openvibers/openvibe.sdk Commits

ov.cam: the Cam kit pinned to its new release (#167)

OP OpenVibers committed 4 days ago · 721de21644 · 9 files, +22 −14

* ov.cam: the Cam kit pinned to its new release, at its versioned URL

* Merge main

* 0.117.0

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 8a5f1d9..2bc7a7c 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,9 @@
  # Changelog
  
++## 0.117.0 (2026-11-09)
++
++- ov.cam loads Cam's kit at its versioned URL and its new hash (Cam #116 changed the kit)
++
  ## 0.116.0 (2026-11-09)
  
  - npm metadata (keywords, homepage, funding), the README's first screen and CITATION.cff
ddiff --git a/README.md b/README.md
iindex d10b361..9cfb91a 100644
---- a/README.md
++++ b/README.md
@@@ -10,7 +10,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.116.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.117.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -19,7 +19,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.116.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.117.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
ddiff --git a/STATUS.json b/STATUS.json
iindex 7d5e4f9..031b585 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.116.0",
++  "version": "0.117.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex aab9b76..5c14cb5 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.116.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.117.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, trust, modules, realtime, media, cam, community, homeFeed, bot, search, bench, meme, vision, themes, redact, chat, ai, credentials, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -52,7 +52,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.116.0';
++const SDK_VERSION = '0.117.0';
  
  module.exports = {
      createClient,
@@@ -3246,8 +3246,10 @@ function (module, exports) {
   * pack test import it). Pass `src` to self-host the same element file.
   */
  const OV_CAMERA_SRC = 'https://openvibe.cam/embed/ov-camera.js';
--const CAM_KIT_SRC = 'https://openvibe.cam/embed/cam-kit.js';
--const CAM_KIT_SRI = 'sha384-kD5WfySp7D3rNJliBpLgJRrl4Geks+4EcgSaCIBGX+dZdecjmUVxEjzbcUw2Spp7';
++// The kit at its versioned URL (the query names the version), so Cloudflare never hands the integrity check an older
++// copy cached under the plain URL (Cam #116, 11-09). A Cam release that changes the kit ships with these two lines.
++const CAM_KIT_SRC = 'https://openvibe.cam/embed/cam-kit.js?v=yqqjh1FiP7a4';
++const CAM_KIT_SRI = 'sha384-yqqjh1FiP7a4l9uelJHaryd8Y5IwnHVbqjt1d0AXbgCcytI9Z5MMmItFqbwB4YZG';
  
  // One promise per src: a second call while the script is in flight gets the same load, never a second tag.
  const pending = new Map();
ddiff --git a/package-lock.json b/package-lock.json
iindex 1de08ea..95bec01 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.116.0",
++  "version": "0.117.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.116.0",
++      "version": "0.117.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex 49470ed..d844aa6 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.116.0",
++  "version": "0.117.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/cam/index.js b/src/cam/index.js
iindex 15e8327..798acdb 100644
---- a/src/cam/index.js
++++ b/src/cam/index.js
@@@ -18,8 +18,10 @@
   * pack test import it). Pass `src` to self-host the same element file.
   */
  const OV_CAMERA_SRC = 'https://openvibe.cam/embed/ov-camera.js';
--const CAM_KIT_SRC = 'https://openvibe.cam/embed/cam-kit.js';
--const CAM_KIT_SRI = 'sha384-kD5WfySp7D3rNJliBpLgJRrl4Geks+4EcgSaCIBGX+dZdecjmUVxEjzbcUw2Spp7';
++// The kit at its versioned URL (the query names the version), so Cloudflare never hands the integrity check an older
++// copy cached under the plain URL (Cam #116, 11-09). A Cam release that changes the kit ships with these two lines.
++const CAM_KIT_SRC = 'https://openvibe.cam/embed/cam-kit.js?v=yqqjh1FiP7a4';
++const CAM_KIT_SRI = 'sha384-yqqjh1FiP7a4l9uelJHaryd8Y5IwnHVbqjt1d0AXbgCcytI9Z5MMmItFqbwB4YZG';
  
  // One promise per src: a second call while the script is in flight gets the same load, never a second tag.
  const pending = new Map();
ddiff --git a/src/core/index.js b/src/core/index.js
iindex 1011eeb..504230b 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.116.0';
++const SDK_VERSION = '0.117.0';
  
  module.exports = {
      createClient,
ddiff --git a/test/cam.test.js b/test/cam.test.js
iindex cb3ce7f..143d089 100644
---- a/test/cam.test.js
++++ b/test/cam.test.js
@@@ -17,7 +17,7 @@ run([
      ['the entry resolves by name and names the loader and the default script', async () => {
          assert.deepEqual(Object.keys(cam).sort(), ['CAM_KIT_SRC', 'CAM_KIT_SRI', 'OV_CAMERA_SRC', 'defineOvCamera', 'loadCamKit', 'open']);
          assert.equal(cam.OV_CAMERA_SRC, 'https://openvibe.cam/embed/ov-camera.js');
--        assert.equal(cam.CAM_KIT_SRC, 'https://openvibe.cam/embed/cam-kit.js');
++        assert.equal(cam.CAM_KIT_SRC, 'https://openvibe.cam/embed/cam-kit.js?v=yqqjh1FiP7a4');
          assert.match(cam.CAM_KIT_SRI, /^sha384-/);
          assert.equal(require('openvibe-sdk/cam'), cam);
          assert.deepEqual(pkg.exports['./cam'], {