openvibers/openvibe.sdk Commits

0.87.0: freeze the five 1.0 core entries, remove the auth leaving names (#120)

OP OpenVibers committed 7 days ago · 7fce56095b · 18 files, +71 −44

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex f4f489a..16a6322 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,19 @@
  # Changelog
  
++## 0.87.0 (2026-11-06)
++
++- **The 1.0 core surface is frozen now.** `core`, `auth`, `events`, `db` and `media` are stable before 1.0:
++  removing or renaming one of their exports needs a major release. `docs/one-point-oh.json` keeps each name's tier,
++  `docs/api-surface.json` records every export, and `test/surface.test.js` now pins the exact export list of the five
++  entries, so a break there is a deliberate line in a diff rather than a surprise on a pin round.
++- **Removed the two `auth` leaving names**, planned for 1.0 in `docs/one-point-oh.md`: `createCodeVerifier` and
++  `pkceChallenge`. They were the two halves of `createPkcePair`, which stays frozen; no OpenVibers repository's `main`
++  imported them (checked 2026-11-06). Use `createPkcePair()` for both halves.
++- **`signDelivery` and `verifyDelivery` (the v1 signature) stay for now.** They are still the last leaving names, but
++  `signDelivery` is imported by the test helpers of OpenVibe.Deals, Examples, Reviews, Tips, Trade and VIP on `main`, so
++  they go once a pin round moves those onto `signDeliveryHeaders` / `signDeliveryV2`. `parseDelivery` still requires
++  v2 by default.
++
  ## 0.86.0 (2026-11-06)
  
  - Add `openvibe-sdk/locker`: the Locker envelope (`locker.envelope@1`), end-to-end encryption for anything on OpenVibe, in Node and in the browser. WebCrypto only (`globalThis.crypto.subtle`), no other crypto library and nothing hand-rolled.
ddiff --git a/README.md b/README.md
iindex 51db9cc..2c202b7 100644
---- a/README.md
++++ b/README.md
@@@ -2,16 +2,16 @@
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.86.0 (roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.87.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
  **If a capability is not in the SDK, it is not public.** Apps call services through `openvibe-sdk` and never build internal routes themselves. A route with no SDK wrapper is internal, even when you can reach it, and it can change without notice. To make a capability public, first define it in OpenVibe.Contracts, then wrap it here.
  
--After v0.86.0 is tagged:
++After v0.87.0 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.86.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.87.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
@@@ -164,7 +164,7 @@ Until OpenVibe.Tools serves the gateway facade (Tools S6), point the jobs client
  | Subpath | Where | What |
  |---|---|---|
  | `openvibe-sdk/core` | both | `createClient()`, `OpenVibeError`, `paginate()`, `offsetPager()`, trace and id helpers, `CONTRACTS_RANGE` |
--| `openvibe-sdk/auth` | server (browser build: PKCE only) | `createServiceTokenClient()` (+ `getTokenInfo()`), `createNetworkKeys()`, `verifyUserToken()`, `verifyAppToken()`, `verifyServiceToken()`, `exchangeCode()`, `refreshUserToken()`; `startAuthorization()`, `buildAuthorizeUrl()`, `createPkcePair()`, `pkceChallenge()`, `readCallback()`, `decodeUnverified()`, `unverifiedClaims()` |
++| `openvibe-sdk/auth` | server (browser build: PKCE only) | `createServiceTokenClient()` (+ `getTokenInfo()`), `createNetworkKeys()`, `verifyUserToken()`, `verifyAppToken()`, `verifyServiceToken()`, `exchangeCode()`, `refreshUserToken()`; `startAuthorization()`, `buildAuthorizeUrl()`, `createPkcePair()`, `readCallback()`, `decodeUnverified()`, `unverifiedClaims()` |
  | `openvibe-sdk/registry` | both | `createRegistryClient(client)`: `services({status})`, `service(id)`, `capabilities({owner})`, `capability(id)`, `namespaces()`, `contracts()`, `topics()`, `domain(host)`, `descriptor()` |
  | `openvibe-sdk/identity` | server | `createIdentityClient(client)`: `resolve({subjectId} \| {system,type,id})`, `resolveBatch({subjectIds} \| {system,type,ids})` |
  | `openvibe-sdk/notifications` | server | `createNotificationsClient(client)`: `push({subjectId \| userId, type, title, message, url, category, priority, …})` through Network (`network.notifications.push`); `{ sent, skipped }` or `{ sent: false, reason: 'unknown_subject' }`; attempted once, the caller retries |
@@@ -488,6 +488,7 @@ Install the drivers the service uses: `pg` and `iovalkey` (production), `@electr
  ## Versioning
  
  - `openvibe-sdk` follows semver. While it is 0.x, a minor release may break an API, and [CHANGELOG.md](CHANGELOG.md) says so. Pin a tag.
++- **The 1.0 core surface is already frozen.** `core`, `auth`, `events`, `db` and `media` are stable now, before 1.0: removing or renaming one of their exports needs a major release. `docs/one-point-oh.json` gives each name its tier (frozen, platform, leaving), `test/surface.test.js` pins the exact export list of the five entries, and `node scripts/surface.js --check` marks a break there as `[1.0 core]`.
  - [docs/api-surface.json](docs/api-surface.json) lists every name each entry exports and what it is (function, class, a plain object's keys, …). `test/surface.test.js` fails when the exports and the file disagree, so a removal or a change of kind is a reviewed line in a diff, never a surprise on a service's next pin round; `node scripts/surface.js --check` names each change as breaking or added, and `node scripts/surface.js` updates the file. 1.0 freezes `core`, `auth`, `events`, `db` and `media` first: a breaking change there is marked `[1.0 core]`. Inside them each name is frozen, platform (exported, not frozen) or leaving before 1.0: [docs/one-point-oh.md](docs/one-point-oh.md).
  - Each release states the openvibe-contracts range it was tested against (`CONTRACTS_RANGE`), and `discover()` checks it at runtime. Contract types are copied into `types/contracts.d.ts`. `test/types.test.js` fails if they differ from the pinned Contracts release, the `openvibe-contracts` devDependency (temporarily the sharing branch), which the tools tests also use to validate requests and answers. It is never a runtime or peer dependency.
  - A new public capability ships as a minor release: first the contract, then the wrapper here, then the service's route. Removing a wrapper is a major release, after the capability's deprecation window in Contracts has passed.
ddiff --git a/STATUS.json b/STATUS.json
iindex b9209be..d2fc82e 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,13 +3,14 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.86.0",
++  "version": "0.87.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), \u00a73.2; roadmap \u00a730",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
    "contracts": "openvibe-contracts v0.292.0",
    "features": [
      "locker (openvibe-sdk/locker, openvibe-sdk/locker/server): the Locker envelope (locker.envelope@1) for end-to-end encryption, WebCrypto only, in Node and the browser: seal/open for text and bytes, sealStream/openStream, the three locks (people, password, link), person key pairs (ECDH P-256, ECDSA P-256), the eight-word fingerprint, wrapFor and rewrap, recoveryWords for the phrase to write down, opening a people lock by key, inspect for what an envelope says about itself, and the header checks a service runs without a key",
++    "the 1.0 core surface is frozen now, before 1.0 (core, auth, events, db, media): docs/one-point-oh.json gives every export its tier, test/surface.test.js pins the exact names, and removing or renaming one needs a major release; createCodeVerifier and pkceChallenge left in 0.86.0",
      "share (openvibe-sdk/share): transactional local sharing, audience and membership checks, exact-name resolution, recipient-bound ownership transfers, audit, durable events/notifications, uniform API and agent client",
      "redact (openvibe-sdk/redact): the shared secret scrubber for memory, the same shapes and corpus as OpenVibe.Node's internal/memory/redact.go (redact, onlySecret)",
      "core client: retries, timeouts, problem+json errors, trace propagation",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 9ff5f20..800f680 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.86.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.87.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, modules, realtime, media, community, bot, search, bench, meme, vision, themes, redact, chat, ai, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -48,7 +48,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.86.0';
++const SDK_VERSION = '0.87.0';
  
  module.exports = {
      createClient,
@@@ -837,7 +837,7 @@ function unverifiedClaims(token) {
      return d ? d.claims : null;
  }
  
--module.exports = { createCodeVerifier, pkceChallenge, createPkcePair, createState, buildAuthorizeUrl, startAuthorization, readCallback, base64url, decodeUnverified, unverifiedClaims };
++module.exports = { createPkcePair, createState, buildAuthorizeUrl, startAuthorization, readCallback, base64url, decodeUnverified, unverifiedClaims };
  },
  // ── 9: src/locker.js ───────────────────────────────────────────────
  function (module, exports) {
ddiff --git a/docs/api-surface.json b/docs/api-surface.json
iindex 1e7fa92..7dbb412 100644
---- a/docs/api-surface.json
++++ b/docs/api-surface.json
@@@ -21,7 +21,6 @@
          "TOKEN_VALID_AFTER",
          "base64url",
          "buildAuthorizeUrl",
--        "createCodeVerifier",
          "createJwksClient",
          "createNetworkKeys",
          "createPgRevocationStore",
@@@ -32,7 +31,6 @@
          "exchangeCode",
          "jwksClient",
          "jwksStatus",
--        "pkceChallenge",
          "readCallback",
          "refreshUserToken",
          "revocationSchema",
@@@ -405,7 +403,6 @@
      "TOKEN_VALID_AFTER": "string",
      "base64url": "function",
      "buildAuthorizeUrl": "function",
--    "createCodeVerifier": "function",
      "createJwksClient": "function",
      "createNetworkKeys": "function",
      "createPgRevocationStore": "function",
@@@ -416,7 +413,6 @@
      "exchangeCode": "function",
      "jwksClient": "function",
      "jwksStatus": "function",
--    "pkceChallenge": "function",
      "readCallback": "function",
      "refreshUserToken": "function",
      "revocationSchema": "function",
@@@ -429,11 +425,9 @@
    "openvibe-sdk/auth/browser": {
      "base64url": "function",
      "buildAuthorizeUrl": "function",
--    "createCodeVerifier": "function",
      "createPkcePair": "function",
      "createState": "function",
      "decodeUnverified": "function",
--    "pkceChallenge": "function",
      "readCallback": "function",
      "startAuthorization": "function",
      "unverifiedClaims": "function"
ddiff --git a/docs/one-point-oh.json b/docs/one-point-oh.json
iindex 5a4115e..9230cda 100644
---- a/docs/one-point-oh.json
++++ b/docs/one-point-oh.json
@@@ -7,7 +7,7 @@
    "openvibe-sdk/auth": {
      "frozen": ["buildAuthorizeUrl", "createPkcePair", "createServiceTokenClient", "createState", "decodeUnverified", "exchangeCode", "jwksClient", "jwksStatus", "readCallback", "refreshUserToken", "startAuthorization", "unverifiedClaims", "verifyAppToken", "verifyServiceToken", "verifyUserToken"],
      "platform": ["TOKEN_VALID_AFTER", "base64url", "createJwksClient", "createNetworkKeys", "createPgRevocationStore", "revocationSchema"],
--    "leaving": ["createCodeVerifier", "pkceChallenge"]
++    "leaving": []
    },
    "openvibe-sdk/events": {
      "frozen": ["appSource", "createAppEvents", "createEventsClient", "parseDelivery", "projectKey", "signDeliveryHeaders", "signDeliveryV2", "verifyDeliveryV2"],
ddiff --git a/docs/one-point-oh.md b/docs/one-point-oh.md
iindex 68865f0..c47b383 100644
---- a/docs/one-point-oh.md
++++ b/docs/one-point-oh.md
@@@ -40,7 +40,8 @@ developers outside the organisation, who are not in the count.
    - `createNetworkKeys` (12): service key handling;
    - `createJwksClient`: the uncached constructor behind `jwksClient`, which is what code should call;
    - `base64url`: an encoding helper, not an auth API.
--- **leaving:** `createCodeVerifier` and `pkceChallenge`. They are the two halves of `createPkcePair`, and no repository uses them.
++- **leaving:** none. `createCodeVerifier` and `pkceChallenge` went in 0.86.0: they were the two halves of
++  `createPkcePair`, and no repository's `main` imported them.
  
  ## events
  
@@@ -49,7 +50,9 @@ developers outside the organisation, who are not in the count.
    - receiving: `parseDelivery` (15), `verifyDeliveryV2`;
    - signing in tests and senders: `signDeliveryHeaders`, `signDeliveryV2`.
  - **platform:** `createPgOutbox`, `createServiceOutbox`, `createPgInbox`, `outboxSchema`, `inboxSchema`. They are the PostgreSQL outbox and inbox a service keeps beside its own tables. Their schema and relay behaviour change with the platform; 0.63.0 added a 429 pause and pruning.
--- **leaving:** `signDelivery` and `verifyDelivery`, the v1 signature.
++- **leaving:** `signDelivery` and `verifyDelivery`, the v1 signature. They cannot go yet: `signDelivery` is still
++  imported by the test helpers of OpenVibe.Deals, Examples, Reviews, Tips, Trade and VIP on `main` (checked
++  2026-11-06). They go once a pin round moves those onto `signDeliveryHeaders` / `signDeliveryV2`.
    - v1 signs no time, so a captured delivery verifies forever.
    - OpenVibe.Events sends only v2 (`X-OpenVibe-Signature-V2`, over the timestamp and the body, within five minutes).
    - Every production receiver already calls `parseDelivery(..., { requireV2: true })`.
@@@ -63,6 +66,7 @@ All frozen:
  
  ## Before 1.0
  
--1. The leaving names go: remove them, update `docs/api-surface.json`, and the test lists them as breaking.
++1. The last leaving names (`signDelivery`, `verifyDelivery`) go once the pin round above frees them: remove them,
++   update `docs/api-surface.json`, and the test lists them as breaking.
  2. Publish to npm (owner's account), so that `npm i openvibe-sdk` works without a tarball pin.
  3. From then on, a breaking change marked `[1.0 core]` needs a major release.
ddiff --git a/esm/auth-browser.mjs b/esm/auth-browser.mjs
iindex 0660a13..637b7aa 100644
---- a/esm/auth-browser.mjs
++++ b/esm/auth-browser.mjs
@@@ -2,7 +2,7 @@
  import cjs from '../src/auth/browser.js';
  
  export const {
--    createCodeVerifier, pkceChallenge, createPkcePair, createState, buildAuthorizeUrl, startAuthorization,
--    readCallback, base64url, decodeUnverified, unverifiedClaims,
++    createPkcePair, createState, buildAuthorizeUrl, startAuthorization, readCallback, base64url,
++    decodeUnverified, unverifiedClaims,
  } = cjs;
  export default cjs;
ddiff --git a/esm/auth.mjs b/esm/auth.mjs
iindex 5cff6d0..75514a7 100644
---- a/esm/auth.mjs
++++ b/esm/auth.mjs
@@@ -2,9 +2,9 @@
  import cjs from '../src/auth/index.js';
  
  export const {
--    createCodeVerifier, pkceChallenge, createPkcePair, createState, buildAuthorizeUrl, startAuthorization,
--    readCallback, base64url, decodeUnverified, unverifiedClaims, createServiceTokenClient, verifyUserToken,
--    verifyAppToken, verifyServiceToken, createJwksClient, jwksClient, jwksStatus, createNetworkKeys,
--    exchangeCode, refreshUserToken, createPgRevocationStore, revocationSchema, TOKEN_VALID_AFTER,
++    createPkcePair, createState, buildAuthorizeUrl, startAuthorization, readCallback, base64url,
++    decodeUnverified, unverifiedClaims, createServiceTokenClient, verifyUserToken, verifyAppToken, verifyServiceToken,
++    createJwksClient, jwksClient, jwksStatus, createNetworkKeys, exchangeCode, refreshUserToken,
++    createPgRevocationStore, revocationSchema, TOKEN_VALID_AFTER,
  } = cjs;
  export default cjs;
ddiff --git a/package-lock.json b/package-lock.json
iindex 1b17150..cf0c7aa 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.86.0",
++  "version": "0.87.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.86.0",
++      "version": "0.87.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex 2e53866..f913ffd 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.86.0",
++  "version": "0.87.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/auth/browser.js b/src/auth/browser.js
iindex e275b12..7dd9322 100644
---- a/src/auth/browser.js
++++ b/src/auth/browser.js
@@@ -137,4 +137,4 @@ function unverifiedClaims(token) {
      return d ? d.claims : null;
  }
  
--module.exports = { createCodeVerifier, pkceChallenge, createPkcePair, createState, buildAuthorizeUrl, startAuthorization, readCallback, base64url, decodeUnverified, unverifiedClaims };
++module.exports = { createPkcePair, createState, buildAuthorizeUrl, startAuthorization, readCallback, base64url, decodeUnverified, unverifiedClaims };
ddiff --git a/src/core/index.js b/src/core/index.js
iindex 30d4e14..145489f 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.86.0';
++const SDK_VERSION = '0.87.0';
  
  module.exports = {
      createClient,
ddiff --git a/test/apps.test.js b/test/apps.test.js
iindex 90f87bd..cf41ff4 100644
---- a/test/apps.test.js
++++ b/test/apps.test.js
@@@ -88,7 +88,7 @@ run([
          s = await signIn(platform, { audience: 'openvibe.media' });
          await assert.rejects(auth.exchangeCode({ fetch: platform.fetch, clientId: PUBLIC_APP, clientSecret: 'nope', code: s.code, codeVerifier: s.codeVerifier, redirectUri: REDIRECT, audience: 'openvibe.media' }), { code: 'invalid_client' });
          s = await signIn(platform, { audience: 'openvibe.media' });
--        await assert.rejects(auth.exchangeCode({ fetch: platform.fetch, clientId: PUBLIC_APP, code: s.code, codeVerifier: auth.createCodeVerifier(), redirectUri: REDIRECT, audience: 'openvibe.media' }), (e) => e.code === 'invalid_grant' && /PKCE/.test(e.detail));
++        await assert.rejects(auth.exchangeCode({ fetch: platform.fetch, clientId: PUBLIC_APP, code: s.code, codeVerifier: (await auth.createPkcePair()).codeVerifier, redirectUri: REDIRECT, audience: 'openvibe.media' }), (e) => e.code === 'invalid_grant' && /PKCE/.test(e.detail));
          await assert.rejects(auth.exchangeCode({ fetch: platform.fetch, clientId: PUBLIC_APP, code: s.code, codeVerifier: s.codeVerifier, redirectUri: REDIRECT, audience: 'openvibe.media' }), { code: 'invalid_grant' }, 'burnt');
      }],
  
ddiff --git a/test/bundle.test.js b/test/bundle.test.js
iindex e62fbc7..a0c5ff7 100644
---- a/test/bundle.test.js
++++ b/test/bundle.test.js
@@@ -7,6 +7,7 @@ const assert = require('node:assert/strict');
  const fs = require('node:fs');
  const path = require('node:path');
  const { pathToFileURL } = require('node:url');
++const { createHash } = require('node:crypto');
  const { execFileSync } = require('node:child_process');
  const { run } = require('./helpers');
  const { OUT, collect } = require('../scripts/browser-bundle');
@@@ -46,7 +47,8 @@ run([
  
      ['it works: PKCE, an app sign-in URL, and a registry read through its own client', async () => {
          const sdk = await load();
--        assert.equal(await sdk.auth.pkceChallenge('dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'), 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM');
++        const pair = await sdk.auth.createPkcePair();
++        assert.equal(pair.codeChallenge, createHash('sha256').update(pair.codeVerifier).digest('base64url'));
          const { url } = await sdk.auth.startAuthorization({ clientId: 'app_01K5WZX7S7Q4D2B8N3M6V1C9TR', redirectUri: 'http://localhost:3001/callback', audience: 'openvibe.media', scope: ['media.object.read'] });
          const u = new URL(url);
          assert.equal(u.searchParams.get('audience'), 'openvibe.media');
ddiff --git a/test/pkce.test.js b/test/pkce.test.js
iindex 90b6b83..e177977 100644
---- a/test/pkce.test.js
++++ b/test/pkce.test.js
@@@ -10,22 +10,22 @@ const { createMockPlatform } = require('../src/testing');
  const s256 = (v) => crypto.createHash('sha256').update(v).digest('base64url');
  
  run([
--    ['RFC 7636 appendix B vector', async () => {
--        assert.equal(await browser.pkceChallenge('dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'), 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM');
++    ['the challenge is S256 of the verifier (RFC 7636)', async () => {
++        const { codeVerifier, codeChallenge, codeChallengeMethod } = await browser.createPkcePair();
++        assert.equal(codeChallenge, s256(codeVerifier));
++        assert.equal(codeChallengeMethod, 'S256');
      }],
  
--    ['verifiers are 43..128 unreserved characters and the challenge is S256 of them', async () => {
++    ['verifiers are 43..128 unreserved characters', async () => {
          for (const len of [43, 64, 128]) {
--            const { codeVerifier, codeChallenge, codeChallengeMethod } = await browser.createPkcePair(len);
++            const { codeVerifier } = await browser.createPkcePair(len);
              assert.equal(codeVerifier.length, len);
              assert.match(codeVerifier, /^[A-Za-z0-9\-._~]+$/);
--            assert.equal(codeChallenge, s256(codeVerifier));
--            assert.equal(codeChallengeMethod, 'S256');
          }
--        assert.throws(() => browser.createCodeVerifier(42), RangeError);
--        assert.throws(() => browser.createCodeVerifier(129), RangeError);
--        const a = browser.createCodeVerifier();
--        const b = browser.createCodeVerifier();
++        await assert.rejects(browser.createPkcePair(42), RangeError);
++        await assert.rejects(browser.createPkcePair(129), RangeError);
++        const a = (await browser.createPkcePair()).codeVerifier;
++        const b = (await browser.createPkcePair()).codeVerifier;
          assert.notEqual(a, b);
      }],
  
@@@ -69,7 +69,7 @@ run([
  
          await assert.rejects(exchangeCode({ fetch: platform.fetch, clientId: 'demo', clientSecret: 'demo-secret', code, redirectUri, codeVerifier }), { code: 'invalid_grant' });
          const code2 = platform.authorize({ clientId: 'demo', redirectUri, subjectId: user.subject_id, codeChallenge });
--        await assert.rejects(exchangeCode({ fetch: platform.fetch, clientId: 'demo', clientSecret: 'demo-secret', code: code2, redirectUri, codeVerifier: browser.createCodeVerifier() }), (err) => err.code === 'invalid_grant' && /PKCE/.test(err.detail));
++        await assert.rejects(exchangeCode({ fetch: platform.fetch, clientId: 'demo', clientSecret: 'demo-secret', code: code2, redirectUri, codeVerifier: (await browser.createPkcePair()).codeVerifier }), (err) => err.code === 'invalid_grant' && /PKCE/.test(err.detail));
  
          const refreshed = await refreshUserToken({ fetch: platform.fetch, clientId: 'demo', clientSecret: 'demo-secret', refreshToken: tokens.refresh_token });
          assert.ok(refreshed.access_token);
ddiff --git a/test/surface.test.js b/test/surface.test.js
iindex b4bc8ba..ccc14b7 100644
---- a/test/surface.test.js
++++ b/test/surface.test.js
@@@ -22,6 +22,19 @@ run([
          assert.equal(recorded['openvibe-sdk/core'].createClient, 'function');
      }],
  
++    ['the five 1.0 core entries export exactly these names: the freeze', async () => {
++        const expected = {
++            'openvibe-sdk/core': ['CONTRACTS_RANGE', 'DEFAULT_NETWORK', 'OpenVibeError', 'SDK_VERSION', 'compareVersions', 'contextFromHeaders', 'createClient', 'isActingSubjectId', 'isOpenVibeError', 'newEventId', 'newIdempotencyKey', 'offsetPager', 'paginate', 'parseTraceparent', 'satisfiesRange', 'startSpan', 'ulid'],
++            'openvibe-sdk/auth': ['TOKEN_VALID_AFTER', 'base64url', 'buildAuthorizeUrl', 'createJwksClient', 'createNetworkKeys', 'createPgRevocationStore', 'createPkcePair', 'createServiceTokenClient', 'createState', 'decodeUnverified', 'exchangeCode', 'jwksClient', 'jwksStatus', 'readCallback', 'refreshUserToken', 'revocationSchema', 'startAuthorization', 'unverifiedClaims', 'verifyAppToken', 'verifyServiceToken', 'verifyUserToken'],
++            'openvibe-sdk/events': ['appSource', 'createAppEvents', 'createEventsClient', 'createPgInbox', 'createPgOutbox', 'createServiceOutbox', 'inboxSchema', 'outboxSchema', 'parseDelivery', 'projectKey', 'signDelivery', 'signDeliveryHeaders', 'signDeliveryV2', 'verifyDelivery', 'verifyDeliveryV2'],
++            'openvibe-sdk/db': ['DbError', 'ISOLATION', 'PARSERS', 'createDb', 'sql'],
++            'openvibe-sdk/media': ['DEFAULT_PUBLIC_ORIGIN', 'createMediaClient', 'createObjectsClient', 'mediaUrls'],
++        };
++        assert.deepEqual(Object.keys(expected).sort(), [...CORE].sort());
++        const now = current();
++        for (const spec of CORE) assert.deepEqual(Object.keys(now[spec]), expected[spec], `${spec}: a frozen export name changed; removing or renaming one needs a major release`);
++    }],
++
      ['every name in the 1.0 core entries has exactly one tier (docs/one-point-oh.json), and every tiered name exists', async () => {
          const recorded = JSON.parse(fs.readFileSync(FILE, 'utf8'));
          assert.deepEqual(Object.keys(TIERS).sort(), [...CORE].sort());
ddiff --git a/types/auth-browser.d.ts b/types/auth-browser.d.ts
iindex 95b919d..121130a 100644
---- a/types/auth-browser.d.ts
++++ b/types/auth-browser.d.ts
@@@ -1,5 +1,3 @@
--export declare function createCodeVerifier(length?: number): string;
--export declare function pkceChallenge(verifier: string): Promise<string>;
  export declare function createPkcePair(length?: number): Promise<{ codeVerifier: string; codeChallenge: string; codeChallengeMethod: 'S256' }>;
  export declare function createState(): string;