openvibers/openvibe.sdk Commits

Add Community comment attachments to SDK (#191)

OP OpenVibers committed 3 days ago · ae1c7598f7 · 10 files, +48 −17

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 4af1bde..a32727c 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,9 @@
  # Changelog
  
++## 0.141.0 — 2026-11-10
++
++- `community.comments.upload(ref, file)` uploads a Community paste comment attachment through Community; `comments.create()` accepts typed attachment references.
++
  ## 0.140.0 — 2026-11-10
  
  - `chat.history.pages()` asynchronously iterates newest-first cursor pages; `chat.history.attach()` loads older pages on scroll while preserving the visible message anchor. The same helper is available to Live and Dock.
ddiff --git a/README.md b/README.md
iindex 65637e2..830a542 100644
---- a/README.md
++++ b/README.md
@@@ -13,7 +13,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.140.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.141.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -22,7 +22,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.140.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.141.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
@@@ -202,7 +202,7 @@ Until OpenVibe.Tools serves the gateway facade (Tools S6), point the jobs client
  | `openvibe-sdk/sso` | server | `createSsoClient({site, baseUrl, clientId, clientSecret, networkUrl, networkInternalUrl, secureCookies})`: a product site's sign-in with OpenVibe.Network: `router(express)` (`/login` with state + PKCE S256, `/callback`, `/fedcm`, `/logout`, `/me`, `/refresh`), `optionalAuth()`, `requireAuth()`, `verify(token)` (offline, shared JWKS), `extractToken(req)`; `sanitizeNext`, `COOKIES` |
  | `openvibe-sdk/realtime` | both | `subscribe(topics, onEvent, {lastEventId, onGap, …})`, `createRealtimeClient(client)`, `parseSSE(body)` |
  | `openvibe-sdk/media` | both (credentials: server) | `createMediaClient(client, {app, apiKey?, actingUserId?})`: `files.upload/list/iterate/get/delete`; `mediaUrls(origin)` public URL helpers; `createObjectsClient({app, baseUrl?, tokenClient \| apiKey \| client})`: object API v2 `upload` (single or multipart by size, resumable), `resume`, `get`, `signedUrl`, `delete`, `list`, `iterate`, and `jobs.create/get/list/approve/cancel/wait`; Media's origin from the platform descriptor when `baseUrl` is omitted |
--| `openvibe-sdk/community` | both | `createCommunityClient(client, {actingSubject?, origin?, sourceRef?, staff?})`: `pastes.list/iterate/get/create/update/delete/fork/like/copy/versions/byUser/config`, `pastes.comments.list/create/delete`, shared `comments.resolve/get/create/edit/delete/visibility`, `as(subject)` |
++| `openvibe-sdk/community` | both | `createCommunityClient(client, {actingSubject?, origin?, sourceRef?, staff?})`: `pastes.list/iterate/get/create/update/delete/fork/like/copy/versions/byUser/config`, `pastes.comments.list/create/delete`, shared `comments.resolve/get/upload/create/edit/delete/visibility`, `as(subject)` |
  | `openvibe-sdk/home-feed` | both | `createHomeFeedClient(client)` gives `ov.home.get()/set(layout)`, `ov.network.today()`, `ov.feed.list({ for: 'me', cursor })`, `ov.feed.post(text)`, and `ov.feed.contribute({ id, text, url })`. Personal calls need a user Bearer token; contribution needs an app token granted `community.pulse.contribute`. Today is public and cached by Network for five minutes. |
  | `openvibe-sdk/bot` | both | `createBotClient(client, {actingSubject?})`: OpenVibe.Bot robots. `robots.list/get/create/update/delete/pairingCode`, `robots.operators.list/add/remove`, `robots.devices`, `robots.streaming.get/set`, `robots.audit`/`iterateAudit`, `robots.estop`/`clearEstop`, `robots.command` (`bot.command@1`), `devices.rotate/revoke`, public `profiles.list/get` and `kits.list/get`, `pair` (the agent's one-time code, never retried), `as(subject)`; a service acts for a person with `X-OV-Subject` (capabilities `bot.robot.read`/`manage`/`control`, `bot.device.connect`) |
  | `openvibe-sdk/themes` | both | `createThemesClient(client)`: `catalog({mode, search, sort, limit})` (seasonal themes carry `season`), `get(idOrSlug)` (null when missing), `export(idOrSlug)`, `active()` (`{theme_id, custom_variables, display}`), `set(themeId, {custom})`, `setDisplay({motion, text, seasonal})`, `seasons({date})`, `submissions()`, `submit(theme)`, `import(file)`. In the browser: `followTheme(fn)` calls back now and on every theme, display or season change with `readTheme()` (`{id, mode, tokens, display: {motion, text, textScale, seasonal, calm}, season, seasonMark}`) and returns `stop()`, for a canvas or game to keep up; `applyTheme(vars, {root})`, `seasonOn(date, seasons)`, `onColor(hex)`, `DISPLAY_OPTIONS`, `TOKENS` |
ddiff --git a/STATUS.json b/STATUS.json
iindex 421f14a..908f884 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.140.0",
++  "version": "0.141.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), \u00a73.2; roadmap \u00a730",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 565cdee..349a308 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.140.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.141.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, trust, levels, modules, realtime, media, cam, mediaUpload, ui, community, homeFeed, bot, search, bench, meme, vision, themes, design, redact, chat, ai, credentials, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -57,7 +57,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.140.0';
++const SDK_VERSION = '0.141.0';
  
  module.exports = {
      createClient,
@@@ -3465,8 +3465,8 @@ function (module, exports) {
   * Community ignores X-OV-* headers from browsers.
   *
   * The Feed and status posts are here too: feed() reads GET /api/v1/feed (one stream from Pulse across every
-- * OpenVibe site) and posts.create() posts text with up to four pictures. Comments on other content, the rest of
-- * the forum and Pulse's service API are not wrapped yet; paste comments are.
++ * OpenVibe site) and posts.create() posts text with up to four pictures. Shared typed comment threads are exposed
++ * as comments.*, including the owner-service attachment upload for Community paste comments.
   */
  const { isOpenVibeError } = __load(3);
  const { isActingSubjectId } = __load(5);
@@@ -3577,6 +3577,14 @@ function createCommunityClient(client, defaults = {}) {
          resolve: (ref, o = {}) => call({ method: 'POST', path: '/api/v1/comments/threads/resolve', json: { ref }, ...once }, o),
          /** Read a page; sort is old|new, or parent pages replies after the first page. */
          get: (id, query = {}, o = {}) => call({ path: `/api/v1/comments/threads/${enc(id)}`, query }, o),
++        /** Upload bytes to the service that owns a Community paste, before passing the returned ref to create(). */
++        upload: (ref, file, o = {}) => {
++            const form = new FormData();
++            form.set('ref', JSON.stringify(ref));
++            const blob = file instanceof Blob ? file : new Blob([file], { type: o.mediaType || 'application/octet-stream' });
++            form.set('file', blob, o.filename || file.name || 'file');
++            return call({ method: 'POST', path: '/api/v1/comments/attachments', body: form, ...once }, o);
++        },
          /** Add a comment or reply; replies to replies are filed under their first comment. */
          create: (id, input, o = {}) => call({ method: 'POST', path: `/api/v1/comments/threads/${enc(id)}/comments`, json: input, ...once }, o),
          edit: (commentId, input, o = {}) => call({ method: 'PATCH', path: `/api/v1/comments/${enc(commentId)}`, json: input }, o),
ddiff --git a/package-lock.json b/package-lock.json
iindex 7ed6808..82c00e7 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.140.0",
++  "version": "0.141.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.140.0",
++      "version": "0.141.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex c1bf859..f26dcf3 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.140.0",
++  "version": "0.141.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/community.js b/src/community.js
iindex 2e36173..fd5e67a 100644
---- a/src/community.js
++++ b/src/community.js
@@@ -14,8 +14,8 @@
   * Community ignores X-OV-* headers from browsers.
   *
   * The Feed and status posts are here too: feed() reads GET /api/v1/feed (one stream from Pulse across every
-- * OpenVibe site) and posts.create() posts text with up to four pictures. Comments on other content, the rest of
-- * the forum and Pulse's service API are not wrapped yet; paste comments are.
++ * OpenVibe site) and posts.create() posts text with up to four pictures. Shared typed comment threads are exposed
++ * as comments.*, including the owner-service attachment upload for Community paste comments.
   */
  const { isOpenVibeError } = require('./core/errors');
  const { isActingSubjectId } = require('./core/ids');
@@@ -126,6 +126,14 @@ function createCommunityClient(client, defaults = {}) {
          resolve: (ref, o = {}) => call({ method: 'POST', path: '/api/v1/comments/threads/resolve', json: { ref }, ...once }, o),
          /** Read a page; sort is old|new, or parent pages replies after the first page. */
          get: (id, query = {}, o = {}) => call({ path: `/api/v1/comments/threads/${enc(id)}`, query }, o),
++        /** Upload bytes to the service that owns a Community paste, before passing the returned ref to create(). */
++        upload: (ref, file, o = {}) => {
++            const form = new FormData();
++            form.set('ref', JSON.stringify(ref));
++            const blob = file instanceof Blob ? file : new Blob([file], { type: o.mediaType || 'application/octet-stream' });
++            form.set('file', blob, o.filename || file.name || 'file');
++            return call({ method: 'POST', path: '/api/v1/comments/attachments', body: form, ...once }, o);
++        },
          /** Add a comment or reply; replies to replies are filed under their first comment. */
          create: (id, input, o = {}) => call({ method: 'POST', path: `/api/v1/comments/threads/${enc(id)}/comments`, json: input, ...once }, o),
          edit: (commentId, input, o = {}) => call({ method: 'PATCH', path: `/api/v1/comments/${enc(commentId)}`, json: input }, o),
ddiff --git a/src/core/index.js b/src/core/index.js
iindex fc3799a..11b90dc 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.140.0';
++const SDK_VERSION = '0.141.0';
  
  module.exports = {
      createClient,
ddiff --git a/test/community.test.js b/test/community.test.js
iindex 69c942f..81f35bd 100644
---- a/test/community.test.js
++++ b/test/community.test.js
@@@ -94,19 +94,27 @@ run([
      ['shared comment threads support resolving, ordered paging, replies and edits', async () => {
          const srv = await echo();
          const community = createCommunityClient(createClient({ baseUrls: { community: srv.url } }));
++        const ref = { service: 'community', type: 'paste', id: 'paste-42' };
          await community.comments.resolve({ service: 'live', type: 'vod', id: '42' });
++        await community.comments.upload(ref, new Blob(['picture'], { type: 'image/png' }), { filename: 'look.png' });
          await community.comments.get('cth_test', { sort: 'new', limit: 2 });
          await community.comments.get('cth_test', { parent: 7, after: 12, limit: 50 });
          await community.comments.create('cth_test', { message: 'reply', parent_id: 7 });
          await community.comments.edit(8, { message: 'edited' });
          assert.deepEqual(srv.requests.map((r) => `${r.method} ${r.url}`), [
              'POST /api/v1/comments/threads/resolve',
++            'POST /api/v1/comments/attachments',
              'GET /api/v1/comments/threads/cth_test?sort=new&limit=2',
              'GET /api/v1/comments/threads/cth_test?parent=7&after=12&limit=50',
              'POST /api/v1/comments/threads/cth_test/comments',
              'PATCH /api/v1/comments/8',
          ]);
--        assert.deepEqual(JSON.parse(srv.requests[3].body), { message: 'reply', parent_id: 7 });
++        const upload = srv.requests[1];
++        assert.match(upload.headers['content-type'], /^multipart\/form-data/);
++        assert.match(upload.body.toString('latin1'), /name="ref"/);
++        assert.match(upload.body.toString('latin1'), /community.*paste-42/);
++        assert.match(upload.body.toString('latin1'), /name="file"; filename="look.png"/);
++        assert.deepEqual(JSON.parse(srv.requests[4].body), { message: 'reply', parent_id: 7 });
          await srv.close();
      }],
  
ddiff --git a/types/community.d.ts b/types/community.d.ts
iindex 828bbed..5c74ab1 100644
---- a/types/community.d.ts
++++ b/types/community.d.ts
@@@ -1,4 +1,5 @@
  import type { OpenVibeClient, EntityRef } from './core';
++import type { AiFile } from './ai';
  
  export interface ActingOptions {
      /** usr_… or gst_… (services only). */
@@@ -10,12 +11,14 @@ export interface ActingOptions {
  export type CallOptions = ActingOptions & { signal?: AbortSignal };
  
  export interface CommentQuery { after?: string | number; sort?: 'old' | 'new'; limit?: number; parent?: string | number; }
--export interface Comment { id: number; thread_id: number | string; parent_id: number | null; message: string | null; reply_count?: number | null; replies?: Comment[]; [field: string]: unknown; }
++export type CommentAttachment = AiFile & { url?: string };
++export interface Comment { id: number; thread_id: number | string; parent_id: number | null; message: string | null; reply_count?: number | null; replies?: Comment[]; attachments?: CommentAttachment[]; [field: string]: unknown; }
  export interface CommentPage { thread: Record<string, unknown>; comments: Comment[]; next_cursor: string | null; viewer: Record<string, boolean>; }
  export interface CommentsApi {
      resolve(ref: EntityRef, opts?: CallOptions): Promise<{ thread: Record<string, unknown>; created: boolean }>;
      get(id: string, query?: CommentQuery, opts?: CallOptions): Promise<CommentPage>;
--    create(id: string, input: { message: string; parent_id?: number | string | null; anon_name?: string }, opts?: CallOptions): Promise<{ comment: Comment }>;
++    upload(ref: EntityRef, file: Blob | ArrayBuffer | ArrayBufferView, opts?: CallOptions & { filename?: string; mediaType?: string }): Promise<{ attachment: CommentAttachment }>;
++    create(id: string, input: { message: string; parent_id?: number | string | null; anon_name?: string; attachments?: CommentAttachment[] }, opts?: CallOptions): Promise<{ comment: Comment }>;
      edit(commentId: number | string, input: { message: string }, opts?: CallOptions): Promise<{ comment: Comment }>;
      delete(commentId: number | string, opts?: CallOptions): Promise<{ ok: true; id: number }>;
      visibility(id: string, visibility: 'public' | 'hidden' | 'locked', opts?: CallOptions): Promise<{ thread: Record<string, unknown> }>;