openvibe-shared v4.133.0 (was v4.129.0) (#97)

ddiff --git a/README.md b/README.md
iindex 004debc..0e948bb 100644
---- a/README.md
++++ b/README.md
@@@ -261,5 +261,5 @@ Part of the [OpenVibe network](https://openvibe.network). Built in the open by
  <!-- versions:start -->
  - openvibe-contracts: v0.312.0
  - openvibe-sdk: v0.94.0
--- openvibe-shared: v4.129.0
++- openvibe-shared: v4.133.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex 4f65f7a..42bcf6f 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -10,11 +10,11 @@
    "domain": "openvibe.surf",
    "contracts": "openvibe-contracts v0.312.0",
    "sdk": "openvibe-sdk v0.94.0",
--  "shared": "openvibe-shared v4.129.0",
++  "shared": "openvibe-shared v4.133.0",
    "packages": [
      "openvibe-contracts v0.312.0",
      "openvibe-sdk v0.94.0",
--    "openvibe-shared v4.129.0"
++    "openvibe-shared v4.133.0"
    ],
    "summary": "openvibe.surf, the Surf room: Network sign-in as OAuth client `surf`; Ride (OpenVibe.Games' surf maps, cached 60 s, embedded); Watch (a lean-back TV over OpenVibe.Live's live streams, clips and AI moments, clips and moments playing in the page over HLS) plus watch together (in-memory SSE parties); Web (Surf with Vibe: one OpenVibe.Actor task made with the person's own Network token). No database.",
    "works": [
ddiff --git a/package-lock.json b/package-lock.json
iindex 9bcd3a6..e697bb0 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -16,7 +16,7 @@
          "helmet": "^8.1.0",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.94.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.129.0"
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.133.0"
        },
        "engines": {
          "node": ">=22.0.0"
@@@ -1103,9 +1103,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "4.129.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.129.0",
--      "integrity": "sha512-wkBHrcR5C2mc+tmnIE4UVQaLztVNZtmg3xq1DQpaK1lqx3QshiVpBBAWkTvsaBMD5wOHxrXwfZ69pK6zCoFofQ==",
++      "version": "4.133.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.133.0",
++      "integrity": "sha512-ry+yvht0O+fHhMQr2LOaQKRYJo38d2cgsI3UtRmHge91qEQ/gL0wtcHawME1/G7V0NrlpdGzJMueKYd8UKrhjw==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0",
ddiff --git a/package.json b/package.json
iindex bbf80de..41b4237 100644
---- a/package.json
++++ b/package.json
@@@ -22,7 +22,7 @@
      "helmet": "^8.1.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.94.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.129.0"
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.133.0"
    },
    "engines": {
      "node": ">=22.0.0"
ddiff --git a/server/app.js b/server/app.js
iindex bea5918..372bfa3 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -99,7 +99,7 @@ function createApp(opts = {}) {
                  imgSrc: ["'self'", 'data:', 'https:'],
                  // The footer's release line hears OpenVibe.Events; Cloudflare's beacon reports page timings.
                  // hls.js fetches Media's playlists and segments, which may redirect to R2 or B2 (as openvibe.video's CSP).
--                connectSrc: ["'self'", 'https://openvibe.network', 'https://cloudflareinsights.com', 'https://openvibe.events', 'https://openvibe.media', 'https://edge.openvibe.media', 'https://*.r2.cloudflarestorage.com', 'https://*.backblazeb2.com'],
++                connectSrc: ["'self'", 'https://openvibe.network', 'https://openvibe.chat', 'https://cloudflareinsights.com', 'https://openvibe.events', 'https://openvibe.media', 'https://edge.openvibe.media', 'https://*.r2.cloudflarestorage.com', 'https://*.backblazeb2.com'],
                  // Ride embeds a Games map; Watch may embed Live's player when Live has one.
                  frameSrc: ["'self'", 'https://openvibe.games', 'https://openvibe.live'],
                  // HLS clips play from the media edge (and a blob: URL a player may build).
ddiff --git a/test/pages.test.js b/test/pages.test.js
iindex d1f6985..fc21543 100644
---- a/test/pages.test.js
++++ b/test/pages.test.js
@@@ -188,7 +188,8 @@ const { assetVersion } = require('../server/assets');
          assert.match(csp, /frame-src 'self' https:\/\/openvibe\.games https:\/\/openvibe\.live/);
          assert.match(csp, /media-src 'self' https:\/\/openvibe\.media https:\/\/edge\.openvibe\.media https:\/\/\*\.r2\.cloudflarestorage\.com https:\/\/\*\.backblazeb2\.com blob:/);
          assert.match(csp, /connect-src [^;]*https:\/\/openvibe\.media/, 'hls.js fetches Media\'s playlists and segments');
--        assert.match(csp, /connect-src 'self' https:\/\/openvibe\.network https:\/\/cloudflareinsights\.com https:\/\/openvibe\.events/);
++        // OpenVibe.Chat too: the navbar's Messages count (openvibe-shared 4.130.0).
++        assert.match(csp, /connect-src 'self' https:\/\/openvibe\.network https:\/\/openvibe\.chat https:\/\/cloudflareinsights\.com https:\/\/openvibe\.events/);
      });
  
      await check('health and readiness are honest; a Network outage is degraded, not down', async () => {