openvibe-sdk/report: me, person and publish (0.112.0) (#160)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 00acd96..c791747 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,9 @@
  # Changelog
  
++## 0.112.0 — 2026-11-09
++
++- Add the person's stats to `openvibe-sdk/report`: `report.me({ days })` (GET `/api/v1/me/stats`, the signed-in person's own numbers), `report.person(username)` (GET `/api/v1/u/:name/stats`, only the sections they published) and `report.publish({ sites, activity, made, ai, money }, { days })` (PUT `/api/v1/me/stats/published`, all five switches named). The answers are `report.me-stats@1`; a source that does not answer leaves its section out, never a zero. `me` and `publish` need the person's own session token; `person` is public and is a 404 when nothing is published.
++
  ## 0.111.0 — 2026-11-09
  
  - **`openvibe-sdk/shoes`: the Open.Shoes catalogue and sizing tools.**
ddiff --git a/README.md b/README.md
iindex 05b3f87..b218aa3 100644
---- a/README.md
++++ b/README.md
@@@ -2,7 +2,7 @@
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.111.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.112.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -11,7 +11,7 @@
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.111.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.112.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
@@@ -655,6 +655,9 @@ const client = ov.createClient();
  const report = ov.report.createReportClient(client);
  const leaders = await report.ai.leaderboard({ kind: 'code', limit: 25 });
  const headToHead = await report.ai.compare(['openai/gpt-4o', 'anthropic/claude-sonnet']);
++const mine = await report.me({ days: 30 });                 // private by default; the switches say what is public
++await report.publish({ sites: true, activity: true, made: false, ai: false, money: false });
++const theirs = await report.person('goosely');              // only the sections they published
  
  const exchange = require('openvibe-sdk/exchange').createExchangeClient({ developerKey });
  const round = await exchange.arena.start({ prompt: 'Explain a binary search.', category: 'code', entries });
ddiff --git a/STATUS.json b/STATUS.json
iindex 90e3af0..20592e9 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.111.0",
++  "version": "0.112.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 9d586b8..4722735 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.111.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.112.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, trust, modules, realtime, media, cam, community, homeFeed, bot, search, bench, meme, vision, themes, redact, chat, ai, credentials, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -52,7 +52,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.111.0';
++const SDK_VERSION = '0.112.0';
  
  module.exports = {
      createClient,
ddiff --git a/docs/api-surface.json b/docs/api-surface.json
iindex fbc30b3..7d77dfd 100644
---- a/docs/api-surface.json
++++ b/docs/api-surface.json
@@@ -313,7 +313,9 @@
      },
      "report": {
        "object": [
++        "DAYS",
          "REPORT_URL",
++        "SECTIONS",
          "createReportClient"
        ]
      },
@@@ -971,7 +973,9 @@
      "createRegistryClient": "function"
    },
    "openvibe-sdk/report": {
++    "DAYS": "array",
      "REPORT_URL": "string",
++    "SECTIONS": "array",
      "createReportClient": "function"
    },
    "openvibe-sdk/reports": {
ddiff --git a/esm/report.mjs b/esm/report.mjs
iindex 197a402..302eab7 100644
---- a/esm/report.mjs
++++ b/esm/report.mjs
@@@ -2,6 +2,6 @@
  import cjs from '../src/report.js';
  
  export const {
--    createReportClient, REPORT_URL,
++    createReportClient, REPORT_URL, DAYS, SECTIONS,
  } = cjs;
  export default cjs;
ddiff --git a/package-lock.json b/package-lock.json
iindex b197748..6c284b5 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.111.0",
++  "version": "0.112.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.111.0",
++      "version": "0.112.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex ba7e4db..30f4464 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.111.0",
++  "version": "0.112.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/core/index.js b/src/core/index.js
iindex ec031c3..6a941be 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.111.0';
++const SDK_VERSION = '0.112.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/report.js b/src/report.js
iindex 9182a27..b0e890a 100644
---- a/src/report.js
++++ b/src/report.js
@@@ -1,15 +1,71 @@
  'use strict';
  
++/**
++ * openvibe-sdk/report — OpenVibe.Report's public JSON API.
++ *
++ *   const report = createReportClient(client);
++ *   const ai = await report.ai.leaderboard({ kind: 'code', limit: 25 });
++ *   const mine = await report.me({ days: 30 });                 // the signed-in person's own stats
++ *   const theirs = await report.person('goosely');              // only the sections they published
++ *   await report.publish({ sites: true, activity: true, made: false, ai: false, money: false });
++ *
++ * The routes answer the report.me-stats@1 document: the person, the window, the five publish switches and only the
++ * sections a source answered for (a source that does not answer leaves its section out, never a zero). `me` and
++ * `publish` need the person's own session token; `person` is public and is a 404 when nothing is published. The
++ * publish call is a PUT with every switch named, so a request can never leave one to chance.
++ */
  const REPORT_URL = 'https://openvibe.report';
++const DAYS = [7, 30, 90];
++const SECTIONS = ['sites', 'activity', 'made', 'ai', 'money'];
++const USERNAME_RE = /^[A-Za-z0-9_]{1,32}$/;
++
++function windowOf(days) {
++    if (days == null) return {};
++    if (!DAYS.includes(Number(days))) throw new TypeError(`report.me: days is one of ${DAYS.join(', ')}`);
++    return { days: Number(days) };
++}
++
++function publishedOf(published) {
++    if (!published || typeof published !== 'object' || Array.isArray(published)) throw new TypeError('report.publish: pass the five switches');
++    const out = {};
++    for (const key of SECTIONS) {
++        if (typeof published[key] !== 'boolean') throw new TypeError(`report.publish: ${key} must be true or false`);
++        out[key] = published[key];
++    }
++    return out;
++}
++
  function createReportClient(client, { baseUrl = REPORT_URL } = {}) {
      if (!client || typeof client.json !== 'function') throw new TypeError('createReportClient: pass an openvibe-sdk/core client');
      const call = (path, query, signal) => client.json({ baseUrl, path, query, signal, service: 'report' });
--    return { ai: {
--        leaderboard(opts = {}, { signal } = {}) { return call('/api/v1/ai/leaderboard', opts, signal); },
--        model(id, { signal } = {}) { if (!id) throw new TypeError('report.ai.model: id is required'); return call(`/api/v1/ai/models/${encodeURIComponent(id)}`, null, signal); },
--        providers({ signal } = {}) { return call('/api/v1/ai/providers', null, signal); },
--        compare(ids, { signal } = {}) { const models = (Array.isArray(ids) ? ids : [ids]).map(String).join(','); return call('/api/v1/ai/compare', { models }, signal); },
--        picks({ signal } = {}) { return call('/api/v1/ai/picks', null, signal); },
--    } };
++    return {
++        /**
++         * The signed-in person's own numbers: sites, activity, what they made, AI and Vibes. Private by default;
++         * the switches in the answer say which sections are public.
++         */
++        me({ days, signal } = {}) {
++            return call('/api/v1/me/stats', windowOf(days), signal);
++        },
++        /** One person's published numbers, by username. Only the sections they made public; 404 when none. */
++        person(username, { signal } = {}) {
++            if (typeof username !== 'string' || !USERNAME_RE.test(username)) throw new TypeError('report.person: a username is 1–32 letters, digits or _');
++            return call(`/api/v1/u/${encodeURIComponent(username)}/stats`, null, signal);
++        },
++        /** Set the five per-section switches and answer the recomputed document (the person's token is required). */
++        publish(published, { days, signal } = {}) {
++            const switches = publishedOf(published);
++            return client.json({
++                baseUrl, path: '/api/v1/me/stats/published', method: 'PUT',
++                json: { published: switches, ...windowOf(days) }, signal, service: 'report',
++            });
++        },
++        ai: {
++            leaderboard(opts = {}, { signal } = {}) { return call('/api/v1/ai/leaderboard', opts, signal); },
++            model(id, { signal } = {}) { if (!id) throw new TypeError('report.ai.model: id is required'); return call(`/api/v1/ai/models/${encodeURIComponent(id)}`, null, signal); },
++            providers({ signal } = {}) { return call('/api/v1/ai/providers', null, signal); },
++            compare(ids, { signal } = {}) { const models = (Array.isArray(ids) ? ids : [ids]).map(String).join(','); return call('/api/v1/ai/compare', { models }, signal); },
++            picks({ signal } = {}) { return call('/api/v1/ai/picks', null, signal); },
++        },
++    };
  }
--module.exports = { createReportClient, REPORT_URL };
++module.exports = { createReportClient, REPORT_URL, DAYS, SECTIONS };
ddiff --git a/test/report-ai.test.js b/test/report-ai.test.js
iindex 00bbee0..81561a8 100644
---- a/test/report-ai.test.js
++++ b/test/report-ai.test.js
@@@ -12,10 +12,22 @@ const { createExchangeClient } = require('../src/exchange');
      await report.ai.providers();
      await report.ai.compare(['a', 'b']);
      await report.ai.picks();
--    assert.equal(calls.length, 5);
++    await report.me({ days: 30 });
++    await report.person('goosely');
++    await report.publish({ sites: true, activity: true, made: false, ai: false, money: false }, { days: 7 });
++    assert.equal(calls.length, 8);
      assert.equal(calls[0].path, '/api/v1/ai/leaderboard');
      assert.deepEqual(calls[3].query, { models: 'a,b' });
++    assert.equal(calls[5].path, '/api/v1/me/stats');
++    assert.deepEqual(calls[5].query, { days: 30 });
++    assert.equal(calls[6].path, '/api/v1/u/goosely/stats');
++    assert.equal(calls[7].path, '/api/v1/me/stats/published');
++    assert.equal(calls[7].method, 'PUT');
++    assert.deepEqual(calls[7].json, { published: { sites: true, activity: true, made: false, ai: false, money: false }, days: 7 });
      assert.throws(() => report.ai.model(''), /id is required/);
++    assert.throws(() => report.me({ days: 14 }), /days is one of 7, 30, 90/);
++    assert.throws(() => report.person('not a name'), /username/);
++    assert.throws(() => report.publish({ sites: true }), /activity must be true or false/);
  
      const requests = [];
      const exchange = createExchangeClient({ developerKey: 'test-key', baseUrl: 'https://exchange.test', fetchImpl: async (url, options) => {
ddiff --git a/types/report.d.ts b/types/report.d.ts
iindex 71dbfcd..46e5b78 100644
---- a/types/report.d.ts
++++ b/types/report.d.ts
@@@ -1,4 +1,33 @@
  import type { OpenVibeClient } from './core';
++
++export interface ReportStatsWindow { days?: 7 | 30 | 90; signal?: AbortSignal; }
++export interface ReportPublished {
++    sites: boolean;
++    activity: boolean;
++    made: boolean;
++    ai: boolean;
++    money: boolean;
++}
++export interface ReportPerson {
++    username: string;
++    display_name: string;
++    avatar_url?: string;
++}
++export interface ReportMeStats {
++    generated_at: string;
++    person: ReportPerson;
++    window: { days: 7 | 30 | 90; from: string; to: string };
++    published: ReportPublished;
++    sections: {
++        sites?: Record<string, unknown>;
++        activity?: Record<string, unknown>;
++        made?: Record<string, unknown>;
++        ai?: Record<string, unknown>;
++        money?: Record<string, unknown>;
++    };
++    note?: string;
++}
++
  export interface ReportAI {
      leaderboard(opts?: { kind?: string; maker?: string; weights?: 'open' | 'closed'; price?: string; status?: 'current' | 'all'; uncensored?: boolean; community?: boolean; sort?: string; limit?: number; cursor?: string }, options?: { signal?: AbortSignal }): Promise<unknown>;
      model(id: string, options?: { signal?: AbortSignal }): Promise<unknown>;
@@@ -6,6 +35,16 @@ export interface ReportAI {
      compare(ids: string | string[], options?: { signal?: AbortSignal }): Promise<unknown>;
      picks(options?: { signal?: AbortSignal }): Promise<unknown>;
  }
--export interface ReportClient { ai: ReportAI }
++export interface ReportClient {
++    /** The signed-in person's own numbers (report.me-stats@1). Needs their session token on the client. */
++    me(options?: ReportStatsWindow): Promise<ReportMeStats>;
++    /** One person's published numbers, by username; 404 when they published nothing. */
++    person(username: string, options?: { signal?: AbortSignal }): Promise<ReportMeStats>;
++    /** Set all five per-section switches and answer the recomputed document. */
++    publish(published: ReportPublished, options?: ReportStatsWindow): Promise<ReportMeStats>;
++    ai: ReportAI;
++}
  export declare function createReportClient(client: Pick<OpenVibeClient, 'json'>, options?: { baseUrl?: string }): ReportClient;
  export declare const REPORT_URL: string;
++export declare const DAYS: readonly number[];
++export declare const SECTIONS: readonly string[];