openvibers/openvibe.sdk Commits

0.54.0: openvibe-sdk/tips, OpenVibe.Tips in the SDK (tip pages, tipping and paid requests, receipts, goals, moderation, overlays) (#65)

OP OpenVibers committed 24 days ago · 8c91d3ac3d · 17 files, +303 −13

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 281ba8e..866bfe1 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -3,6 +3,15 @@
  All notable changes to `openvibe-sdk`. The package follows semver; while it is `0.x`, a minor
  release may change an API and says so here.
  
++## 0.54.0 (2026-10-20)
++
++- **`openvibe-sdk/tips`**: OpenVibe.Tips through the SDK (it had 19 capabilities and no module). `createTipsClient(client)`
++  covers its `/api/v1`: a creator's tip page (`profiles`), tipping (`tip` → `{ interaction, checkout_url,
++  checkout_ref }`) and paid messages, TTS, media and sound requests (`send.*`), receipts and external tips
++  (`interactions`), `goals`, `moderation` (queue, log, moderators), `overlays` (tokens, configs, a test alert) and the
++  supporter's own `me.export` / `erase`. Tips replays an Idempotency-Key once, so every write carries one and a
++  retried tip is safe.
++
  ## 0.53.0 (2026-10-20)
  
  - **`openvibe-sdk/inventory`**: OpenVibe.Inventory through the SDK, as the owner asked of it ("cross site network wide
ddiff --git a/README.md b/README.md
iindex a1ce00b..340181e 100644
---- a/README.md
++++ b/README.md
@@@ -2,14 +2,14 @@
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.53.0 (roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat and AI clients from WS-F task 4; per-actor limits from WS-R task 4). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.54.0 (roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat and AI clients from WS-F task 4; per-actor limits from WS-R task 4). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
  **If a capability is not in the SDK, it is not public.** Apps call services through `openvibe-sdk` and never build internal routes themselves. A route with no SDK wrapper is internal, even when you can reach it, and it can change without notice. To make a capability public, first define it in OpenVibe.Contracts, then wrap it here.
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.53.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.54.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from Contracts v0.86.0, a devDependency the tests check them against).
@@@ -189,6 +189,7 @@ Until OpenVibe.Tools serves the gateway facade (Tools S6), point the jobs client
  | `openvibe-sdk/quest` | server | `createQuestClient(client)`: `appQuests.define(slug, {title, why?, steps: [{event_type, count, label}], badge: {name}, url?})`, `appQuests.list()`, `appQuests.retire(slug)` with an app token (audience `openvibe.quest`, `quest.app_quest.manage`); `eventType(projectId, name)` gives the `app.<project_key>.<name>` type to publish at Events. Badges only, never OpenCoins; production events count |
  | `openvibe-sdk/live` | server | `createLiveClient(client)`: OpenVibe.Live's documented routes. `streams.list/get/recentlyOnline/mine/update/end/heartbeat/endpoint`, `slots.list/create/update/remove/regenerateKey` (a slot is a saved setup with its own stream key), `goLive(slotId, {title, category, tags})` → `{ stream, endpoint }`, `channels.get/mine/update/toggleFollow/url`, `content.feed/moments({type, sort, window, cursor, limit})`; WHIP: `whip.url(streamKey)`, `whip.publish(url, offerSdp, {key?})` → `{ answer, location }` (the client's own token never goes to `/whip`), `whip.end(location)`. Writes are never retried |
  | `openvibe-sdk/inventory` | server | `createInventoryClient(client)`: OpenVibe.Inventory, the network-wide inventory (ADR-054). Public reads: `kinds.list/get`, `definitions.list({kind, issuer})/get`, `people.items(subject)`, `people.equipped(subject)`, `equipped([subjects])` (≤ 100, for chat renders). The person's own: `me.items()`, `me.equip({kind, slot, instance_id | null})`. An issuer's: `definitions.create/update`, `grants.create({definition_id, subject, idempotency_key})` → `{ instance, created }` (retry-safe on the key), `instances.consume/revoke`. `forPerson(usr_…)` sends `X-OV-Subject` for a service acting for a person. Audience `openvibe.inventory` |
++| `openvibe-sdk/tips` | server | `createTipsClient(client)`: OpenVibe.Tips' `/api/v1`. A creator's page: `profiles.get/update/totals/sounds/supporters`. Tipping: `tip({creator, amount, message?, goal_id?, pay_with})` → `{ interaction, checkout_url, checkout_ref }`, `send.message/tts/media/sound`. Receipts: `interactions.get/list/recordExternal/hide/restore`. `goals.list/get/create/update/close`, `moderation.queue/log/moderators.*`, `overlays.tokens.*/configs.*/simulate`, `me.export/erase`. Every write carries an Idempotency-Key, which Tips replays once, so retries are safe. Audience `openvibe.tips` |
  | `openvibe-sdk/vip` | server | `createVipClient({baseUrl?, tokenClient \| getToken, fetch?, timeoutMs?})`: `evaluate({subject, resource, owner, fallback, mode})`, `checkEntitlement({subject, creator, product, mode})`, `isMember(subject, creator)`; every failure is a denial. `createVipCache({vip, ttlMs, denyTtlMs, unavailableTtlMs})`: `entitlement`, `peekEntitlement`, `evaluate`, `invalidate`, `handleEvent` (`vip.membership.changed` and Billing's entitlement events drop a member's answers at once), `clear`, `bounds` |
  | `openvibe-sdk/usage` | server | `usageSample(fields)` builds a `platform.usage-sample@1` record (required `id`, `idempotency_key`, `service`, `operation`, `quantity`, `unit`; `at` defaults to now ISO, `source` to `openvibe-sdk/usage`; null fields stripped; money fields never invented); `usageKey(service, ...parts)` joins an idempotency key with `:`; `validateUsageSample(record)` → `{ok, errors}` (openvibe-contracts, required lazily). `createUsageReporter({ db, service, source, table, billingUrl, tokenClient, audience, requireProject, ... })` owns one service's readings: `key(...parts)`/`sample(fields)`, and `record(t, reading)` queues the reading idempotency-keyed in the outbox inside the caller's transaction, relayed to Billing's `billing.usage.record` with backoff (a retry is never dropped; only Billing refusing the reading itself — any 4xx but 401/403/404/408/425/429, which stay pending — marks a row rejected; a 401 drops the cached token). The reporter bills whatever reading it is given: never record first-party or sandbox traffic (pass `requireProject: true` to refuse a reading without a `prj_…` project). `openvibe-sdk/govern` builds its `onUsage` record with it |
  | `openvibe-sdk/commerce` | server | `createCommerceClient(config, {caps, fetchImpl?, tokenClients?, timeoutMs?})`: the Billing client Tips and VIP share. `config` = `{billing: {url, audience, timeoutMs = 10000}, network: {internalUrl}, oauth: {clientId, clientSecret}}`; `caps` maps `intent`, `transfer`, `subscription`, `entitlement` (and optional `rates`, default `entitlement`) to capability strings, one lazily created `serviceAuth` token client per distinct string (`scope` = the string) unless `tokenClients` supplies one, keyed by logical key or capability. Methods: `createIntent` (`kind` purchase with `bits`, or subscription with `creator`/`tier`/`autoRenew`), `createTransfer`, `refundTransfer`, `subscribeWithCredit` (`tier`), `cancelSubscription`, `getSubscription`, `listSubscriptions`, `entitlement`, `rates`, `listTiers(creator)` and `setTier({creator, tier, priceCents, status?, key})` (a creator's tier prices, kept by Billing; optional `caps.tier` = `billing.tier.manage`, which `setTier` needs), `baseUrl`. `Idempotency-Key` is sent verbatim; a 401 invalidates the token and retries once with the same key; problem+json becomes `CommerceError` (`status`, `code`, `body`, `retryable`). `intentKey(prefix, parts)` joins the parts that are set; `receipt(kind, fields)` → `{kind, at, ...fields}` (null stripped, never posted). `openvibe-contracts` is required lazily |
ddiff --git a/STATUS.json b/STATUS.json
iindex 41764da..a8fa889 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.53.0",
++  "version": "0.54.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex e824a19..635cbe8 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.53.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.54.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, registry, modules, realtime, media, community, bot, search, chat, ai, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -42,7 +42,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.53.0';
++const SDK_VERSION = '0.54.0';
  
  module.exports = {
      createClient,
ddiff --git a/esm/index.mjs b/esm/index.mjs
iindex 8fe52e9..d38c548 100644
---- a/esm/index.mjs
++++ b/esm/index.mjs
@@@ -8,7 +8,7 @@ export const {
      registry, identity, modules, events, realtime, media,
      community, bot, search, chat, ai, jobs,
      tools, projects, resources, vip, quest, live,
--    inventory, play, download, openre, geo, usage,
--    commerce, telemetry,
++    inventory, tips, play, download, openre, geo,
++    usage, commerce, telemetry,
  } = cjs;
  export default cjs;
ddiff --git a/esm/tips.mjs b/esm/tips.mjs
nnew file mode 100644
iindex 0000000..e3a4b41
---- /dev/null
++++ b/esm/tips.mjs
@@@ -0,0 +1,7 @@
++// Generated by scripts/esm.js from src/tips.js. Do not edit.
++import cjs from '../src/tips.js';
++
++export const {
++    createTipsClient,
++} = cjs;
++export default cjs;
ddiff --git a/index.js b/index.js
iindex 4b09ec3..2aa1d9e 100644
---- a/index.js
++++ b/index.js
@@@ -28,6 +28,7 @@ module.exports = {
      quest: require('./src/quest'),
      live: require('./src/live'),
      inventory: require('./src/inventory'),
++    tips: require('./src/tips'),
      play: require('./src/play'),
      download: require('./src/download'),
      openre: require('./src/openre'),
ddiff --git a/package-lock.json b/package-lock.json
iindex cc20373..1c431b9 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.53.0",
++  "version": "0.54.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.53.0",
++      "version": "0.54.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex cadc23d..b75b3ce 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.53.0",
++  "version": "0.54.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
@@@ -266,6 +266,12 @@
        "import": "./esm/inventory.mjs",
        "default": "./src/inventory.js"
      },
++    "./tips": {
++      "types": "./types/tips.d.ts",
++      "browser": null,
++      "import": "./esm/tips.mjs",
++      "default": "./src/tips.js"
++    },
      "./vip": {
        "types": "./types/vip.d.ts",
        "browser": null,
ddiff --git a/scripts/esm.js b/scripts/esm.js
iindex 3665114..89d34d7 100644
---- a/scripts/esm.js
++++ b/scripts/esm.js
@@@ -57,6 +57,7 @@ const ENTRIES = {
      'quest.mjs': '../src/quest.js',
      'live.mjs': '../src/live.js',
      'inventory.mjs': '../src/inventory.js',
++    'tips.mjs': '../src/tips.js',
      'vip.mjs': '../src/vip.js',
      'frame.mjs': '../src/frame.js',
      'service.mjs': '../src/service/index.js',
ddiff --git a/src/core/index.js b/src/core/index.js
iindex 3bfea17..dc1806e 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.53.0';
++const SDK_VERSION = '0.54.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/tips.js b/src/tips.js
nnew file mode 100644
iindex 0000000..e1bb74f
---- /dev/null
++++ b/src/tips.js
@@@ -0,0 +1,120 @@
++'use strict';
++/**
++ * openvibe-sdk/tips — OpenVibe.Tips: a creator's tip page, tipping (with a message, a TTS line, a media or sound
++ * request), receipts, goals, supporters, moderation, overlays and external tips. Money moves through OpenVibe.Billing;
++ * this is the product around it. Its /api/v1 honours Idempotency-Key on every POST and PATCH (the same key twice runs
++ * once), so the SDK's automatic keys make a retried tip safe. Tokens are for audience openvibe.tips: a person acts on
++ * their own things; a service holds one capability per route.
++ *
++ *   const tips = createTipsClient(createClient({ tokenProvider }));
++ *   const page = await tips.profiles.get('goosely');                                   // the public tip page
++ *   const { checkout_url } = await tips.tip({ creator: 'goosely', amount: 500, message: 'gg', pay_with: 'checkout' });
++ *   await tips.goals.create({ title: 'New mic', target: 20000 });                      // the creator's own
++ *   const { interactions, next_cursor } = await tips.interactions.list({ as: 'creator' });
++ *
++ * Amounts are what Tips states (minor units, cents). Errors are OpenVibeError with Tips' codes (tips.page_off,
++ * tips.amount_invalid, idempotency.in_progress …).
++ */
++const enc = encodeURIComponent;
++const CREATOR_RE = /^(me|[A-Za-z0-9_]{1,32})$/;
++
++function createTipsClient(client, { baseUrl } = {}) {
++    if (!client || typeof client.json !== 'function') throw new TypeError('createTipsClient: pass an openvibe-sdk/core client');
++    const call = (opts) => client.json({ service: 'tips', baseUrl, audience: 'openvibe.tips', ...opts });
++    const who = (creator) => {
++        const c = String(creator || '').replace(/^@/, '');
++        if (!CREATOR_RE.test(c)) throw new TypeError('tips: a creator is a username (or "me")');
++        return enc(c);
++    };
++    const id = (v, what) => {
++        if (!/^[A-Za-z0-9_-]{1,64}$/.test(String(v || ''))) throw new TypeError(`tips: ${what}`);
++        return enc(String(v));
++    };
++    const post = (path, json, signal) => call({ method: 'POST', path, json: json || {}, signal });
++
++    const profiles = {
++        /** A creator's tip page (public when switched on; the owner always). */
++        get: (creator, { signal } = {}) => call({ path: `/api/v1/profiles/${who(creator)}`, signal }),
++        /** Update your page (`me` creates it): its settings, what supporters may send, minimums. */
++        update: (patch, { signal } = {}) => call({ method: 'PATCH', path: '/api/v1/profiles/me', json: patch, signal }),
++        /** The owner's totals. */
++        totals: (creator = 'me', { signal } = {}) => call({ path: `/api/v1/profiles/${who(creator)}/totals`, signal }),
++        /** The sounds a supporter may request. */
++        sounds: (creator, { signal } = {}) => call({ path: `/api/v1/profiles/${who(creator)}/sounds`, signal }),
++        /** The supporters list (public when the creator shows it; the owner always). */
++        supporters: (creator, { signal } = {}) => call({ path: `/api/v1/profiles/${who(creator)}/supporters`, signal }),
++    };
++
++    /**
++     * Tip a creator → { interaction, checkout_url, checkout_ref } (a checkout_url to complete when paying by checkout).
++     * { creator, amount, message?, goal_id?, pay_with: 'credit' | 'checkout', provider?, privacy? }; a service passes
++     * `supporter`.
++     */
++    const tip = (req, { signal } = {}) => post('/api/v1/checkout', req, signal);
++    const send = {
++        /** A paid chat message. */
++        message: (req, { signal } = {}) => post('/api/v1/paid-messages', req, signal),
++        /** A paid TTS line: { …, tts: { text, voice } }. */
++        tts: (req, { signal } = {}) => post('/api/v1/tts-requests', req, signal),
++        /** A paid media request: { …, media: { url } }. */
++        media: (req, { signal } = {}) => post('/api/v1/media-requests', req, signal),
++        /** A paid sound: { …, sound: { id } } (from profiles.sounds). */
++        sound: (req, { signal } = {}) => post('/api/v1/sound-requests', req, signal),
++    };
++
++    const interactions = {
++        get: (interactionId, { signal } = {}) => call({ path: `/api/v1/interactions/${id(interactionId, 'an interaction id')}`, signal }),
++        /** Your receipts, or with { as: 'creator' } the tips you received. */
++        list: ({ creator, supporter, as, cursor, signal } = {}) => call({ path: '/api/v1/interactions', query: { creator, supporter, as, cursor }, signal }),
++        /** A service records a tip made elsewhere: { creator, provider, provider_ref, amount_cents, supporter_name?, message?, announce? }. */
++        recordExternal: (req, { signal } = {}) => post('/api/v1/interactions/external', req, signal),
++        hide: (interactionId, { reason, signal } = {}) => post(`/api/v1/interactions/${id(interactionId, 'an interaction id')}/hide`, reason ? { reason } : {}, signal),
++        restore: (interactionId, { reason, signal } = {}) => post(`/api/v1/interactions/${id(interactionId, 'an interaction id')}/restore`, reason ? { reason } : {}, signal),
++    };
++
++    const goals = {
++        list: (creator, { signal } = {}) => call({ path: '/api/v1/goals', query: { creator: String(creator || '').replace(/^@/, '') || undefined }, signal }),
++        get: (goalId, { signal } = {}) => call({ path: `/api/v1/goals/${id(goalId, 'a goal id')}`, signal }),
++        create: (goal, { signal } = {}) => post('/api/v1/goals', goal, signal),
++        update: (goalId, patch, { signal } = {}) => call({ method: 'PATCH', path: `/api/v1/goals/${id(goalId, 'a goal id')}`, json: patch, signal }),
++        close: (goalId, { signal } = {}) => post(`/api/v1/goals/${id(goalId, 'a goal id')}/close`, {}, signal),
++    };
++
++    const moderation = {
++        /** Held, hidden or visible tips: { creator, state: 'held' | 'hidden' | 'visible' | 'all' }. */
++        queue: ({ creator, state, signal } = {}) => call({ path: '/api/v1/moderation', query: { creator, state }, signal }),
++        log: ({ creator, signal } = {}) => call({ path: '/api/v1/moderation/log', query: { creator }, signal }),
++        moderators: {
++            list: ({ signal } = {}) => call({ path: '/api/v1/moderators', signal }),
++            add: (req, { signal } = {}) => post('/api/v1/moderators', req, signal),
++            remove: (subject, { signal } = {}) => post(`/api/v1/moderators/${id(subject, 'a moderator is a subject id')}/remove`, {}, signal),
++        },
++    };
++
++    const overlays = {
++        tokens: {
++            list: ({ signal } = {}) => call({ path: '/api/v1/overlay-tokens', signal }),
++            create: (req = {}, { signal } = {}) => post('/api/v1/overlay-tokens', req, signal),
++            revoke: (tokenId, { signal } = {}) => post(`/api/v1/overlay-tokens/${id(tokenId, 'an overlay token id')}/revoke`, {}, signal),
++        },
++        configs: {
++            list: ({ signal } = {}) => call({ path: '/api/v1/overlay-configs', signal }),
++            get: (configId, { signal } = {}) => call({ path: `/api/v1/overlay-configs/${id(configId, 'an overlay config id')}`, signal }),
++            create: (config, { signal } = {}) => post('/api/v1/overlay-configs', config, signal),
++            update: (configId, patch, { signal } = {}) => call({ method: 'PATCH', path: `/api/v1/overlay-configs/${id(configId, 'an overlay config id')}`, json: patch, signal }),
++        },
++        /** A test alert on your overlays, with nothing paid. */
++        simulate: (req = {}, { signal } = {}) => post('/api/v1/simulate', req, signal),
++    };
++
++    const me = {
++        /** Your own tips as a download. */
++        export: ({ signal } = {}) => call({ path: '/api/v1/me/export', signal }),
++        /** Erase your data from your tips (the creator keeps the amounts). */
++        erase: ({ signal } = {}) => post('/api/v1/me/erase', {}, signal),
++    };
++
++    return { profiles, tip, send, interactions, goals, moderation, overlays, me };
++}
++
++module.exports = { createTipsClient };
ddiff --git a/test/browser-entries.test.js b/test/browser-entries.test.js
iindex 0d2b188..f95c2d9 100644
---- a/test/browser-entries.test.js
++++ b/test/browser-entries.test.js
@@@ -76,7 +76,7 @@ run([
              for (const [re, why] of FORBIDDEN) if (re.test(src)) problems.push(`${path.relative(ROOT, file)}: ${why}`);
          }
          assert.deepEqual(problems, []);
--        assert.deepEqual(blocked.sort(), ['./account-data', './cache', './commerce', './cost', './db', './delivery', './download', './events', './govern', './identity', './inventory', './limits', './live', './node', './notifications', './openre', './placement', './play', './pubsub', './quest', './queue', './resources', './runtime', './service', './sso', './storage', './telemetry', './testing', './usage', './valkey', './vip']);
++        assert.deepEqual(blocked.sort(), ['./account-data', './cache', './commerce', './cost', './db', './delivery', './download', './events', './govern', './identity', './inventory', './limits', './live', './node', './notifications', './openre', './placement', './play', './pubsub', './quest', './queue', './resources', './runtime', './service', './sso', './storage', './telemetry', './testing', './tips', './usage', './valkey', './vip']);
          const rel = [...scanned].map((f) => path.relative(ROOT, f));
          for (const must of ['browser.js', 'src/core/client.js', 'src/auth/browser.js', 'src/realtime.js', 'src/media.js', 'src/community.js', 'src/bot.js', 'src/modules.js', 'src/registry.js', 'src/jobs.js', 'src/tools.js', 'src/core/form.js', 'src/projects.js', 'browser/openvibe-sdk.mjs']) {
              assert.ok(rel.includes(must), `${must} is scanned`);
ddiff --git a/test/pack.test.js b/test/pack.test.js
iindex 0506d50..e63c1c2 100644
---- a/test/pack.test.js
++++ b/test/pack.test.js
@@@ -66,7 +66,7 @@ run([
                  })().catch((err) => { console.error(err); process.exit(1); });`;
              const res = execFileSync(process.execPath, ['-e', script], { cwd: app, encoding: 'utf8' });
              assert.match(res, new RegExp(`consumer ok: ${subpaths.length} subpaths \\+ the browser bundle`));
--            assert.equal(subpaths.length, 49);
++            assert.equal(subpaths.length, 50);
              assert.ok(!fs.existsSync(path.join(app, 'node_modules/openvibe-contracts')), 'the optional peer is not installed');
          } finally {
              fs.rmSync(tmp, { recursive: true, force: true });
ddiff --git a/test/tips.test.js b/test/tips.test.js
nnew file mode 100644
iindex 0000000..51ca2b9
---- /dev/null
++++ b/test/tips.test.js
@@@ -0,0 +1,94 @@
++'use strict';
++// openvibe-sdk/tips: OpenVibe.Tips' /api/v1 through a real core client against a local stub: every route and method,
++// an Idempotency-Key on each write (Tips replays the same key once, so a retried tip is safe and is retried), the
++// creator and id checks done before any call.
++const assert = require('assert');
++const http = require('http');
++const { createClient } = require('../src/core');
++const { createTipsClient } = require('../src/tips');
++
++(async () => {
++    const seen = [];
++    let tipAttempts = 0;
++    const server = http.createServer((req, res) => {
++        let body = '';
++        req.on('data', (c) => { body += c; });
++        req.on('end', () => {
++            seen.push({ method: req.method, url: req.url, idem: req.headers['idempotency-key'] || null, body: body ? JSON.parse(body) : null });
++            const json = (status, obj) => { res.writeHead(status, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(obj)); };
++            if (req.url === '/api/v1/checkout') {
++                tipAttempts++;
++                if (tipAttempts === 1) return json(503, { type: 'about:blank', title: 'busy', status: 503 });
++                return json(201, { interaction: { id: 'int_1' }, checkout_url: 'https://pay.example/x', checkout_ref: 'ref' });
++            }
++            return json(200, { ok: true });
++        });
++    });
++    await new Promise((r) => server.listen(0, '127.0.0.1', r));
++    const base = `http://127.0.0.1:${server.address().port}`;
++    const tips = createTipsClient(createClient({ baseUrls: { tips: base }, token: 'tok', retries: 2, retryDelayMs: 1, maxRetryDelayMs: 2 }));
++
++    try {
++        await tips.profiles.get('@goosely');
++        await tips.profiles.update({ enabled: true });
++        await tips.profiles.totals();
++        await tips.profiles.sounds('goosely');
++        await tips.profiles.supporters('goosely');
++        await tips.send.message({ creator: 'goosely', amount: 100, message: 'hi' });
++        await tips.send.tts({ creator: 'goosely', amount: 100, tts: { text: 'hello', voice: 'en' } });
++        await tips.send.media({ creator: 'goosely', amount: 100, media: { url: 'https://example.com/v' } });
++        await tips.send.sound({ creator: 'goosely', amount: 100, sound: { id: 'snd_1' } });
++        await tips.interactions.get('int_1');
++        await tips.interactions.list({ as: 'creator', cursor: 'c2' });
++        await tips.interactions.recordExternal({ creator: 'goosely', provider: 'kofi', provider_ref: 'k1', amount_cents: 300 });
++        await tips.interactions.hide('int_1', { reason: 'spam' });
++        await tips.interactions.restore('int_1');
++        await tips.goals.list('goosely');
++        await tips.goals.get('gol_1');
++        await tips.goals.create({ title: 'New mic', target: 20000 });
++        await tips.goals.update('gol_1', { title: 'Better mic' });
++        await tips.goals.close('gol_1');
++        await tips.moderation.queue({ creator: 'goosely', state: 'held' });
++        await tips.moderation.log({ creator: 'goosely' });
++        await tips.moderation.moderators.list();
++        await tips.moderation.moderators.add({ subject: 'usr_x' });
++        await tips.moderation.moderators.remove('usr_x');
++        await tips.overlays.tokens.list();
++        await tips.overlays.tokens.create();
++        await tips.overlays.tokens.revoke('ovt_1');
++        await tips.overlays.configs.list();
++        await tips.overlays.configs.get('ovc_1');
++        await tips.overlays.configs.create({ kind: 'alert' });
++        await tips.overlays.configs.update('ovc_1', { volume: 50 });
++        await tips.overlays.simulate({ kind: 'tip' });
++        await tips.me.export();
++        await tips.me.erase();
++        assert.deepStrictEqual(seen.map((s) => `${s.method} ${s.url}`), [
++            'GET /api/v1/profiles/goosely', 'PATCH /api/v1/profiles/me', 'GET /api/v1/profiles/me/totals', 'GET /api/v1/profiles/goosely/sounds',
++            'GET /api/v1/profiles/goosely/supporters', 'POST /api/v1/paid-messages', 'POST /api/v1/tts-requests', 'POST /api/v1/media-requests',
++            'POST /api/v1/sound-requests', 'GET /api/v1/interactions/int_1', 'GET /api/v1/interactions?as=creator&cursor=c2',
++            'POST /api/v1/interactions/external', 'POST /api/v1/interactions/int_1/hide', 'POST /api/v1/interactions/int_1/restore',
++            'GET /api/v1/goals?creator=goosely', 'GET /api/v1/goals/gol_1', 'POST /api/v1/goals', 'PATCH /api/v1/goals/gol_1', 'POST /api/v1/goals/gol_1/close',
++            'GET /api/v1/moderation?creator=goosely&state=held', 'GET /api/v1/moderation/log?creator=goosely', 'GET /api/v1/moderators', 'POST /api/v1/moderators',
++            'POST /api/v1/moderators/usr_x/remove', 'GET /api/v1/overlay-tokens', 'POST /api/v1/overlay-tokens', 'POST /api/v1/overlay-tokens/ovt_1/revoke',
++            'GET /api/v1/overlay-configs', 'GET /api/v1/overlay-configs/ovc_1', 'POST /api/v1/overlay-configs', 'PATCH /api/v1/overlay-configs/ovc_1',
++            'POST /api/v1/simulate', 'GET /api/v1/me/export', 'POST /api/v1/me/erase',
++        ]);
++        assert.ok(seen.filter((s) => s.method !== 'GET').every((s) => s.idem), 'every write carries an Idempotency-Key');
++        assert.deepStrictEqual(seen[12].body, { reason: 'spam' });
++
++        // A tip retried through a 503 keeps its key: Tips runs it once.
++        seen.length = 0;
++        const out = await tips.tip({ creator: 'goosely', amount: 500, message: 'gg', pay_with: 'checkout' });
++        assert.deepStrictEqual(out, { interaction: { id: 'int_1' }, checkout_url: 'https://pay.example/x', checkout_ref: 'ref' });
++        assert.strictEqual(seen.length, 2, 'retried once');
++        assert.ok(seen[0].idem && seen[0].idem === seen[1].idem, 'with the same Idempotency-Key');
++
++        assert.throws(() => tips.profiles.get('no spaces here'), /username/);
++        assert.throws(() => tips.goals.get('../x'), /goal id/);
++        assert.throws(() => createTipsClient({}), /core client/);
++        console.log('tips: all checks passed');
++    } finally {
++        server.close();
++    }
++})().catch((err) => { console.error(err); process.exit(1); });
ddiff --git a/types/index.d.ts b/types/index.d.ts
iindex 93b76a8..aab3fb5 100644
---- a/types/index.d.ts
++++ b/types/index.d.ts
@@@ -19,6 +19,7 @@ export * as vip from './vip';
  export * as quest from './quest';
  export * as live from './live';
  export * as inventory from './inventory';
++export * as tips from './tips';
  export * as play from './play';
  export * as download from './download';
  export * as openre from './openre';
ddiff --git a/types/tips.d.ts b/types/tips.d.ts
nnew file mode 100644
iindex 0000000..1e8b963
---- /dev/null
++++ b/types/tips.d.ts
@@@ -0,0 +1,50 @@
++/** openvibe-sdk/tips: OpenVibe.Tips — tip pages, tipping, receipts, goals, moderation and overlays. */
++type Opts = { signal?: AbortSignal };
++type TipsJson = Record<string, any>;
++export interface TipRequest {
++    creator: string; amount: number; message?: string; goal_id?: string; pay_with: 'credit' | 'checkout';
++    provider?: string; privacy?: string; supporter?: string; target?: string; [k: string]: unknown;
++}
++export interface TipResult { interaction: TipsJson; checkout_url: string | null; checkout_ref: string | null }
++export interface TipsClient {
++    profiles: {
++        get(creator: string, opts?: Opts): Promise<TipsJson>;
++        update(patch: Record<string, unknown>, opts?: Opts): Promise<TipsJson>;
++        totals(creator?: string, opts?: Opts): Promise<TipsJson>;
++        sounds(creator: string, opts?: Opts): Promise<TipsJson>;
++        supporters(creator: string, opts?: Opts): Promise<TipsJson>;
++    };
++    tip(req: TipRequest, opts?: Opts): Promise<TipResult>;
++    send: {
++        message(req: TipRequest, opts?: Opts): Promise<TipResult>;
++        tts(req: TipRequest & { tts: { text: string; voice?: string } }, opts?: Opts): Promise<TipResult>;
++        media(req: TipRequest & { media: { url: string } }, opts?: Opts): Promise<TipResult>;
++        sound(req: TipRequest & { sound: { id: string } }, opts?: Opts): Promise<TipResult>;
++    };
++    interactions: {
++        get(id: string, opts?: Opts): Promise<{ interaction: TipsJson }>;
++        list(opts?: Opts & { creator?: string; supporter?: string; as?: 'creator'; cursor?: string }): Promise<{ interactions: TipsJson[]; next_cursor: string | null }>;
++        recordExternal(req: { creator: string; provider: string; provider_ref: string; amount_cents: number; supporter_name?: string; message?: string; announce?: boolean }, opts?: Opts): Promise<TipsJson>;
++        hide(id: string, opts?: Opts & { reason?: string }): Promise<TipsJson>;
++        restore(id: string, opts?: Opts & { reason?: string }): Promise<TipsJson>;
++    };
++    goals: {
++        list(creator: string, opts?: Opts): Promise<TipsJson>;
++        get(id: string, opts?: Opts): Promise<TipsJson>;
++        create(goal: Record<string, unknown>, opts?: Opts): Promise<{ goal: TipsJson }>;
++        update(id: string, patch: Record<string, unknown>, opts?: Opts): Promise<TipsJson>;
++        close(id: string, opts?: Opts): Promise<TipsJson>;
++    };
++    moderation: {
++        queue(opts?: Opts & { creator?: string; state?: 'held' | 'hidden' | 'visible' | 'all' }): Promise<TipsJson>;
++        log(opts?: Opts & { creator?: string }): Promise<TipsJson>;
++        moderators: { list(opts?: Opts): Promise<TipsJson>; add(req: Record<string, unknown>, opts?: Opts): Promise<TipsJson>; remove(subject: string, opts?: Opts): Promise<TipsJson> };
++    };
++    overlays: {
++        tokens: { list(opts?: Opts): Promise<TipsJson>; create(req?: Record<string, unknown>, opts?: Opts): Promise<{ token: string; secret: string; overlay_url: string; events_url: string }>; revoke(id: string, opts?: Opts): Promise<TipsJson> };
++        configs: { list(opts?: Opts): Promise<TipsJson>; get(id: string, opts?: Opts): Promise<TipsJson>; create(config: Record<string, unknown>, opts?: Opts): Promise<TipsJson>; update(id: string, patch: Record<string, unknown>, opts?: Opts): Promise<TipsJson> };
++        simulate(req?: Record<string, unknown>, opts?: Opts): Promise<TipsJson>;
++    };
++    me: { export(opts?: Opts): Promise<TipsJson>; erase(opts?: Opts): Promise<TipsJson> };
++}
++export function createTipsClient(client: { json(opts: Record<string, unknown>): Promise<any> }, options?: { baseUrl?: string }): TipsClient;