0.65.0 (10-26 batch) (#83)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 542d826..2178d4d 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -3,6 +3,30 @@
  All notable changes to `openvibe-sdk`. The package follows semver; while it is `0.x`, a minor
  release may change an API and says so here.
  
++## 0.65.0 (2026-10-26)
++
++- **`openvibe-sdk/sso`: switch account and use another account** (the owner, 2026-10-26: sign-in "like the Google
++  sign-in does … open to SDK and API"). `GET /auth/login?prompt=select_account` shows OpenVibe.Network's account
++  chooser, `?prompt=login` its sign-in form, and `?login_hint=<username>` names the account the chooser continues as when
++  the browser has it (OpenID Connect; Network's docs/sign-in.md). `?silent=1` stays `prompt=none`; anything else is
++  dropped.
++- **`openvibe-sdk/chat`: Vibe, support inboxes and feeds** (#78; the owner, 2026-10-24: OpenVibe Chat "fully modular
++  and SDK and API"). `createChatClient` gains `vibe.*` (a person's chats with Vibe), `inboxes.*` (the team's side of a
++  support inbox: conversations, replies, members, verified visitors, saved replies, actions, assign, translate) and
++  `feeds.*` (the owner's side of a feed; `view` and `onLive` send no token). `createInboxVisitor(client, { inbox, token,
++  user })` is a visitor's side with no account and no cookies (visit, send, messages, handoff, rate, sendPicture), and
++  `createFeedPublisher(client, { feed, key })` publishes vibe coding events with a feed's key (`claudeCode(hookJson)`).
++- **`openvibe-sdk/themes`** (#80, #81; the owner, 2026-10-25: the theme system in the SDK and API). `createThemesClient`
++  reads and sets the account's theme on Network (catalog with seasons, active, set, setDisplay, seasons, submissions,
++  import), and `followTheme(fn)` keeps a page, canvas or game in step with the theme someone picked on any OpenVibe site
++  (`readTheme()`: id, mode, tokens, display, season). `DISPLAY_OPTIONS.scheme` is `manual | auto` (Shared 4.12's Light /
++  Dark / Auto), and each season says its light half.
++- **`openvibe-sdk/play`: `titles.remove`** (#82) deletes a sandbox title you manage (OpenVibe.Play#42; a developer's
++  sandbox app registers up to 3 `sandbox-` titles since Play#41). A production title is kept (409 `play.title_kept`).
++- `openvibe-contracts` v0.213.0 (#79).
++
++All additions: nothing exported before changes.
++
  ## 0.64.0 (2026-10-25)
  
  - **`parseDelivery` requires a v2 signature by default.** A delivery without `X-OpenVibe-Signature-V2` is refused
ddiff --git a/README.md b/README.md
iindex 8a6fb45..ea22edd 100644
---- a/README.md
++++ b/README.md
@@@ -2,14 +2,14 @@
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.64.0 (roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat and AI clients from WS-F task 4; per-actor limits from WS-R task 4). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.65.0 (roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat and AI clients from WS-F task 4; per-actor limits from WS-R task 4). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
  **If a capability is not in the SDK, it is not public.** Apps call services through `openvibe-sdk` and never build internal routes themselves. A route with no SDK wrapper is internal, even when you can reach it, and it can change without notice. To make a capability public, first define it in OpenVibe.Contracts, then wrap it here.
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.64.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.65.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from Contracts v0.86.0, a devDependency the tests check them against).
ddiff --git a/STATUS.json b/STATUS.json
iindex 8548d17..4b92435 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.64.0",
++  "version": "0.65.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 65a8db8..fb73a12 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.64.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.65.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, registry, modules, realtime, media, community, bot, search, themes, chat, ai, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -43,7 +43,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.64.0';
++const SDK_VERSION = '0.65.0';
  
  module.exports = {
      createClient,
ddiff --git a/package-lock.json b/package-lock.json
iindex 56ae9d2..973f774 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.64.0",
++  "version": "0.65.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.64.0",
++      "version": "0.65.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex 7c94a7a..171b54d 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.64.0",
++  "version": "0.65.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/core/index.js b/src/core/index.js
iindex 954809f..371ccdd 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.64.0';
++const SDK_VERSION = '0.65.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/sso/index.js b/src/sso/index.js
iindex 458911b..6d142cb 100644
---- a/src/sso/index.js
++++ b/src/sso/index.js
@@@ -16,7 +16,8 @@
   *   app.get('/private', sso.requireAuth(), handler);     // 401 JSON without a session
   *
   * Routes (mounted at /auth; the redirect URI is <baseUrl>/auth/callback unless `redirectUri` says otherwise):
-- *   GET  /login     → Network /oauth/authorize with state and PKCE (S256); ?silent=1: prompt=none; ?next= a same-site
++ *   GET  /login     → Network /oauth/authorize with state and PKCE (S256); ?silent=1: prompt=none; ?prompt=select_account
++ *                     (the chooser) or login (the sign-in form) and ?login_hint=<username> pass through; ?next= a same-site
   *                     path, this site's https origin or the Network's (control characters and backslashes go home)
   *   GET  /callback  → the state is required and compared in constant time; the code is exchanged server-side with the
   *                     client secret and the PKCE verifier; cookies are set; back to `next`
@@@ -194,7 +195,7 @@ function createSsoClient(opts = {}) {
      }
  
      /** The authorize URL for a sign-in (pure; exported for tests). → { url, state, verifier } */
--    function authorizeUrl({ silent = false } = {}) {
++    function authorizeUrl({ silent = false, prompt = '', loginHint = '' } = {}) {
          const verifier = crypto.randomBytes(32).toString('base64url');
          const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
          const state = crypto.randomBytes(24).toString('base64url');
@@@ -209,6 +210,11 @@ function createSsoClient(opts = {}) {
          // silent: continue as the account openvibe.network already knows (no chooser); with no Network session either it
          // bounces back with error=login_required and the site stays quiet.
          if (silent) u.searchParams.set('prompt', 'none');
++        // "Switch account" (the chooser) and "use another account" (the sign-in form); login_hint names the account the
++        // chooser continues as when this browser has it (Network docs/sign-in.md).
++        else if (prompt === 'select_account' || prompt === 'login') u.searchParams.set('prompt', prompt);
++        const hint = String(loginHint || '').trim();
++        if (hint.length <= 64 && /^@?[A-Za-z0-9_.-]+$/.test(hint)) u.searchParams.set('login_hint', hint);
          return { url: u.toString(), state, verifier };
      }
  
@@@ -218,7 +224,7 @@ function createSsoClient(opts = {}) {
              const silent = !!q.silent && q.silent !== '0';
              // Already signed in here? A silent round trip would only hand back the session we have.
              if (silent && await verify(parseCookies(req)[ACCESS_COOKIE])) { clearFlow(res); return res.redirect(next(q.next)); }
--            const { url, state, verifier } = authorizeUrl({ silent });
++            const { url, state, verifier } = authorizeUrl({ silent, prompt: String(q.prompt || ''), loginHint: q.login_hint });
              res.cookie(STATE_COOKIE, state, flowOpts());
              res.cookie(VERIFIER_COOKIE, verifier, flowOpts());
              const target = next(q.next);
ddiff --git a/test/sso.test.js b/test/sso.test.js
iindex a3fc05b..e1e8026 100644
---- a/test/sso.test.js
++++ b/test/sso.test.js
@@@ -72,6 +72,19 @@ run([
          await sso.handlers.login({ query: { silent: '1', next: '/deals' }, headers: {} }, silent);
          assert.equal(new URL(silent.location).searchParams.get('prompt'), 'none');
          assert.equal(silent.cookies.ov_oauth_next.v, '/deals');
++        // "Switch account" and "use another account" pass through, with the account to continue as (OIDC login_hint).
++        const sw = fakeRes();
++        await sso.handlers.login({ query: { prompt: 'select_account', login_hint: '@alt' }, headers: {} }, sw);
++        assert.deepEqual([new URL(sw.location).searchParams.get('prompt'), new URL(sw.location).searchParams.get('login_hint')], ['select_account', '@alt']);
++        const other = fakeRes();
++        await sso.handlers.login({ query: { prompt: 'login' }, headers: {} }, other);
++        assert.equal(new URL(other.location).searchParams.get('prompt'), 'login');
++        const odd = fakeRes();
++        await sso.handlers.login({ query: { prompt: 'consent', login_hint: '<b>x</b>' }, headers: {} }, odd);
++        assert.deepEqual([new URL(odd.location).searchParams.get('prompt'), new URL(odd.location).searchParams.get('login_hint')], [null, null], 'anything else is dropped');
++        const quiet = fakeRes();
++        await sso.handlers.login({ query: { silent: '1', prompt: 'login' }, headers: {} }, quiet);
++        assert.equal(new URL(quiet.location).searchParams.get('prompt'), 'none', 'silent stays silent');
      }],
  
      ['callback: the state cookie is required and must match; the code is exchanged with the secret and the PKCE verifier', async () => {