Commits

main

tools/asyncify: the codemod that converted Wiki and Blog from better-sqlite3 to openvibe-sdk/db (ADR-035, WS-X2). It works on syntax (acorn). It awaits prepared statements, Publishing store calls and module API methods that became async, makes the enclosing functions async, and repeats across files to a fixpoint. It never awaits a promise used as a value, and it reports calls inside array callbacks for a hand fix instead of breaking them. There is also the earlier regex pass for tests and an example config. Not part of the published package.OpenVibers · 28 Sept 2026 76579d8
0.19.0: runSqliteMigration in openvibe-sdk/db, a service's scripts/migrate-to-postgres.js in one call. It migrates as the owner (or into PGlite with --pglite for a rehearsal) and imports into emptied tables. It makes text PostgreSQL refuses storable: a NUL is dropped and an unpaired surrogate becomes U+FFFD, in text and inside JSON, and every column where that happened is reported. It verifies counts and checksums, prints the report (--json for all of it), and answers 0 only when everything verified. Generalised from Tips' script; Wiki's is a few lines around it. test/sqlite-cli.test.js; 41/41 test files with the containers.OpenVibers · 28 Sept 2026 0a4b221
0.18.1. db.prepare: a statement with one parameter takes a single array argument as its value (WHERE id = ANY(?)); only statements with several parameters read one array as the list of values. Found converting OpenVibe.Wiki. openvibe-sdk/testing gains createTestDb({ migrations, store, service }): a migrated PGlite database, or on the containers roles and a schema of its own, shaped as the host's add-service.sh makes them. Setup and teardown take an advisory lock, so parallel runs never race on the catalog ("tuple concurrently updated", found in Wiki's tests). Also createTestValkey. Services drop their copied helpers. 40/40 test files with the containers.OpenVibers · 28 Sept 2026 1b59c3b
0.18.0: moving a service off better-sqlite3 becomes mostly mechanical. Ambient transactions (on by default): inside db.tx(fn), plain db calls, db.prepare statements and library stores handed db join the running transaction through AsyncLocalStorage; a db.tx inside is a savepoint; a promise the transaction did not await runs on the pool afterwards; db.detached(fn) leaves on purpose; db.inTransaction() tells. db.prepare(text) gives async better-sqlite3-shaped statements (get, all, run with changes, rows and lastInsertRowid from RETURNING, pluck) with ? and @name/:name parameters compiled to $n, leaving strings, identifiers, dollar quotes, comments and :: casts alone. importSqlite verification treats JSON null and SQL NULL as equal (found in the Tips migration). The migration guide gains the short path and the Tips lessons. test/db-ambient.test.js passes on PGlite and through PgBouncer; 39/39 test files.OpenVibers · 28 Sept 2026 4762731
esm/index.mjs regenerated for the root export's geo and openre (0.17.0 left it out).OpenVibers · 28 Sept 2026 cb261b8
0.17.0: openvibe-sdk/geo, the nearest OpenVibe node (roadmap WS-X1 task 5, ADR-034 §12). It works in the browser and on the server. nodes({ role, region }) reads Network's public node registry (GET /api/v1/nodes, network.node-list-result@1) without a token. measure(nodes) times each beacon several times and keeps the best sample, because the first also pays for DNS and TLS; results come fastest first. nearest() returns the fastest measured node that is up or degraded; when nothing can be measured it falls back to preferRegion and then to the first healthy node, and says measured: false. Game-server lists, ping tools and ingest pick use it. geo is in the root export and the browser bundle, and openre is in the root export.OpenVibers · 28 Sept 2026 922eba6
0.16.0: openvibe-sdk/openre, the client for OpenRe.Stream, the platform's streaming engine. It covers streams (byExternalRef, create, get, update, delete, keys, rotateKey, destinations, addDestination), destinations (update, delete, test, start, stop, logs), sessions (list, get, playback cached 10 s, end, outputs), outputLogs, workers and manageUrl. Every call uses a service token for openvibe.openre, and { subject } acts for a person (X-OV-Subject). A missing stream or session is null; refusals are OpenVibeError. It is server-only (browser: null) and exported for CJS, ESM and types. Products stop carrying their own copy, starting with OpenVibe.Live.OpenVibers · 28 Sept 2026 fbc8893
SDK docs: moving a service from SQLite to PostgreSQL and Valkey (ADR-035), the procedure every migration follows: dependencies; the schema as migrations with a SQLite-to-PostgreSQL type table (epoch-ms integers stay bigint so APIs keep their numbers, 0/1 becomes boolean, JSON text jsonb, CURRENT_TIMESTAMP timestamptz); the code idioms (prepare/get/all/run/transaction to the async layer, OR IGNORE/OR REPLACE to ON CONFLICT, LIKE to ILIKE, OFFSET to keyset, loops to ANY/batched inserts); the pooler's rules; serializable money paths; readiness and boot; per-process state to Valkey (limits, caches, fan-out, once-only jobs to queues or leases); tests on PGlite with query-count, migration and import checks; the rehearsed import and the production switch with its 7-day rollback file; and the evidence each migration records. Published with the package (files: docs/).OpenVibers · 28 Sept 2026 83b9a6f
SDK 0.15.0: the event outbox and inbox on PostgreSQL (ADR-004 on ADR-035), in openvibe-sdk/events. createPgOutbox(db, { events }) takes an openvibe-sdk/db handle. enqueue(t, envelope) requires the transaction handle, so the event exists if and only if the change commits. The relay claims due rows with a lease (FOR UPDATE SKIP LOCKED), so any number of processes and hosts relay one table without sending an event twice, and a dead relay's rows return after the lease. Backoff, per-row permanent refusals, the kept seq, pending, rejected and prune are as before. createPgInbox(db).once(consumer, eventId, async (t) => …) runs a handler once in one transaction with its receipt; a failed handler leaves none. outboxSchema() and inboxSchema() give the DDL for service migrations. The SQLite versions stay for services not yet moved. The db slow-query log is off by default on PGlite (its first query includes the WASM start). test/pg-outbox.test.js runs on PGlite and through PgBouncer, where three relays sharing one table send 60 events with none twice. npm test 36/36 with the containers.OpenVibers · 28 Sept 2026 dc4e1be
SDK 0.14.0: the async data layer and the Valkey modules (ADR-035 and its amendment; roadmap WS-X2). openvibe-sdk/db: createDb({ url | pglite, service }) with query, many, maybe, one, value and exec on a safe sql tagged template (every value a bind parameter, nesting fragments, sql.ident/set/insert/join/json); tx(fn, { isolation, retries }) retrying 40001 and 40P01, with nested savepoints; ready() reporting the store that answered; query-time histogram, pool gauges and a slow-query log without values. node-postgres through PgBouncer in production and PGlite (real PostgreSQL in-process) in tests return identical rows: int8 as Number (refused past 2^53), timestamps as ISO strings, dates as YYYY-MM-DD, numeric as exact text, json parsed. db.migrate runs numbered expand/migrate/contract SQL files once, with checksums (edits refused), order kept, an advisory lock, contract migrations held until their expand is 7 days old, and -- no-transaction. importSqlite moves a service's SQLite file into its schema: parents first, conversion by target type, identities kept and sequences advanced, lost columns refused unless dropped, streamed verification of counts and checksums. openvibe-sdk/valkey (auto-pipelined, prefix-confined), cache (cross-process single-flight, tags), queue (at-least-once on streams: retries with backoff, dead letters, delays, dedupe, reclaim of hung workers' jobs), pubsub, and createValkeyLimitStore for limits shared by every process (in-process counting if Valkey fails); each has an in-process twin. Drivers are optional peers loaded on use. scripts/test-services.sh starts PostgreSQL 18 + PgBouncer (transaction, SCRAM) + Valkey 9 containers; CI runs the suite against them. npm test: 35/35 with the containers (the same db cases pass on PGlite and through PgBouncer; 8 concurrent serializable increments all land), 33/35 with 2 skipped without them.OpenVibers · 28 Sept 2026 1a93eeb
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7, the rule of openvibe-shared/test-runner). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. A test now prints "<label>: skipped (<why>)" for what it could not run, and the runner lists that file with ○ and its reasons and does not count it as passed: the summary reads "32/33 test files passed, 1 skipped (…)", and only a run with nothing skipped says N/N; --strict (or OV_TEST_STRICT=1) makes a skip fail the run. The SDK does not depend on openvibe-shared, so the runner keeps its own loop (one file at a time, 120 s timeout) with SKIP_RE and skipsIn copied from the module. types.test.js printed "skipped: no openvibe-contracts checkout next to this repository" when it had no contract types to compare with and now prints "copied contract types: skipped (…)". npm test (Node 22) 33/33.OpenVibers · 28 Sept 2026 adda89e
v0.13.0: deliveries are v2 only, as OpenVibe.Events sends them since 2026-09-28 (shim C-60). signDeliveryHeaders returns X-OpenVibe-Timestamp and X-OpenVibe-Signature-V2 only, and the mock platform's deliverEvents sends no v1 header. signDelivery and verifyDelivery stay for testing a legacy receiver; parseDelivery still accepts v1-only unless requireV2, which every production consumer sets. Tests: the header set, the mock's delivery, and a valid v1 never rescuing a bad v2. npm test 33/33.OpenVibers · 28 Sept 2026 1f70fe4
README and STATUS.json are current (roadmap WS-U task 3): the README gains Purpose, Capabilities (none held; clients call with the app's token, so the app needs the grant), Acceptance (what the test files prove), Security (SECURITY.md, no secrets in browser files, retries, webhook v2, the Frame's origins), Deploy (a tag that services and apps pin), Does not own and Depends on sections. Stale facts corrected: the status line and install line name v0.12.0 (was v0.6.0 untagged and v0.5.0), the old per-service pin list and CI history are gone, the copied contract types come from Contracts v0.49.0, and Chat is wrapped over REST since v0.11.0. STATUS.json names version 0.12.0, gains deployed false, contracts and features, and is updated 2026-09-28.OpenVibers · 28 Sept 2026 5abe851
v0.12.0: openvibe-sdk/limits (roadmap WS-R task 4). createActorLimiter({ limits: { minute, hour, day } }) gives limits(name, ownLimits), Express middleware counting each actor in fixed windows at a capability boundary: the verified principal (svc:live, app:…), else the signed-in person (user:<subject>), else ip:<address>; actor(req) overrides, null skips. Past a limit it answers 429 problem+json rate_limited with Retry-After from the tightest exceeded window, before the route runs. A route's limits replace the defaults window by window; counters are per process and bounded (maxActors); onLimited observes refusals. Node only (browser: null), ESM and types. test/limits.test.js; browser-entries and pack tests list the new subpath. npm test 33/33.OpenVibers · 28 Sept 2026 0a4909d
Pins: openvibe-contracts 0.44.0 → 0.49.0OpenVibers · 25 Sept 2026 f3bd712
CI on the shared test and security workflows (WS-Q task 1, OpenVibe.Shared 66b76f8): install, node --check, tests, contract and pin-drift checks from one definition; this repository's own steps kept as inputs and extra stepsOpenVibers · 25 Sept 2026 e090ae9
v0.11.0: openvibe-sdk/chat (global chat, rooms and DMs over REST as the token's person; writes never retried) and openvibe-sdk/ai (runs create/get/list/cancel/retry/citations, waitFor, and the direct ai.<op> operations; a create is retried only with an idempotency key) — WS-F task 4OpenVibers · 25 Sept 2026 a4aae65
v0.10.0: openvibe-sdk/search (WS-F task 4): OpenVibe.Search's query API — query with owner/type/lang/facet filters and facet counts, iterate across cursor pages, suggest, document by id (null when missing or not visible), actingSubject for services with search.query.delegate; in the browser bundle, ESM and typesOpenVibers · 25 Sept 2026 01851f1
Pins: openvibe-contracts (devDependency) 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit); types/contracts.d.ts header names v0.44.0 (the copied blocks are unchanged)OpenVibers · 25 Sept 2026 34c0a3c
Pins: openvibe-contracts (devDependency) 0.33.0 → 0.42.0; types/contracts.d.ts re-copied from Contracts 0.42.0 (service manifest internalOrigin/exposure/site, module namespace readers/migrations, tools.tool 1.1.0 keywords/examples and the tools doc comments); CI runs the pin-drift checkOpenVibers · 25 Sept 2026 03d7e92
v0.9.1: SDK_VERSION and the browser bundle match the release (v0.9.0 reported 0.8.0); same API as 0.9.0OpenVibers · 24 Sept 2026 5ffc87a
v0.9.0: openvibe-sdk/auth createRevocationStore — per-person token cutoffs from network.user.token_valid_after (Contracts 0.39.0): apply(event), isRevoked(claims) with Network's rule iat * 1000 < valid_after, only forward, source network only; SQLite-backed or in memoryOpenVibers · 24 Sept 2026 5d9576f
The Frame rename, completed: the renamed files carry their new names inside (the previous commit staged them before the edit)OpenVibers · 24 Sept 2026 6c05a88
The OpenVibe Frame: openvibe-sdk/chrome is now openvibe-sdk/frame (mountFrame, frameTags, frameConfig) — the navbar, footer and themes every OpenVibe site sits in; 'chrome' was borrowed UI jargon easily mistaken for the browser. Not yet tagged, so no aliasOpenVibers · 24 Sept 2026 9ea504e
0.8.0: openvibe-sdk/chrome, the network's shared chrome for any app: mountChrome() loads and mounts the universal navbar (account menu, notifications, site switcher, sign in/out through the app's own sessionUrl/loginUrl/logoutUrl), the shared footer (network and legal links, 'shipped X ago', Updates) and themes from openvibe.network; chromeTags() gives server-rendered pages the same markup with the config escaped; never throws for a network failure; https bases onlyOpenVibers · 24 Sept 2026 4ecf0f4
0.7.0: openvibe-sdk/vip, the VIP consumer seam (createVipClient, createVipCache) published once instead of the copies of openvibe-vip/client in Chat, Community and Blog; server-only; fail-closed, one token retry, cache convergence on vip.membership.changed and Billing's entitlement events. Types, ESM entry, README row, CHANGELOG; test/vip.test.jsOpenVibers · 24 Sept 2026 483e93f
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026 11469f9
0.6.0: openvibe-sdk/tools (the Tools registry and run API) and jobs retry/references; README Tools section, CHANGELOGOpenVibers · 23 Sept 2026 a22927b
openvibe-sdk/tools: the Tools platform API client (registry, run API) and jobs retry/references, tested against a contract-checked stand-inOpenVibers · 23 Sept 2026 03e55f2
0.5.0: Media object API v2 client (createObjectsClient in openvibe-sdk/media)OpenVibers · 23 Sept 2026 7d3eff3

More commits