openvibe-sdk 0.153.0: turn a stored picture a quarter (#231)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex ad4dc99..da13c27 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,11 @@
  # Changelog
  
++## 0.153.0 — 2026-11-11
++
++- Add `objects.rotate(id, { degrees })` to `openvibe-sdk/media` (the v2 object client): turn a stored JPEG, PNG or WebP
++  picture clockwise by 90, 180 or 270 degrees. Media keeps the uploader's original beside the turned copy, every
++  generated size follows, and only the picture's owner may turn it (`subject` / `actingUserId` on a service client).
++
  ## 0.152.0 — 2026-11-11
  
  A train of two pull requests: `openvibe-sdk/elements` (#227) and `openvibe-sdk/ui-layout` (#226).
ddiff --git a/README.md b/README.md
iindex 34f1cc5..b20bfd5 100644
---- a/README.md
++++ b/README.md
@@@ -8,12 +8,12 @@
  **Install and test:** `npm ci && npm test` (Node 20 or newer)
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.152.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.153.0
  ```
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.152.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.153.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -22,7 +22,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.152.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.153.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
ddiff --git a/STATUS.json b/STATUS.json
iindex e09699d..e574a1d 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.152.0",
++  "version": "0.153.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 5fa479e..d2a30d0 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.152.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.153.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, trust, levels, modules, realtime, media, composer, cam, mediaUpload, ui, uiLayout, community, homeFeed, feed, bot, search, bench, meme, vision, themes, elements, design, redact, chat, ai, credentials, jobs, agents, tools, projects, geo, history, userCard, player, agentSheet). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -66,7 +66,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.152.0';
++const SDK_VERSION = '0.153.0';
  
  module.exports = {
      createClient,
@@@ -3285,6 +3285,14 @@ function createObjectsClient({
       */
      const signedUrl = (id, { ttl } = {}) => json({ path: `${O}/${enc(id)}/download`, query: { format: 'json', ttl } });
  
++    /**
++     * rotate(id, { degrees }) -> the object with its new `rotation`.
++     * Turn a stored JPEG, PNG or WebP picture clockwise by 90, 180 or 270 degrees. Only the picture's owner may
++     * (pass `subject` or `actingUserId` when the client's credential is a service); Media keeps the uploader's
++     * original beside the turned copy and records the turn in the object's metadata.
++     */
++    const rotate = (id, { degrees = 90 } = {}) => json({ method: 'POST', path: `${O}/${enc(id)}/rotate`, json: { degrees } });
++
      /** Soft delete. true when deleted (or already), false when there is no such object. */
      async function del(id) {
          try { await call({ method: 'DELETE', path: `${O}/${enc(id)}` }); return true; } catch (err) {
@@@ -3335,7 +3343,7 @@ function createObjectsClient({
          },
      };
  
--    return { app, baseUrl: resolveBase, upload, resume, get, signedUrl, delete: del, list, iterate, jobs, client: http };
++    return { app, baseUrl: resolveBase, upload, resume, get, signedUrl, rotate, delete: del, list, iterate, jobs, client: http };
  }
  
  module.exports = { createObjectsClient };
ddiff --git a/package-lock.json b/package-lock.json
iindex 9757dce..c3e4a6a 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.152.0",
++  "version": "0.153.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.152.0",
++      "version": "0.153.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex 0a92ea0..b51a3d6 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.152.0",
++  "version": "0.153.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/core/index.js b/src/core/index.js
iindex f32a040..74559e2 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.152.0';
++const SDK_VERSION = '0.153.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/objects.js b/src/objects.js
iindex 3c8eb90..4529a5d 100644
---- a/src/objects.js
++++ b/src/objects.js
@@@ -261,6 +261,14 @@ function createObjectsClient({
       */
      const signedUrl = (id, { ttl } = {}) => json({ path: `${O}/${enc(id)}/download`, query: { format: 'json', ttl } });
  
++    /**
++     * rotate(id, { degrees }) -> the object with its new `rotation`.
++     * Turn a stored JPEG, PNG or WebP picture clockwise by 90, 180 or 270 degrees. Only the picture's owner may
++     * (pass `subject` or `actingUserId` when the client's credential is a service); Media keeps the uploader's
++     * original beside the turned copy and records the turn in the object's metadata.
++     */
++    const rotate = (id, { degrees = 90 } = {}) => json({ method: 'POST', path: `${O}/${enc(id)}/rotate`, json: { degrees } });
++
      /** Soft delete. true when deleted (or already), false when there is no such object. */
      async function del(id) {
          try { await call({ method: 'DELETE', path: `${O}/${enc(id)}` }); return true; } catch (err) {
@@@ -311,7 +319,7 @@ function createObjectsClient({
          },
      };
  
--    return { app, baseUrl: resolveBase, upload, resume, get, signedUrl, delete: del, list, iterate, jobs, client: http };
++    return { app, baseUrl: resolveBase, upload, resume, get, signedUrl, rotate, delete: del, list, iterate, jobs, client: http };
  }
  
  module.exports = { createObjectsClient };
ddiff --git a/test/objects.test.js b/test/objects.test.js
iindex 0696a5b..c5e1b48 100644
---- a/test/objects.test.js
++++ b/test/objects.test.js
@@@ -112,6 +112,13 @@ async function mockMedia({ singleMax = 1024 * 1024, failPart = null, descriptor
              }
          }
          if (!authed) return problem(res, 401, 'token.missing', 'no');
++        if (rest === 'rotate' && req.method === 'POST') {
++            const b = JSON.parse(body || '{}');
++            if (![90, 180, 270].includes(Number(b.degrees))) return problem(res, 422, 'media.rotate.invalid', 'a turn is 90, 180 or 270 degrees');
++            obj.rotation = ((obj.rotation || 0) + Number(b.degrees)) % 360;
++            obj.rotatedBy = req.headers['x-ov-subject'] || null;
++            return send(res, 200, { ...pub(obj), rotation: obj.rotation });
++        }
          if (rest === 'download') return send(res, 200, { url: `${base}/o/${id}?exp=1&sig=s&ttl=${u.searchParams.get('ttl')}`, expires_at: '2030-01-01T00:00:00.000Z', public: false, format: u.searchParams.get('format') });
          if (req.method === 'GET' && !rest) return send(res, 200, pub(obj));
          if (req.method === 'DELETE' && !rest) { obj.lifecycle_status = 'deleted'; return send(res, 200, pub(obj)); }
@@@ -286,6 +293,8 @@ run([
          const all = [];
          for await (const o of objects.iterate({ limit: 2 })) all.push(o.id);
          assert.equal(all.length, 3);
++        const turned = await objects.rotate(a.id, { degrees: 90 });
++        assert.deepEqual([turned.rotation, m.state.objects.get(a.id).rotation], [90, 90], 'a quarter turn reaches Media and its answer comes back');
          assert.equal(await objects.delete(a.id), true);
          assert.equal(await objects.delete('med_missing'), false);
          assert.ok(m.srv.requests.filter((r) => r.headers.authorization).every((r) => r.headers['x-ov-user-id'] === '7'), 'X-OV-User-Id on every credentialed call');
ddiff --git a/types/media.d.ts b/types/media.d.ts
iindex 8e9f0f0..9fb1855 100644
---- a/types/media.d.ts
++++ b/types/media.d.ts
@@@ -139,6 +139,8 @@ export interface ObjectsClient {
      resume(ref: ObjectUploadRef, data: UploadBody, opts?: { signal?: AbortSignal; onProgress?: ObjectUploadOptions['onProgress']; contentHash?: string | false }): Promise<MediaObject>;
      get(id: string): Promise<MediaObject | null>;
      signedUrl(id: string, opts?: { ttl?: number }): Promise<{ url: string; expires_at: string | null; public: boolean }>;
++    /** Turn a stored picture clockwise; only its owner may (subject / actingUserId). */
++    rotate(id: string, opts?: { degrees?: 90 | 180 | 270 }): Promise<MediaObject & { rotation: number }>;
      delete(id: string): Promise<boolean>;
      list(opts?: { kind?: string; visibility?: string; status?: string; owner?: string; userId?: number; limit?: number; cursor?: string; includeDeleted?: boolean }): Promise<{ objects: MediaObject[]; next_cursor: string | null; limit: number }>;
      iterate(opts?: { kind?: string; visibility?: string; status?: string; owner?: string; userId?: number; limit?: number; includeDeleted?: boolean }): AsyncGenerator<MediaObject, void, unknown>;