SDK 0.35.0: the realtime client defaults to openvibe.events (plan T7) (#20)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 7a6071b..1b73c04 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -3,6 +3,13 @@
  All notable changes to `openvibe-sdk`. The package follows semver; while it is `0.x`, a minor
  release may change an API and says so here.
  
++## 0.35.0 (2026-10-07)
++
++- **Events public origin moves to `https://openvibe.events` (plan T7):** realtime clients and the mock
++  platform now use the new origin by default; SDK examples and types name it as well. Browser pages using
++  the SDK's realtime client must allow `connect-src https://openvibe.events` in their Content Security Policy.
++  Events serves both origins during migration; the old origin will answer 308 after clients have moved.
++
  
  
  
ddiff --git a/README.md b/README.md
iindex 288c11d..6b47bc4 100644
---- a/README.md
++++ b/README.md
@@@ -2,14 +2,14 @@
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.34.0 (roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat and AI clients from WS-F task 4; per-actor limits from WS-R task 4). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.  
++**Status:** alpha, v0.35.0 (roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat and AI clients from WS-F task 4; per-actor limits from WS-R task 4). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
  **If a capability is not in the SDK, it is not public.** Apps call services through `openvibe-sdk` and never build internal routes themselves. A route with no SDK wrapper is internal, even when you can reach it, and it can change without notice. To make a capability public, first define it in OpenVibe.Contracts, then wrap it here.
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.34.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.35.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from Contracts v0.86.0, a devDependency the tests check them against).
ddiff --git a/STATUS.json b/STATUS.json
iindex 797dd78..ea5e1d4 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.34.0",
++  "version": "0.35.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex fcd6ead..9a44904 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.34.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.35.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, registry, modules, realtime, media, community, bot, search, chat, ai, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -42,7 +42,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.34.0';
++const SDK_VERSION = '0.35.0';
  
  module.exports = {
      createClient,
@@@ -956,7 +956,7 @@ function (module, exports) {
   * openvibe-sdk/realtime: the browser realtime plane inside OpenVibe.Events (ADR-005), over SSE.
   *
   *   const sub = subscribe(['live.stream.*'], (event, { seq }) => { … }, {
-- *       client,                      // or url: 'https://events.openvibe.network'
++ *       client,                      // or url: 'https://openvibe.events'
   *       lastEventId: savedSeq,       // resume after a reload
   *       onGap: (gap) => refetchState(),
   *   });
@@@ -970,7 +970,7 @@ function (module, exports) {
   */
  const { OpenVibeError } = __load(3);
  
--const DEFAULT_ORIGIN = 'https://events.openvibe.network';
++const DEFAULT_ORIGIN = 'https://openvibe.events';
  const FATAL = new Set([400, 401, 403, 404]);
  const sleep = (ms, signal) => new Promise((resolve) => {
      const t = setTimeout(resolve, ms);
ddiff --git a/docs/service.md b/docs/service.md
iindex 23ea952..003987e 100644
---- a/docs/service.md
++++ b/docs/service.md
@@@ -254,7 +254,7 @@ control plane carries a user or service token and is never shipped to a page).
  const { createResourceIndex, createResourceClient, resourceName } = require('openvibe-sdk/resources');
  
  // A console reads several authorities and merges their index pages; a failing authority is reported, not fatal.
--const index = createResourceIndex({ authorities: ['https://media.openvibe.network', 'https://events.openvibe.network'], token: userAccessToken });
++const index = createResourceIndex({ authorities: ['https://media.openvibe.network', 'https://openvibe.events'], token: userAccessToken });
  const { resources, stale } = await index.list({ project: prj.id, kind: 'media.object' });   // follows each next_cursor
  
  // A change is a control call to the authority that owns the resource; it decides, we only show the answer.
ddiff --git a/package-lock.json b/package-lock.json
iindex b9e8f37..2eed4d4 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.34.0",
++  "version": "0.35.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.34.0",
++      "version": "0.35.0",
        "license": "MIT",
        "devDependencies": {
          "@electric-sql/pglite": "^0.5.8",
ddiff --git a/package.json b/package.json
iindex f0a67a7..262a126 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.34.0",
++  "version": "0.35.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/core/index.js b/src/core/index.js
iindex b3cbf52..ddc41a3 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.34.0';
++const SDK_VERSION = '0.35.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/realtime.js b/src/realtime.js
iindex 0c76328..fc2e462 100644
---- a/src/realtime.js
++++ b/src/realtime.js
@@@ -3,7 +3,7 @@
   * openvibe-sdk/realtime: the browser realtime plane inside OpenVibe.Events (ADR-005), over SSE.
   *
   *   const sub = subscribe(['live.stream.*'], (event, { seq }) => { … }, {
-- *       client,                      // or url: 'https://events.openvibe.network'
++ *       client,                      // or url: 'https://openvibe.events'
   *       lastEventId: savedSeq,       // resume after a reload
   *       onGap: (gap) => refetchState(),
   *   });
@@@ -17,7 +17,7 @@
   */
  const { OpenVibeError } = require('./core/errors');
  
--const DEFAULT_ORIGIN = 'https://events.openvibe.network';
++const DEFAULT_ORIGIN = 'https://openvibe.events';
  const FATAL = new Set([400, 401, 403, 404]);
  const sleep = (ms, signal) => new Promise((resolve) => {
      const t = setTimeout(resolve, ms);
ddiff --git a/src/testing/index.js b/src/testing/index.js
iindex 4f73584..6074f92 100644
---- a/src/testing/index.js
++++ b/src/testing/index.js
@@@ -43,11 +43,12 @@ const { signDeliveryHeaders } = require('../events');
  
  const DEFAULT_ORIGINS = {
      network: 'https://openvibe.network',
--    events: 'https://events.openvibe.network',
++    events: 'https://openvibe.events',
      media: 'https://openvibe.media',
      community: 'https://openvibe.community',
      tools: 'https://openvibe.tools',
  };
++const LEGACY_EVENTS_ORIGIN = 'https://events.openvibe.network';
  
  /** The Tools satellites that run jobs (/api/v1/jobs); the mock answers them too. */
  const DEFAULT_TOOLS_SATELLITES = ['https://img.openvibe.tools', 'https://audio.openvibe.tools', 'https://docs.openvibe.tools'];
@@@ -815,7 +816,8 @@ function createMockPlatform(opts = {}) {
      async function route(req, url) {
          const origin = url.origin;
          if (origin === new URL(origins.network).origin) return network(req, url);
--        if (origin === new URL(origins.events).origin) return eventsService(req, url);
++        // During the public-origin migration, Events answers both names. Keep explicit old-URL fixtures working.
++        if (origin === new URL(origins.events).origin || (origins.events === DEFAULT_ORIGINS.events && origin === LEGACY_EVENTS_ORIGIN)) return eventsService(req, url);
          if (origin === new URL(origins.media).origin) return media(req, url);
          if (toolsOrigins.includes(origin)) return /^\/api\/v1\/tools(\/|$)/.test(url.pathname) ? toolsService.handle(req, url) : jobsService.handle(req, url);
          throw new TypeError(`mock platform: no service at ${origin} (fetch failed)`);
ddiff --git a/test/realtime.test.js b/test/realtime.test.js
iindex 35bf559..c33c5b4 100644
---- a/test/realtime.test.js
++++ b/test/realtime.test.js
@@@ -2,13 +2,29 @@
  /** Realtime SSE: resume from Last-Event-ID after a drop, dedupe, gap callback, transports. */
  const assert = require('node:assert/strict');
  const { stubServer, run, waitFor } = require('./helpers');
--const { subscribe, createRealtimeClient, parseSSE } = require('../src/realtime');
++const { subscribe, createRealtimeClient, parseSSE, DEFAULT_ORIGIN } = require('../src/realtime');
  const { createClient } = require('../src/core');
  const { createMockPlatform } = require('../src/testing');
  
  const frame = (seq, type = 'live.stream.started') => `id: ${seq}\ndata: ${JSON.stringify({ seq, event: { event_type: type, event_id: `e${seq}` } })}\n\n`;
  
  run([
++    ['uses the new Events public origin when no URL or client is supplied', async () => {
++        const made = [];
++        class FakeES {
++            constructor(url) { this.url = url; this.readyState = 0; made.push(this); }
++            addEventListener() {}
++            close() { this.readyState = 2; }
++        }
++        const sub = subscribe('live.*', () => {}, { EventSource: FakeES });
++        await waitFor(() => made.length === 1);
++        assert.equal(DEFAULT_ORIGIN, 'https://openvibe.events');
++        assert.equal(new URL(made[0].url).origin, DEFAULT_ORIGIN);
++        assert.equal(new URL(made[0].url).pathname, '/realtime/stream');
++        sub.close();
++        await sub.done;
++    }],
++
      ['resumes with Last-Event-ID after a drop, skips repeats, reports the gap', async () => {
          const connections = [];
          const srv = await stubServer((req, res) => {
ddiff --git a/types/realtime.d.ts b/types/realtime.d.ts
iindex a98868b..ac1ec56 100644
---- a/types/realtime.d.ts
++++ b/types/realtime.d.ts
@@@ -3,7 +3,7 @@ import type { OpenVibeClient, EventEnvelope, FetchLike, TokenContext } from './c
  export interface RealtimeGap { reason: 'retention' | 'replay_limit' | 'cursor_ahead' | string; from_seq: number; to_seq: number; latest_seq?: number; }
  export interface SubscribeOptions {
      client?: OpenVibeClient;
--    /** Events origin or the full …/realtime/stream URL; default from the client's registry, else https://events.openvibe.network */
++    /** Events origin or the full …/realtime/stream URL; default from the client's registry, else https://openvibe.events */
      url?: string;
      baseUrl?: string;
      /** Resume after this seq (e.g. saved before a reload). */