`openvibe-sdk/bot`). The operator WebSocket (`/control`, Realtime frames `bot.command@1`), device bootstrap (`POST /devices/bind`, a Network node token) and the internal Run→Bot job dispatch (`bot.job.dispatch`, service-to-service and never delegated to people or apps) are not.
ddiff --git a/STATUS.json b/STATUS.json
iindex 8694227..1237520 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.56.0",
++  "version": "0.57.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 0a62d6f..6cbe638 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.56.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.57.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, registry, modules, realtime, media, community, bot, search, chat, ai, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -42,7 +42,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.56.0';
++const SDK_VERSION = '0.57.0';
  
  module.exports = {
      createClient,
ddiff --git a/esm/index.mjs b/esm/index.mjs
iindex e1a07c4..05f2577 100644
---- a/esm/index.mjs
++++ b/esm/index.mjs
@@@ -8,8 +8,8 @@ export const {
      registry, identity, modules, events, realtime, media,
      community, bot, search, chat, ai, jobs,
      tools, projects, resources, vip, quest, live,
--    inventory, tips, blog, food, actor, run,
--    video, work, zone, play, download, openre,
--    geo, usage, commerce, telemetry,
++    inventory, tips, blog, reviews, wiki, food,
++    actor, run, video, work, zone, play,
++    download, openre, geo, usage, commerce, telemetry,
  } = cjs;
  export default cjs;
ddiff --git a/esm/reviews.mjs b/esm/reviews.mjs
nnew file mode 100644
iindex 0000000..32a2457
---- /dev/null
++++ b/esm/reviews.mjs
@@@ -0,0 +1,7 @@
++// Generated by scripts/esm.js from src/reviews.js. Do not edit.
++import cjs from '../src/reviews.js';
++
++export const {
++    createReviewsClient,
++} = cjs;
++export default cjs;
ddiff --git a/esm/wiki.mjs b/esm/wiki.mjs
nnew file mode 100644
iindex 0000000..bc1349f
---- /dev/null
++++ b/esm/wiki.mjs
@@@ -0,0 +1,7 @@
++// Generated by scripts/esm.js from src/wiki.js. Do not edit.
++import cjs from '../src/wiki.js';
++
++export const {
++    createWikiClient,
++} = cjs;
++export default cjs;
ddiff --git a/index.js b/index.js
iindex b9749f5..c27e6a0 100644
---- a/index.js
++++ b/index.js
@@@ -30,6 +30,8 @@ module.exports = {
      inventory: require('./src/inventory'),
      tips: require('./src/tips'),
      blog: require('./src/blog'),
++    reviews: require('./src/reviews'),
++    wiki: require('./src/wiki'),
      food: require('./src/food'),
      actor: require('./src/actor'),
      run: require('./src/run'),
ddiff --git a/package-lock.json b/package-lock.json
iindex cd7eccc..4ea3f14 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.56.0",
++  "version": "0.57.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.56.0",
++      "version": "0.57.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex 19ed1a0..6f94278 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.56.0",
++  "version": "0.57.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
@@@ -314,6 +314,18 @@
        "import": "./esm/zone.mjs",
        "default": "./src/zone.js"
      },
++    "./reviews": {
++      "types": "./types/reviews.d.ts",
++      "browser": null,
++      "import": "./esm/reviews.mjs",
++      "default": "./src/reviews.js"
++    },
++    "./wiki": {
++      "types": "./types/wiki.d.ts",
++      "browser": null,
++      "import": "./esm/wiki.mjs",
++      "default": "./src/wiki.js"
++    },
      "./vip": {
        "types": "./types/vip.d.ts",
        "browser": null,
ddiff --git a/scripts/esm.js b/scripts/esm.js
iindex d47205e..554f86a 100644
---- a/scripts/esm.js
++++ b/scripts/esm.js
@@@ -59,6 +59,8 @@ const ENTRIES = {
      'inventory.mjs': '../src/inventory.js',
      'tips.mjs': '../src/tips.js',
      'blog.mjs': '../src/blog.js',
++    'reviews.mjs': '../src/reviews.js',
++    'wiki.mjs': '../src/wiki.js',
      'food.mjs': '../src/food.js',
      'actor.mjs': '../src/actor.js',
      'run.mjs': '../src/run.js',
ddiff --git a/src/core/index.js b/src/core/index.js
iindex 68dd00a..f843bdf 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.56.0';
++const SDK_VERSION = '0.57.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/reviews.js b/src/reviews.js
nnew file mode 100644
iindex 0000000..bce3ed0
---- /dev/null
++++ b/src/reviews.js
@@@ -0,0 +1,62 @@
++'use strict';
++/**
++ * openvibe-sdk/reviews — OpenVibe.Reviews for apps: look up a business, product or place (an entity) by name, URL or
++ * product code, read its record (the aggregate with its inputs, the signals with their provenance, the summary) and
++ * history, and send a correction to the editors for the person. Routes at https://openvibe.reviews/api/v1; tokens for
++ * audience openvibe.reviews. A developer app acts only for the person who authorized it (on_behalf_of).
++ *
++ *   const reviews = createReviewsClient(createClient({ tokenProvider }));
++ *   const hit = await reviews.resolve({ name: 'Blue Star Donuts', url: 'https://bluestardonuts.com' });   // a match or candidates
++ *   const { entities } = await reviews.entities.list({ q: 'donuts', limit: 20 });
++ *   const page = await reviews.entities.get('blue-star-donuts');                                          // aggregate, signals, summary
++ *   await reviews.corrections.submit('blue-star-donuts', { target_type: 'entity', body: 'Closed on Mondays now', evidence_url: 'https://…' });
++ *
++ * Capabilities (public since openvibe-contracts 0.207.0): reviews.entity.resolve (the reads and resolve) and
++ * reviews.correction.submit. Resolving is deterministic: a name alone yields candidates, never a match. A correction
++ * goes to the editors' queue; it changes nothing until an editor accepts it, and is never retried on its own.
++ * Errors are OpenVibeError: entity.not_found, item.not_found, item.removed (410), reviews.person_required,
++ * capability.denied, subject.not_delegated, …
++ */
++const enc = encodeURIComponent;
++const TARGETS = ['entity', 'alias', 'signal', 'summary', 'aggregate'];
++
++function createReviewsClient(client, { baseUrl } = {}) {
++    if (!client || typeof client.json !== 'function') throw new TypeError('createReviewsClient: pass an openvibe-sdk/core client');
++    const at = { service: 'reviews', baseUrl, audience: 'openvibe.reviews' };
++    const call = (opts) => client.json({ ...at, ...opts });
++    const entity = (ref, rest = '') => {
++        if (!ref || typeof ref !== 'string') throw new TypeError("reviews: an entity's ref (its slug or id)");
++        return `/api/v1/entities/${enc(ref)}${rest}`;
++    };
++
++    return {
++        /** Resolve identifiers to an entity (reviews.entity-resolve-request@1): name, url, gtin, sku, mpn, source, external. */
++        resolve: (identifiers, { signal } = {}) => {
++            if (!identifiers || typeof identifiers !== 'object' || !Object.keys(identifiers).length) throw new TypeError('reviews.resolve: at least one identifier');
++            return call({ method: 'POST', path: '/api/v1/resolve', json: identifiers, idempotent: true, signal });
++        },
++        entities: {
++            /** Active entities, or a search with q. */
++            list: ({ q, limit, offset, signal } = {}) => call({ path: '/api/v1/entities', query: { q, limit, offset }, signal }),
++            /** The entity page's data: the aggregate with its inputs, the signals with provenance, the summary. */
++            get: (ref, { signal } = {}) => call({ path: entity(ref), signal }),
++            /** Aggregate and summary revisions, merges and the audit trail. */
++            history: (ref, { signal } = {}) => call({ path: entity(ref, '/history'), signal }),
++            aggregate: (ref, { signal } = {}) => call({ path: entity(ref, '/aggregate'), signal }),
++            summaryRevision: (ref, n, { signal } = {}) => {
++                if (!Number.isInteger(Number(n)) || Number(n) < 1) throw new TypeError('reviews.entities.summaryRevision: a revision number');
++                return call({ path: entity(ref, `/summary/revisions/${Number(n)}`), signal });
++            },
++        },
++        corrections: {
++            /** A correction for the editors (reviews.correction-submit-request@1): body required, target_type, target_id, evidence_url. */
++            submit: (ref, { body, target_type: type, target_id: targetId, evidence_url: evidence } = {}, { signal } = {}) => {
++                if (typeof body !== 'string' || !body.trim()) throw new TypeError('reviews.corrections.submit: the correction text (body)');
++                if (type != null && !TARGETS.includes(type)) throw new TypeError(`reviews.corrections.submit: target_type is one of ${TARGETS.join(', ')}`);
++                return call({ method: 'POST', path: entity(ref, '/corrections'), json: { body, target_type: type, target_id: targetId, evidence_url: evidence }, idempotencyKey: false, signal });
++            },
++        },
++    };
++}
++
++module.exports = { createReviewsClient };
ddiff --git a/src/wiki.js b/src/wiki.js
nnew file mode 100644
iindex 0000000..00a7caf
---- /dev/null
++++ b/src/wiki.js
@@@ -0,0 +1,56 @@
++'use strict';
++/**
++ * openvibe-sdk/wiki — OpenVibe.Wiki for apps: search pages and read them (the revision the person may read, its history,
++ * diffs and citations), and list the spaces. Routes at https://openvibe.wiki/api/v1; tokens for audience
++ * openvibe.wiki. A developer app acts only for the person who authorized it (on_behalf_of); without a person, only
++ * public, published pages are visible.
++ *
++ *   const wiki = createWikiClient(createClient({ tokenProvider }));
++ *   const { results } = await wiki.search('restreaming', { space: 'openvibe', limit: 5 });
++ *   const page = await wiki.pages.get(results[0].id);                         // the published revision
++ *   const { revisions } = await wiki.pages.revisions(results[0].id, { limit: 10 });
++ *   const diff = await wiki.pages.diff(results[0].id, { from: 3, to: 4 });
++ *
++ * Capabilities (public since openvibe-contracts 0.207.0): wiki.page.read and wiki.search.query. Writing pages stays
++ * with people on openvibe.wiki and first-party services. Errors are OpenVibeError: page.not_found, space.not_found,
++ * revision.not_found, capability.denied, subject.not_delegated, …
++ */
++const enc = encodeURIComponent;
++const PAGE_ID_RE = /^pg_[0-9A-HJKMNP-TV-Z]{26}$/;   // the Wiki's own rule
++
++function createWikiClient(client, { baseUrl } = {}) {
++    if (!client || typeof client.json !== 'function') throw new TypeError('createWikiClient: pass an openvibe-sdk/core client');
++    const at = { service: 'wiki', baseUrl, audience: 'openvibe.wiki' };
++    const call = (opts) => client.json({ ...at, ...opts });
++    const page = (id, rest = '') => {
++        if (!PAGE_ID_RE.test(String(id || ''))) throw new TypeError('wiki: a page is a pg_ id');
++        return `/api/v1/pages/${enc(String(id))}${rest}`;
++    };
++    const rev = (n) => {
++        if (!Number.isInteger(Number(n)) || Number(n) < 1) throw new TypeError('wiki: a revision number');
++        return Number(n);
++    };
++
++    return {
++        /** Published pages matching q that the person may read: { results }. */
++        search: (q, { space, limit, signal } = {}) => {
++            if (typeof q !== 'string' || !q.trim()) throw new TypeError('wiki.search: the words to search for');
++            return call({ path: '/api/v1/search', query: { q, space, limit }, signal });
++        },
++        spaces: {
++            list: ({ signal } = {}) => call({ path: '/api/v1/spaces', signal }),
++            /** A space and its page tree. */
++            get: (space, { signal } = {}) => call({ path: `/api/v1/spaces/${enc(String(space))}`, signal }),
++        },
++        pages: {
++            /** A page and the revision the person may read (a given revision with { revision }). */
++            get: (id, { revision, signal } = {}) => call({ path: page(id), query: { revision: revision == null ? undefined : rev(revision) }, signal }),
++            revisions: (id, { before, limit, signal } = {}) => call({ path: page(id, '/revisions'), query: { before, limit }, signal }),
++            revision: (id, n, { signal } = {}) => call({ path: page(id, `/revisions/${rev(n)}`), signal }),
++            diff: (id, { from, to, mode, signal } = {}) => call({ path: page(id, '/diff'), query: { from: rev(from), to: rev(to), mode }, signal }),
++            citations: (id, n, { signal } = {}) => call({ path: page(id, `/revisions/${rev(n)}/citations`), signal }),
++        },
++    };
++}
++
++module.exports = { createWikiClient };
ddiff --git a/test/browser-entries.test.js b/test/browser-entries.test.js
iindex 8ac3305..99f6919 100644
---- a/test/browser-entries.test.js
++++ b/test/browser-entries.test.js
@@@ -76,7 +76,7 @@ run([
              for (const [re, why] of FORBIDDEN) if (re.test(src)) problems.push(`${path.relative(ROOT, file)}: ${why}`);
          }
          assert.deepEqual(problems, []);
--        assert.deepEqual(blocked.sort(), ['./account-data', './actor', './blog', './cache', './commerce', './cost', './db', './delivery', './download', './events', './food', './govern', './identity', './inventory', './limits', './live', './node', './notifications', './openre', './placement', './play', './pubsub', './quest', './queue', './resources', './run', './runtime', './service', './sso', './storage', './telemetry', './testing', './tips', './usage', './valkey', './video', './vip', './work', './zone']);
++        assert.deepEqual(blocked.sort(), ['./account-data', './actor', './blog', './cache', './commerce', './cost', './db', './delivery', './download', './events', './food', './govern', './identity', './inventory', './limits', './live', './node', './notifications', './openre', './placement', './play', './pubsub', './quest', './queue', './resources', './reviews', './run', './runtime', './service', './sso', './storage', './telemetry', './testing', './tips', './usage', './valkey', './video', './vip', './wiki', './work', './zone']);
          const rel = [...scanned].map((f) => path.relative(ROOT, f));
          for (const must of ['browser.js', 'src/core/client.js', 'src/auth/browser.js', 'src/realtime.js', 'src/media.js', 'src/community.js', 'src/bot.js', 'src/modules.js', 'src/registry.js', 'src/jobs.js', 'src/tools.js', 'src/core/form.js', 'src/projects.js', 'browser/openvibe-sdk.mjs']) {
              assert.ok(rel.includes(must), `${must} is scanned`);
ddiff --git a/test/pack.test.js b/test/pack.test.js
iindex ea2fe6f..214162d 100644
---- a/test/pack.test.js
++++ b/test/pack.test.js
@@@ -66,7 +66,7 @@ run([
                  })().catch((err) => { console.error(err); process.exit(1); });`;
              const res = execFileSync(process.execPath, ['-e', script], { cwd: app, encoding: 'utf8' });
              assert.match(res, new RegExp(`consumer ok: ${subpaths.length} subpaths \\+ the browser bundle`));
--            assert.equal(subpaths.length, 57);
++            assert.equal(subpaths.length, 59);
              assert.ok(!fs.existsSync(path.join(app, 'node_modules/openvibe-contracts')), 'the optional peer is not installed');
          } finally {
              fs.rmSync(tmp, { recursive: true, force: true });
ddiff --git a/test/product-modules.test.js b/test/product-modules.test.js
iindex 09a53e0..5a54a2a 100644
---- a/test/product-modules.test.js
++++ b/test/product-modules.test.js
@@@ -1,5 +1,5 @@
  'use strict';
--// openvibe-sdk/food, /actor, /run, /video, /work, /zone and /blog through a real core client against one local stub: every
++// openvibe-sdk/food, /actor, /run, /video, /work, /zone, /blog, /reviews and /wiki through a real core client against one local stub: every
  // route and method, the token audience, which writes are retried (keyed or idempotent) and which never are, the SSE
  // followers (Actor's task events, Run's job stream), and the id checks done before any call.
  const assert = require('assert');
@@@ -12,9 +12,11 @@ const { createVideoClient } = require('../src/video');
  const { createWorkClient } = require('../src/work');
  const { createZoneClient } = require('../src/zone');
  const { createBlogClient } = require('../src/blog');
++const { createReviewsClient } = require('../src/reviews');
++const { createWikiClient } = require('../src/wiki');
  
  const ULID = '01JAB2C3D4E5F6G7H8J9K0MNPQ';
--const ids = { plan: `pln_${ULID}`, task: `tsk_${ULID}`, agent: `agt_${ULID}`, mem: `mem_${ULID}`, job: `job_${ULID}`, playlist: `vpl_${ULID}`, app: `wap_${ULID}`, project: `prj_${ULID}`, zone: `zon_${ULID}`, post: `pst_${ULID}` };
++const ids = { plan: `pln_${ULID}`, task: `tsk_${ULID}`, agent: `agt_${ULID}`, mem: `mem_${ULID}`, job: `job_${ULID}`, playlist: `vpl_${ULID}`, app: `wap_${ULID}`, project: `prj_${ULID}`, zone: `zon_${ULID}`, post: `pst_${ULID}`, page: `pg_${ULID}` };
  
  (async () => {
      const seen = [];
@@@ -45,7 +47,7 @@ const ids = { plan: `pln_${ULID}`, task: `tsk_${ULID}`, agent: `agt_${ULID}`, me
      const base = `http://127.0.0.1:${server.address().port}`;
      const audiences = [];
      const client = createClient({
--        baseUrls: { food: `${base}/food`, actor: `${base}/actor`, run: `${base}/run`, 'media-hub': `${base}/video`, work: `${base}/work`, zone: `${base}/zone`, blog: `${base}/blog` },
++        baseUrls: { food: `${base}/food`, actor: `${base}/actor`, run: `${base}/run`, 'media-hub': `${base}/video`, work: `${base}/work`, zone: `${base}/zone`, blog: `${base}/blog`, reviews: `${base}/reviews`, wiki: `${base}/wiki` },
          getToken: ({ audience }) => { audiences.push(audience); return `tok-${audience}`; },
          retries: 2, retryDelayMs: 1, maxRetryDelayMs: 2,
      });
@@@ -247,13 +249,54 @@ const ids = { plan: `pln_${ULID}`, task: `tsk_${ULID}`, agent: `agt_${ULID}`, me
          assert.throws(() => blog.posts.create('goosely', { body: 'no title' }), /title/);
          assert.throws(() => blog.posts.schedule(ids.post, { at: 'tomorrow' }), /ISO 8601/);
  
++        // ── Reviews ───────────────────────────────────────────
++        const reviews = createReviewsClient(client);
++        mark = since();
++        await reviews.resolve({ name: 'Blue Star Donuts', url: 'https://bluestardonuts.com' });   // a lookup: retried
++        await reviews.entities.list({ q: 'donuts', limit: 20 });
++        await reviews.entities.get('blue-star-donuts');
++        await reviews.entities.history('blue-star-donuts');
++        await reviews.entities.aggregate('blue-star-donuts');
++        await reviews.entities.summaryRevision('blue-star-donuts', 3);
++        await busyOnce(() => reviews.corrections.submit('blue-star-donuts', { target_type: 'entity', body: 'Closed on Mondays now', evidence_url: 'https://example.com/hours' }));
++        const rv = mark();
++        assert.deepStrictEqual(rv.map((x) => `${x.method} ${x.url}`), [
++            'POST /api/v1/resolve', 'POST /api/v1/resolve', 'GET /api/v1/entities?q=donuts&limit=20', 'GET /api/v1/entities/blue-star-donuts',
++            'GET /api/v1/entities/blue-star-donuts/history', 'GET /api/v1/entities/blue-star-donuts/aggregate',
++            'GET /api/v1/entities/blue-star-donuts/summary/revisions/3', 'POST /api/v1/entities/blue-star-donuts/corrections',
++        ]);
++        assert.deepStrictEqual(rv[7].body, { body: 'Closed on Mondays now', target_type: 'entity', evidence_url: 'https://example.com/hours' });
++        assert.throws(() => reviews.resolve({}), /identifier/);
++        assert.throws(() => reviews.corrections.submit('x', { body: 'y', target_type: 'opinion' }), /target_type/);
++        assert.throws(() => reviews.corrections.submit('x', { body: ' ' }), /body/);
++
++        // ── Wiki ──────────────────────────────────────────────
++        const wiki = createWikiClient(client);
++        mark = since();
++        await wiki.search('restreaming', { space: 'openvibe', limit: 5 });
++        await wiki.spaces.list();
++        await wiki.spaces.get('openvibe');
++        await wiki.pages.get(ids.page, { revision: 4 });
++        await wiki.pages.revisions(ids.page, { limit: 10 });
++        await wiki.pages.revision(ids.page, 4);
++        await wiki.pages.diff(ids.page, { from: 3, to: 4, mode: 'words' });
++        await wiki.pages.citations(ids.page, 4);
++        const W = `/api/v1/pages/${ids.page}`;
++        assert.deepStrictEqual(mark().map((x) => `${x.method} ${x.url}`), [
++            'GET /api/v1/search?q=restreaming&space=openvibe&limit=5', 'GET /api/v1/spaces', 'GET /api/v1/spaces/openvibe', `GET ${W}?revision=4`,
++            `GET ${W}/revisions?limit=10`, `GET ${W}/revisions/4`, `GET ${W}/diff?from=3&to=4&mode=words`, `GET ${W}/revisions/4/citations`,
++        ]);
++        assert.throws(() => wiki.search(''), /search for/);
++        assert.throws(() => wiki.pages.get('page_1'), /pg_/);
++        assert.throws(() => wiki.pages.diff(ids.page, { from: 0, to: 2 }), /revision number/);
++
          // Each product's token is for its own audience (Video's is the media hub's, openvibe.download).
--        assert.deepStrictEqual([...new Set(audiences)].sort(), ['openvibe.actor', 'openvibe.blog', 'openvibe.download', 'openvibe.food', 'openvibe.run', 'openvibe.work', 'openvibe.zone']);
--        assert.ok(seen.every((x) => x.auth === `Bearer tok-${{ food: 'openvibe.food', actor: 'openvibe.actor', run: 'openvibe.run', video: 'openvibe.download', work: 'openvibe.work', zone: 'openvibe.zone', blog: 'openvibe.blog' }[x.svc]}`));
++        assert.deepStrictEqual([...new Set(audiences)].sort(), ['openvibe.actor', 'openvibe.blog', 'openvibe.download', 'openvibe.food', 'openvibe.reviews', 'openvibe.run', 'openvibe.wiki', 'openvibe.work', 'openvibe.zone']);
++        assert.ok(seen.every((x) => x.auth === `Bearer tok-${{ food: 'openvibe.food', actor: 'openvibe.actor', run: 'openvibe.run', video: 'openvibe.download', work: 'openvibe.work', zone: 'openvibe.zone', blog: 'openvibe.blog', reviews: 'openvibe.reviews', wiki: 'openvibe.wiki' }[x.svc]}`));
  
          // Each client needs a core client.
--        for (const make of [createFoodClient, createActorClient, createRunClient, createVideoClient, createWorkClient, createZoneClient, createBlogClient]) assert.throws(() => make({}), /core client/);
--        console.log('product modules (food, actor, run, video, work, zone, blog): all checks passed');
++        for (const make of [createFoodClient, createActorClient, createRunClient, createVideoClient, createWorkClient, createZoneClient, createBlogClient, createReviewsClient, createWikiClient]) assert.throws(() => make({}), /core client/);
++        console.log('product modules (food, actor, run, video, work, zone, blog, reviews, wiki): all checks passed');
      } finally {
          server.close();
      }
ddiff --git a/types/index.d.ts b/types/index.d.ts
iindex 2007c51..183ac25 100644
---- a/types/index.d.ts
++++ b/types/index.d.ts
@@@ -21,6 +21,8 @@ export * as live from './live';
  export * as inventory from './inventory';
  export * as tips from './tips';
  export * as blog from './blog';
++export * as reviews from './reviews';
++export * as wiki from './wiki';
  export * as food from './food';
  export * as actor from './actor';
  export * as run from './run';
ddiff --git a/types/reviews.d.ts b/types/reviews.d.ts
nnew file mode 100644
iindex 0000000..6053d06
---- /dev/null
++++ b/types/reviews.d.ts
@@@ -0,0 +1,19 @@
++/** openvibe-sdk/reviews: OpenVibe.Reviews — resolve and read entities, and send corrections for the person. */
++type Opts = { signal?: AbortSignal };
++type ReviewsJson = Record<string, any>;
++export type CorrectionTarget = 'entity' | 'alias' | 'signal' | 'summary' | 'aggregate';
++export interface Identifiers { name?: string; url?: string; gtin?: string; sku?: string; mpn?: string; source?: unknown; external?: unknown; [k: string]: unknown }
++export interface ReviewsClient {
++    resolve(identifiers: Identifiers, opts?: Opts): Promise<ReviewsJson>;
++    entities: {
++        list(opts?: Opts & { q?: string; limit?: number; offset?: number }): Promise<ReviewsJson>;
++        get(ref: string, opts?: Opts): Promise<ReviewsJson>;
++        history(ref: string, opts?: Opts): Promise<ReviewsJson>;
++        aggregate(ref: string, opts?: Opts): Promise<{ aggregate: null | { revision: number; result: ReviewsJson } }>;
++        summaryRevision(ref: string, n: number, opts?: Opts): Promise<ReviewsJson>;
++    };
++    corrections: {
++        submit(ref: string, req: { body: string; target_type?: CorrectionTarget; target_id?: string | null; evidence_url?: string | null }, opts?: Opts): Promise<ReviewsJson>;
++    };
++}
++export function createReviewsClient(client: { json(opts: Record<string, unknown>): Promise<any> }, options?: { baseUrl?: string }): ReviewsClient;
ddiff --git a/types/wiki.d.ts b/types/wiki.d.ts
nnew file mode 100644
iindex 0000000..39cda32
---- /dev/null
++++ b/types/wiki.d.ts
@@@ -0,0 +1,15 @@
++/** openvibe-sdk/wiki: OpenVibe.Wiki's reads — search, spaces, pages, revisions, diffs and citations. */
++type Opts = { signal?: AbortSignal };
++type WikiJson = Record<string, any>;
++export interface WikiClient {
++    search(q: string, opts?: Opts & { space?: string; limit?: number }): Promise<{ results: WikiJson[] }>;
++    spaces: { list(opts?: Opts): Promise<WikiJson>; get(space: string, opts?: Opts): Promise<WikiJson> };
++    pages: {
++        get(id: string, opts?: Opts & { revision?: number }): Promise<WikiJson>;
++        revisions(id: string, opts?: Opts & { before?: number; limit?: number }): Promise<WikiJson>;
++        revision(id: string, n: number, opts?: Opts): Promise<WikiJson>;
++        diff(id: string, opts: Opts & { from: number; to: number; mode?: string }): Promise<WikiJson>;
++        citations(id: string, n: number, opts?: Opts): Promise<WikiJson>;
++    };
++}
++export function createWikiClient(client: { json(opts: Record<string, unknown>): Promise<any> }, options?: { baseUrl?: string }): WikiClient;