openvibers/openvibe.sources Commits

Pin openvibe-contracts v0.96.0 and close the capability shim (#5)

OP OpenVibers committed 5 Oct 2026 · 9747246a20 · 11 files, +56 −508

* Pin openvibe-contracts v0.96.0 and close the capability shim

**Files changed**
- `STATUS.json:10` — `contracts` now `openvibe-contracts v0.96.0` (was v0.76.0); `updated` moved to 2026-10-04.
- `README.md:128` — the API section's contract line said `v0.76.0 (this repo pins v0.49.0)` (both stale): now names the release the capability ids shipped in (`v0.12.0`, matching the two other README lines) and the actual pin `v0.96.0`.
- `server/auth.js` — the header claimed the `sources.*` capabilities "are not in openvibe-contracts v0.7.0 yet" and special-cased them via `PROPOSED`. They are released and listed in `manifests/services/sources.json`, so the transitional branch was dead; removed it (and the `PROPOSED` export) and `checkCapability` now delegates to `capabilities.check`, as the comment promised.
- `docs/capabilities-proposal/sources.source.read.json` — `outputSchema` → released `sources.source-read-result@1`, added `inputSchema: common.no-body@1` (matches the released manifest).
- `docs/capabilities-proposal/sources.item.read.json` — `outputSchema` → released `sources.item-read-result@1`, added `inputSchema: common.no-body@1`.
- `docs/capabilities-proposal/sources.source.manage.json` — added `inputSchema: sources.source-write-request@1` / `outputSchema: sources.source-manage-result@1`. All three are now byte-identical to the released `manifests/capabilities/*.json`.
- `docs/contracts-proposal/README.md` — "asks … Files to add in its next release" → the proposal shipped and the directory is kept in step with the released contracts.
- `test/proposals.test.js` — new test that each capability proposal mirrors the released manifest (schema ids, permissions, events, routes) using `contracts.capabilities.get`; extended the API-views test to validate every route's request/response against the released `sources.source-write-request@1`, `sources.source-read-result@1`, `sources.item-read-result@1` and `sources.source-manage-result@1` contracts.

Not changed (per instructions): `package.json`, `package-lock.json` — left as the setup's v0.96.0 pin.

**Tests run**
- `ov test --all` → **13 passed** in 94 s (all files, Node 22.23.3).
- `ov test proposals auth` → 2 passed in 102 s (focused re-run after the edits).
- `node --check server/auth.js` / `node --check test/proposals.test.js` → clean.
- `node openvibe-contracts/bin/check-service.js --service sources --src .` → ok (contracts 0.96.0).

**Could not do**
- `npm run test:pg` was not run: it needs the PostgreSQL/PgBouncer + Valkey containers (`openvibe-sdk/scripts/test-services.sh up`), which aren't part of this sandbox. `ov test --all` exercises the same 13 files on PGlite. No packages were installed, and nothing was committed or pushed.

* Stop tracking the node_modules link and ignore it as a link too

Changes

ddiff --git a/.gitignore b/.gitignore
iindex 4c6243c..8dd0b68 100644
---- a/.gitignore
++++ b/.gitignore
@@@ -7,3 +7,4 @@ dist/
  *.log
  *.pem
  *.key
++node_modules
ddiff --git a/README.md b/README.md
iindex 0cf662f..4165467 100644
---- a/README.md
++++ b/README.md
@@@ -125,7 +125,7 @@ Callers use an OpenVibe.Network client-credentials token for audience `openvibe.
  `GET /api/v1/items` pages in change order (creations, revisions and — with `include_removed=1` —
  removals); resume from `next_after`. Every page carries the status and staleness of the sources
  it contains. The capability ids (first proposed in [docs/capabilities-proposal/](docs/capabilities-proposal/))
--are released in `openvibe-contracts` v0.76.0 (this repo pins v0.49.0); [server/auth.js](server/auth.js)
++are released in `openvibe-contracts` v0.12.0 (this repo pins v0.96.0); [server/auth.js](server/auth.js)
  decides them with the contracts grant rule.
  
  ### Per-actor limits
ddiff --git a/STATUS.json b/STATUS.json
iindex 5391400..6c7e477 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -7,7 +7,7 @@
    "runtime": "node 22, express, PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9, fast-xml-parser",
    "port": 4720,
    "domain": "sources.openvibe.network (vhost in deploy/nginx: an internal-service page, health and JSON 404s; the API is loopback-only; README \"Public host\")",
--  "contracts": "openvibe-contracts v0.76.0",
++  "contracts": "openvibe-contracts v0.96.0",
    "capabilities": [
      "sources.source.read",
      "sources.item.read",
@@@ -42,5 +42,5 @@
      "staff-only index documents for Search",
      "per-actor limits (openvibe-sdk/limits)"
    ],
--  "updated": "2026-09-28"
++  "updated": "2026-10-04"
  }
ddiff --git a/docs/capabilities-proposal/sources.item.read.json b/docs/capabilities-proposal/sources.item.read.json
iindex ef1c497..fa70eee 100644
---- a/docs/capabilities-proposal/sources.item.read.json
++++ b/docs/capabilities-proposal/sources.item.read.json
@@@ -5,7 +5,7 @@
    "status": "active",
    "visibility": "first-party",
    "description": "Read source items with provenance (source, canonical URL, retrieval time, content and raw-body hashes, parser version, terms) in change order, and one item with its revisions. Each page states the staleness of the sources it contains.",
--  "outputSchema": "sources.item@1",
++  "outputSchema": "sources.item-read-result@1",
    "permissions": [
      "sources:read"
    ],
@@@ -17,5 +17,6 @@
    "implementedBy": [
      "GET /api/v1/items",
      "GET /api/v1/items/:id"
--  ]
++  ],
++  "inputSchema": "common.no-body@1"
  }
ddiff --git a/docs/capabilities-proposal/sources.source.manage.json b/docs/capabilities-proposal/sources.source.manage.json
iindex 0f2c092..0bb4825 100644
---- a/docs/capabilities-proposal/sources.source.manage.json
++++ b/docs/capabilities-proposal/sources.source.manage.json
@@@ -24,5 +24,7 @@
      "POST /api/v1/sources/:key/fetch",
      "POST /api/v1/sources/:key/items",
      "DELETE /api/v1/items/:id"
--  ]
++  ],
++  "inputSchema": "sources.source-write-request@1",
++  "outputSchema": "sources.source-manage-result@1"
  }
ddiff --git a/docs/capabilities-proposal/sources.source.read.json b/docs/capabilities-proposal/sources.source.read.json
iindex f6c7b54..09b223e 100644
---- a/docs/capabilities-proposal/sources.source.read.json
++++ b/docs/capabilities-proposal/sources.source.read.json
@@@ -5,7 +5,7 @@
    "status": "active",
    "visibility": "first-party",
    "description": "List registered sources with health and staleness, their fetch runs (every attempt with an explicit state) and the health summary. Credential values are never part of any response; only the variable name is.",
--  "outputSchema": "sources.source@1",
++  "outputSchema": "sources.source-read-result@1",
    "permissions": [
      "sources:read"
    ],
@@@ -20,5 +20,6 @@
      "GET /api/v1/sources/:key/runs",
      "GET /api/v1/runs",
      "GET /api/v1/health"
--  ]
++  ],
++  "inputSchema": "common.no-body@1"
  }
ddiff --git a/docs/contracts-proposal/README.md b/docs/contracts-proposal/README.md
iindex 15187a5..a5743b1 100644
---- a/docs/contracts-proposal/README.md
++++ b/docs/contracts-proposal/README.md
@@@ -1,6 +1,9 @@
  # Proposal for OpenVibe.Contracts: `sources.source@1`, `sources.item@1`
  
--Wave 14 asks OpenVibe.Contracts for the source-adapter contract. Files to add in its next release:
++Wave 14 asked OpenVibe.Contracts for the source-adapter contract; it shipped, and this directory is
++kept in step with the released contracts (the capability manifests in
++[`../capabilities-proposal/`](../capabilities-proposal/) are copied verbatim from the released
++`manifests/capabilities/`). Files that went in:
  
  | File here | Goes to |
  |---|---|
ddiff --git a/package-lock.json b/package-lock.json
iindex 45fe1fd..ca3380e 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -12,7 +12,7 @@
          "dotenv": "^16.4.7",
          "express": "^4.21.2",
          "fast-xml-parser": "^4.5.3",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.96.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.5.0",
          "pg": "^8.23.0"
@@@ -85,65 +85,6 @@
        "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
        "license": "MIT"
      },
--    "node_modules/base64-js": {
--      "version": "1.5.1",
--      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
--      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
--      "funding": [
--        {
--          "type": "github",
--          "url": "https://github.com/sponsors/feross"
--        },
--        {
--          "type": "patreon",
--          "url": "https://www.patreon.com/feross"
--        },
--        {
--          "type": "consulting",
--          "url": "https://feross.org/support"
--        }
--      ],
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
--    "node_modules/better-sqlite3": {
--      "version": "11.10.0",
--      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-11.10.0.tgz",
--      "integrity": "sha512-EwhOpyXiOEL/lKzHz9AW1msWFNzGc/z+LzeB3/jnFJpxu+th2yqvzsSWas1v9jgs9+xiXJcD5A8CJxAG2TaghQ==",
--      "hasInstallScript": true,
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "bindings": "^1.5.0",
--        "prebuild-install": "^7.1.1"
--      }
--    },
--    "node_modules/bindings": {
--      "version": "1.5.0",
--      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
--      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "file-uri-to-path": "1.0.0"
--      }
--    },
--    "node_modules/bl": {
--      "version": "4.1.0",
--      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
--      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "buffer": "^5.5.0",
--        "inherits": "^2.0.4",
--        "readable-stream": "^3.4.0"
--      }
--    },
      "node_modules/body-parser": {
        "version": "1.20.8",
        "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.8.tgz",
@@@ -168,32 +109,6 @@
          "npm": "1.2.8000 || >= 1.4.16"
        }
      },
--    "node_modules/buffer": {
--      "version": "5.7.1",
--      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
--      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
--      "funding": [
--        {
--          "type": "github",
--          "url": "https://github.com/sponsors/feross"
--        },
--        {
--          "type": "patreon",
--          "url": "https://www.patreon.com/feross"
--        },
--        {
--          "type": "consulting",
--          "url": "https://feross.org/support"
--        }
--      ],
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "base64-js": "^1.3.1",
--        "ieee754": "^1.1.13"
--      }
--    },
      "node_modules/buffer-equal-constant-time": {
        "version": "1.0.1",
        "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
@@@ -238,14 +153,6 @@
          "url": "https://github.com/sponsors/ljharb"
        }
      },
--    "node_modules/chownr": {
--      "version": "1.1.4",
--      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
--      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
--      "license": "ISC",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/content-disposition": {
        "version": "0.5.4",
        "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
@@@ -291,34 +198,6 @@
          "ms": "2.0.0"
        }
      },
--    "node_modules/decompress-response": {
--      "version": "6.0.0",
--      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
--      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "mimic-response": "^3.1.0"
--      },
--      "engines": {
--        "node": ">=10"
--      },
--      "funding": {
--        "url": "https://github.com/sponsors/sindresorhus"
--      }
--    },
--    "node_modules/deep-extend": {
--      "version": "0.6.0",
--      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
--      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "engines": {
--        "node": ">=4.0.0"
--      }
--    },
      "node_modules/depd": {
        "version": "2.0.0",
        "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
@@@ -338,17 +217,6 @@
          "npm": "1.2.8000 || >= 1.4.16"
        }
      },
--    "node_modules/detect-libc": {
--      "version": "2.1.2",
--      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
--      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
--      "license": "Apache-2.0",
--      "optional": true,
--      "peer": true,
--      "engines": {
--        "node": ">=8"
--      }
--    },
      "node_modules/dotenv": {
        "version": "16.6.1",
        "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
@@@ -399,17 +267,6 @@
          "node": ">= 0.8"
        }
      },
--    "node_modules/end-of-stream": {
--      "version": "1.4.5",
--      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
--      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "once": "^1.4.0"
--      }
--    },
      "node_modules/es-define-property": {
        "version": "1.0.1",
        "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
@@@ -455,17 +312,6 @@
          "node": ">= 0.6"
        }
      },
--    "node_modules/expand-template": {
--      "version": "2.0.3",
--      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
--      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
--      "license": "(MIT OR WTFPL)",
--      "optional": true,
--      "peer": true,
--      "engines": {
--        "node": ">=6"
--      }
--    },
      "node_modules/express": {
        "version": "4.22.3",
        "resolved": "https://registry.npmjs.org/express/-/express-4.22.3.tgz",
@@@ -552,14 +398,6 @@
          "fxparser": "src/cli/cli.js"
        }
      },
--    "node_modules/file-uri-to-path": {
--      "version": "1.0.0",
--      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
--      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/finalhandler": {
        "version": "1.3.2",
        "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
@@@ -596,14 +434,6 @@
          "node": ">= 0.6"
        }
      },
--    "node_modules/fs-constants": {
--      "version": "1.0.0",
--      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
--      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/function-bind": {
        "version": "1.1.2",
        "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
@@@ -650,14 +480,6 @@
          "node": ">= 0.4"
        }
      },
--    "node_modules/github-from-package": {
--      "version": "0.0.0",
--      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
--      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/gopd": {
        "version": "1.2.0",
        "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
@@@ -726,42 +548,12 @@
          "node": ">=0.10.0"
        }
      },
--    "node_modules/ieee754": {
--      "version": "1.2.1",
--      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
--      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
--      "funding": [
--        {
--          "type": "github",
--          "url": "https://github.com/sponsors/feross"
--        },
--        {
--          "type": "patreon",
--          "url": "https://www.patreon.com/feross"
--        },
--        {
--          "type": "consulting",
--          "url": "https://feross.org/support"
--        }
--      ],
--      "license": "BSD-3-Clause",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/inherits": {
        "version": "2.0.4",
        "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
        "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
        "license": "ISC"
      },
--    "node_modules/ini": {
--      "version": "1.3.8",
--      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
--      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
--      "license": "ISC",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/ipaddr.js": {
        "version": "1.9.1",
        "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
@@@ -937,53 +729,12 @@
          "node": ">= 0.6"
        }
      },
--    "node_modules/mimic-response": {
--      "version": "3.1.0",
--      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
--      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "engines": {
--        "node": ">=10"
--      },
--      "funding": {
--        "url": "https://github.com/sponsors/sindresorhus"
--      }
--    },
--    "node_modules/minimist": {
--      "version": "1.2.8",
--      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
--      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "funding": {
--        "url": "https://github.com/sponsors/ljharb"
--      }
--    },
--    "node_modules/mkdirp-classic": {
--      "version": "0.5.3",
--      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
--      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/ms": {
        "version": "2.0.0",
        "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
        "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
        "license": "MIT"
      },
--    "node_modules/napi-build-utils": {
--      "version": "2.0.0",
--      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
--      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/negotiator": {
        "version": "0.6.3",
        "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
@@@ -993,20 +744,6 @@
          "node": ">= 0.6"
        }
      },
--    "node_modules/node-abi": {
--      "version": "3.96.0",
--      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.96.0.tgz",
--      "integrity": "sha512-rebQ/lz7i0EkoLzUVSrKRzA69zMkwLp95kKMWoMDkkM00Suxz0D7zEQPwRml5fQum24mj7bPvmlgLAmu2JCiYg==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "semver": "^7.3.5"
--      },
--      "engines": {
--        "node": ">=10"
--      }
--    },
      "node_modules/object-inspect": {
        "version": "1.13.4",
        "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
@@@ -1031,21 +768,10 @@
          "node": ">= 0.8"
        }
      },
--    "node_modules/once": {
--      "version": "1.4.0",
--      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
--      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
--      "license": "ISC",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "wrappy": "1"
--      }
--    },
      "node_modules/openvibe-contracts": {
--      "version": "0.76.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
--      "integrity": "sha512-zTdx776KWrcJKm1JTnf+0+BnsvswdvXy1ldPyse1hSqhnW/SSr98sX696eRetFUhTl8qVM1xSRCykqIUbqItPw==",
++      "version": "0.96.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.96.0",
++      "integrity": "sha512-QEXfNYNkK6n49sXokgbP2FTKaIEawRJOS7Xij9g20fBFSqiVv14voZ60LqECPl1VMZedoSGuYLa8doVlnSxH0w==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
@@@ -1242,35 +968,6 @@
          "node": ">=0.10.0"
        }
      },
--    "node_modules/prebuild-install": {
--      "version": "7.1.3",
--      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
--      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
--      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "detect-libc": "^2.0.0",
--        "expand-template": "^2.0.3",
--        "github-from-package": "0.0.0",
--        "minimist": "^1.2.3",
--        "mkdirp-classic": "^0.5.3",
--        "napi-build-utils": "^2.0.0",
--        "node-abi": "^3.3.0",
--        "pump": "^3.0.0",
--        "rc": "^1.2.7",
--        "simple-get": "^4.0.0",
--        "tar-fs": "^2.0.0",
--        "tunnel-agent": "^0.6.0"
--      },
--      "bin": {
--        "prebuild-install": "bin.js"
--      },
--      "engines": {
--        "node": ">=10"
--      }
--    },
      "node_modules/proxy-addr": {
        "version": "2.0.8",
        "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
@@@ -1288,18 +985,6 @@
          "url": "https://opencollective.com/express"
        }
      },
--    "node_modules/pump": {
--      "version": "3.0.4",
--      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
--      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "end-of-stream": "^1.1.0",
--        "once": "^1.3.1"
--      }
--    },
      "node_modules/qs": {
        "version": "6.16.0",
        "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
@@@ -1340,39 +1025,6 @@
          "node": ">= 0.8"
        }
      },
--    "node_modules/rc": {
--      "version": "1.2.8",
--      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
--      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
--      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "deep-extend": "^0.6.0",
--        "ini": "~1.3.0",
--        "minimist": "^1.2.0",
--        "strip-json-comments": "~2.0.1"
--      },
--      "bin": {
--        "rc": "cli.js"
--      }
--    },
--    "node_modules/readable-stream": {
--      "version": "3.6.2",
--      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
--      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "inherits": "^2.0.3",
--        "string_decoder": "^1.1.1",
--        "util-deprecate": "^1.0.1"
--      },
--      "engines": {
--        "node": ">= 6"
--      }
--    },
      "node_modules/require-from-string": {
        "version": "2.0.2",
        "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
@@@ -1543,55 +1195,6 @@
          "url": "https://github.com/sponsors/ljharb"
        }
      },
--    "node_modules/simple-concat": {
--      "version": "1.0.1",
--      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
--      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
--      "funding": [
--        {
--          "type": "github",
--          "url": "https://github.com/sponsors/feross"
--        },
--        {
--          "type": "patreon",
--          "url": "https://www.patreon.com/feross"
--        },
--        {
--          "type": "consulting",
--          "url": "https://feross.org/support"
--        }
--      ],
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
--    "node_modules/simple-get": {
--      "version": "4.0.1",
--      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
--      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
--      "funding": [
--        {
--          "type": "github",
--          "url": "https://github.com/sponsors/feross"
--        },
--        {
--          "type": "patreon",
--          "url": "https://www.patreon.com/feross"
--        },
--        {
--          "type": "consulting",
--          "url": "https://feross.org/support"
--        }
--      ],
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "decompress-response": "^6.0.0",
--        "once": "^1.3.1",
--        "simple-concat": "^1.0.0"
--      }
--    },
      "node_modules/split2": {
        "version": "4.2.0",
        "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
@@@ -1610,28 +1213,6 @@
          "node": ">= 0.8"
        }
      },
--    "node_modules/string_decoder": {
--      "version": "1.3.0",
--      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
--      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "safe-buffer": "~5.2.0"
--      }
--    },
--    "node_modules/strip-json-comments": {
--      "version": "2.0.1",
--      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
--      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "engines": {
--        "node": ">=0.10.0"
--      }
--    },
      "node_modules/strnum": {
        "version": "1.1.2",
        "resolved": "https://registry.npmjs.org/strnum/-/strnum-1.1.2.tgz",
@@@ -1644,38 +1225,6 @@
        ],
        "license": "MIT"
      },
--    "node_modules/tar-fs": {
--      "version": "2.1.5",
--      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.5.tgz",
--      "integrity": "sha512-OboTd8mmMhZDNPV+UjQcK9yKAatXu2aJ+r1w4im1Otd4M4fl2hwvdoXUxIYHFTHWK/3y3FarBP70v3vwmGlOxw==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "chownr": "^1.1.1",
--        "mkdirp-classic": "^0.5.2",
--        "pump": "^3.0.0",
--        "tar-stream": "^2.1.4"
--      }
--    },
--    "node_modules/tar-stream": {
--      "version": "2.2.0",
--      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
--      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "bl": "^4.0.3",
--        "end-of-stream": "^1.4.1",
--        "fs-constants": "^1.0.0",
--        "inherits": "^2.0.3",
--        "readable-stream": "^3.1.1"
--      },
--      "engines": {
--        "node": ">=6"
--      }
--    },
      "node_modules/toidentifier": {
        "version": "1.0.1",
        "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
@@@ -1685,20 +1234,6 @@
          "node": ">=0.6"
        }
      },
--    "node_modules/tunnel-agent": {
--      "version": "0.6.0",
--      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
--      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
--      "license": "Apache-2.0",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "safe-buffer": "^5.0.1"
--      },
--      "engines": {
--        "node": "*"
--      }
--    },
      "node_modules/type-is": {
        "version": "1.6.18",
        "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
@@@ -1721,14 +1256,6 @@
          "node": ">= 0.8"
        }
      },
--    "node_modules/util-deprecate": {
--      "version": "1.0.2",
--      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
--      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/utils-merge": {
        "version": "1.0.1",
        "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
@@@ -1747,14 +1274,6 @@
          "node": ">= 0.8"
        }
      },
--    "node_modules/wrappy": {
--      "version": "1.0.2",
--      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
--      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
--      "license": "ISC",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/xtend": {
        "version": "4.0.2",
        "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
ddiff --git a/package.json b/package.json
iindex b0019ad..5975a1d 100644
---- a/package.json
++++ b/package.json
@@@ -27,7 +27,7 @@
      "dotenv": "^16.4.7",
      "express": "^4.21.2",
      "fast-xml-parser": "^4.5.3",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.96.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.5.0",
      "pg": "^8.23.0"
ddiff --git a/server/auth.js b/server/auth.js
iindex 2f9773a..01d0f83 100644
---- a/server/auth.js
++++ b/server/auth.js
@@@ -6,9 +6,9 @@
   * offline against Network's JWKS (openvibe-sdk/auth, one client per URL, kept fresh and served
   * through an outage), and ONE capability per route.
   *
-- * The sources.* capabilities are proposed in docs/capabilities-proposal/ and are not in
-- * openvibe-contracts v0.7.0 yet; checkCapability() decides them with the library's own grant rule
-- * (exact id or a `family.*` grant) until a release knows them, then the library decides.
++ * The sources.* capabilities are released in openvibe-contracts (docs/capabilities-proposal/ is
++ * kept in step with those manifests), so the library's own grant rule decides every one: an exact
++ * id or a `family.*` grant, and capability.unknown for an id it does not know.
   */
  const { serviceAuth, capabilities, http } = require('openvibe-contracts');
  const { jwksClient } = require('openvibe-sdk/auth');
@@@ -18,14 +18,8 @@ const CAPS = Object.freeze({
      items: 'sources.item.read',
      manage: 'sources.source.manage',
  });
--const PROPOSED = new Set(Object.values(CAPS));
  
  function checkCapability(claims, capabilityId) {
--    if (!capabilities.get(capabilityId) && PROPOSED.has(capabilityId)) {
--        return capabilities.grants(claims && claims.cap, capabilityId)
--            ? { allowed: true, code: null, reason: null }
--            : { allowed: false, code: 'capability.denied', reason: `${capabilityId} not granted` };
--    }
      return capabilities.check(claims, capabilityId);
  }
  
@@@ -71,4 +65,4 @@ function createAuth({ config, log = console }) {
      return { requireCap };
  }
  
--module.exports = { CAPS, PROPOSED, createAuth, checkCapability };
++module.exports = { CAPS, createAuth, checkCapability };
ddiff --git a/test/proposals.test.js b/test/proposals.test.js
iindex 5691de2..cbf5a60 100644
---- a/test/proposals.test.js
++++ b/test/proposals.test.js
@@@ -22,6 +22,12 @@ const schema = (name) => ajv.compile(JSON.parse(fs.readFileSync(path.join(DOCS,
  const sourceSchema = schema('source.v1.json');
  const itemSchema = schema('item.v1.json');
  
++/** The body must validate against the contract openvibe-contracts released under that id. */
++function assertReleased(id, body, note = '') {
++    const v = contracts.validate(id, body);
++    assert.ok(v.valid, `${id}${note ? ` (${note})` : ''}: ${JSON.stringify(v.errors)}`);
++}
++
  t('capability proposals are valid capabilities.capability@1 and cover every enforced id', () => {
      const dir = path.join(DOCS, 'capabilities-proposal');
      const ids = fs.readdirSync(dir).filter(f => f.endsWith('.json')).map((f) => {
@@@ -34,6 +40,16 @@ t('capability proposals are valid capabilities.capability@1 and cover every enfo
      assert.deepStrictEqual(ids.sort(), Object.values(CAPS).sort());
  });
  
++t('capability proposals mirror the manifests openvibe-contracts released', () => {
++    const pick = (m) => ({ id: m.id, inputSchema: m.inputSchema ?? null, outputSchema: m.outputSchema ?? null, permissions: m.permissions, resourceConstraints: m.resourceConstraints, quotaClass: m.quotaClass, events: m.events, implementedBy: m.implementedBy });
++    for (const id of Object.values(CAPS)) {
++        const released = contracts.capabilities.get(id);
++        assert.ok(released, `${id} is not released in openvibe-contracts`);
++        const proposed = JSON.parse(fs.readFileSync(path.join(DOCS, 'capabilities-proposal', `${id}.json`), 'utf8'));
++        assert.deepStrictEqual(pick(proposed), pick(released), `${id}: docs/capabilities-proposal must match the released manifest`);
++    }
++});
++
  t('the service manifest proposal is a valid registry.service-manifest@1', () => {
      const m = JSON.parse(fs.readFileSync(path.join(DOCS, 'service-manifest-proposal.json'), 'utf8'));
      const v = contracts.validate('registry.service-manifest@1', m);
@@@ -61,19 +77,30 @@ t('seeds: one real source per category, all disabled, all valid, notes recorded'
      await fresh.close();
  });
  
--t('API views match sources.source@1 and sources.item@1', async () => {
++t('API views match sources.source@1 and sources.item@1, and the released sources.* contracts', async () => {
      const svc = await boot();
      const web = await site({ '/robots.txt': () => ({ status: 404 }), '/f': () => ({ body: rss([{ guid: 'p1', title: 'P', link: 'https://example.org/p' }]) }) });
      try {
          const admin = serviceToken('network', ['sources.*']);
--        await request(svc.base, 'POST', '/api/v1/sources', { token: admin, body: sourceDef({ key: 'proposal-check', endpoints: [`${web.origin}/f`] }) });
--        await request(svc.base, 'POST', '/api/v1/sources/proposal-check/fetch', { token: admin });
++        const def = sourceDef({ key: 'proposal-check', endpoints: [`${web.origin}/f`] });
++        // The request bodies and every route's answer follow the contracts openvibe-contracts released for sources.
++        assertReleased('sources.source-write-request@1', def, 'POST /api/v1/sources body');
++        const created = await request(svc.base, 'POST', '/api/v1/sources', { token: admin, body: def });
++        assertReleased('sources.source-manage-result@1', created.body, 'POST /api/v1/sources');
++        const fetched = await request(svc.base, 'POST', '/api/v1/sources/proposal-check/fetch', { token: admin });
++        assertReleased('sources.source-manage-result@1', fetched.body, 'POST /api/v1/sources/:key/fetch');
          const src = await request(svc.base, 'GET', '/api/v1/sources/proposal-check', { token: admin });
          assert.ok(sourceSchema(src.body.source), JSON.stringify(sourceSchema.errors));
++        assertReleased('sources.source-read-result@1', src.body, 'GET /api/v1/sources/:key');
++        assertReleased('sources.source-read-result@1', (await request(svc.base, 'GET', '/api/v1/sources', { token: admin })).body, 'GET /api/v1/sources');
++        assertReleased('sources.source-read-result@1', (await request(svc.base, 'GET', '/api/v1/runs', { token: admin })).body, 'GET /api/v1/runs');
++        assertReleased('sources.source-read-result@1', (await request(svc.base, 'GET', '/api/v1/health', { token: admin })).body, 'GET /api/v1/health');
          const items = await request(svc.base, 'GET', '/api/v1/items', { token: admin });
          for (const it of items.body.items) assert.ok(itemSchema(it), JSON.stringify(itemSchema.errors));
++        assertReleased('sources.item-read-result@1', items.body, 'GET /api/v1/items');
          const one = await request(svc.base, 'GET', `/api/v1/items/${items.body.items[0].id}?revisions=1`, { token: admin });
          assert.ok(itemSchema(one.body.item), JSON.stringify(itemSchema.errors));
++        assertReleased('sources.item-read-result@1', one.body, 'GET /api/v1/items/:id');
      } finally { await svc.stop(); await web.close(); }
  });