openvibers/openvibe.sdk Commits

Add user-owned trust class and bump openvibe-contracts to 0.86.0 (#3)

OP OpenVibers committed 3 Oct 2026 · 10417adcba · 5 files, +14 −11

checks run by GitHub CI (test) · CI ✓ 3/3 · review SHIP by DeepSeek harness · 1 fix round

https://github.com/OpenVibers/OpenVibe.SDK/pull/3

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex d2e6a3b..eb8e516 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -9,7 +9,9 @@ release may change an API and says so here.
  
  ## Unreleased
  
--- **`openvibe-sdk/govern` emits a full usage record** (plan T5). `createGovernor({ service, provider?, resource?, region? })`; `reserve()` takes optional `operation`, `provider`, `resource`, `region`, `trace_id` and `route_epoch`, which override the defaults. `onUsage` now gets a `platform.usage-sample@1` reading: `id` (the reservation id), `idempotency_key`, `service`, `project`, `subject`, `resource`, `provider`, `region`, `operation` (default `reserve`), `quantity`, `unit`, `at`, `route_epoch`, `trace_id`, `source` (`openvibe-sdk/govern`); absent values are left out. **Changed:** `amount` is now `quantity` and `state` is gone (the schema allows neither; only new reservations are emitted). No money fields: rating is Billing's. A governor created without `service` still works and logs one warning (`log`, default `console`). Tested against openvibe-contracts 0.84.0.
++- The devDependency `openvibe-contracts` moves to v0.86.0 (it adds a `node` principal to
++  `identity.service-token-claims`); the copied types and the lockfile integrity hash follow.
++- **`openvibe-sdk/govern` emits a full usage record** (plan T5). `createGovernor({ service, provider?, resource?, region? })`; `reserve()` takes optional `operation`, `provider`, `resource`, `region`, `trace_id` and `route_epoch`, which override the defaults. `onUsage` now gets a `platform.usage-sample@1` reading: `id` (the reservation id), `idempotency_key`, `service`, `project`, `subject`, `resource`, `provider`, `region`, `operation` (default `reserve`), `quantity`, `unit`, `at`, `route_epoch`, `trace_id`, `source` (`openvibe-sdk/govern`); absent values are left out. **Changed:** `amount` is now `quantity` and `state` is gone (the schema allows neither; only new reservations are emitted). No money fields: rating is Billing's. A governor created without `service` still works and logs one warning (`log`, default `console`). Tested against openvibe-contracts 0.86.0.
  
  ## 0.26.0 (2026-10-01)
  
ddiff --git a/README.md b/README.md
iindex 9675cce..4b98dc2 100644
---- a/README.md
++++ b/README.md
@@@ -12,7 +12,7 @@
  npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.12.0
  ```
  
--It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from Contracts v0.49.0, a devDependency the tests check them against).
++It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from Contracts v0.86.0, a devDependency the tests check them against).
  
  ## Purpose
  
@@@ -418,7 +418,7 @@ Moving an existing service from SQLite: [docs/migrating-to-postgresql.md](docs/m
  ## Versioning
  
  - `openvibe-sdk` follows semver. While it is 0.x, a minor release may break an API, and [CHANGELOG.md](CHANGELOG.md) says so. Pin a tag.
--- Each release states the openvibe-contracts range it was tested against (`CONTRACTS_RANGE`), and `discover()` checks it at runtime. Contract types are copied into `types/contracts.d.ts`. `test/types.test.js` fails if they differ from the pinned Contracts release, the `openvibe-contracts` devDependency (a release tarball pin, v0.49.0), which the tools tests also use to validate requests and answers. It is never a runtime or peer dependency.
++- Each release states the openvibe-contracts range it was tested against (`CONTRACTS_RANGE`), and `discover()` checks it at runtime. Contract types are copied into `types/contracts.d.ts`. `test/types.test.js` fails if they differ from the pinned Contracts release, the `openvibe-contracts` devDependency (a release tarball pin, v0.86.0), which the tools tests also use to validate requests and answers. It is never a runtime or peer dependency.
  - A new public capability ships as a minor release: first the contract, then the wrapper here, then the service's route. Removing a wrapper is a major release, after the capability's deprecation window in Contracts has passed.
  
  ## Not wrapped yet (intentionally)
@@@ -485,7 +485,7 @@ Service implementations and their data (each service), the contracts (OpenVibe.C
  
  ## Depends on
  
--Nothing at runtime. `openvibe-contracts` v0.49.0 and `better-sqlite3` are devDependencies (type checks, the outbox and inbox tests). At run time the clients talk to OpenVibe.Network (tokens, registry, discovery) and the service each one wraps.
++Nothing at runtime. `openvibe-contracts` v0.86.0 and `better-sqlite3` are devDependencies (type checks, the outbox and inbox tests). At run time the clients talk to OpenVibe.Network (tokens, registry, discovery) and the service each one wraps.
  
  ---
  
ddiff --git a/package-lock.json b/package-lock.json
iindex fadad71..cf272c4 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -12,7 +12,7 @@
          "@electric-sql/pglite": "^0.5.8",
          "better-sqlite3": "^11.10.0",
          "iovalkey": "^0.4.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.84.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.86.0",
          "pg": "^8.23.0"
        },
        "engines": {
@@@ -459,8 +459,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.84.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.84.0",
++      "version": "0.86.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.86.0",
++      "integrity": "sha512-3o3AILEBtQ2pK0KqK7GEAlN3HJjaKUl6vrbzEDiBbhK6Nr2hivgN/5MAmJ7WRkgaDkxNsZETs/fLZC2Q4oNCiA==",
        "dev": true,
        "license": "AGPL-3.0-only",
        "dependencies": {
ddiff --git a/package.json b/package.json
iindex 7c5c794..4321468 100644
---- a/package.json
++++ b/package.json
@@@ -228,7 +228,7 @@
      "@electric-sql/pglite": "^0.5.8",
      "better-sqlite3": "^11.10.0",
      "iovalkey": "^0.4.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.84.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.86.0",
      "pg": "^8.23.0"
    },
    "peerDependencies": {
ddiff --git a/types/contracts.d.ts b/types/contracts.d.ts
iindex 739da95..33777cb 100644
---- a/types/contracts.d.ts
++++ b/types/contracts.d.ts
@@@ -1,4 +1,4 @@
--/* Copied verbatim from openvibe-contracts v0.84.0 generated/typescript/index.d.ts (the SDK does not
++/* Copied verbatim from openvibe-contracts v0.86.0 generated/typescript/index.d.ts (the SDK does not
   * require the package at runtime; it is a devDependency for the tests). test/types.test.js checks
   * these against it. */
  /* eslint-disable */
@@@ -35,7 +35,7 @@ export type SubjectRef =
  
  /** [email protected] (owner: network) */
  /**
-- * Claims of a short-lived RS256 client-credentials token issued by OpenVibe.Network to a service or app principal. Replaces X-Internal-Key. App tokens (actor_type app) also carry project_id and env; receivers refuse env=sandbox unless they opted in.
++ * Claims of a short-lived RS256 client-credentials token issued by OpenVibe.Network to a service, app, mod or node principal. Replaces X-Internal-Key. App tokens (actor_type app) also carry project_id and env; receivers refuse env=sandbox unless they opted in.
   */
  export type ServiceTokenClaims = {
    [k: string]: unknown | undefined;
@@@ -45,7 +45,7 @@ export type ServiceTokenClaims = {
     */
    iss: string;
    sub: string;
--  actor_type: "service" | "app" | "mod";
++  actor_type: "service" | "app" | "mod" | "node";
    /**
     * @minItems 1
     */