{
  "repository": "OpenVibers/OpenVibe.Surf",
  "version": "0.1.0",
  "stage": "v1",
  "code": true,
  "wave": "W20",
  "plan": "OpenVibe.Surf: one room with three surfs. Ride is CS-style surf in the browser served by OpenVibe.Games; Watch is lean-back channel surfing over OpenVibe.Live's live streams, clips and AI moments; Web is Surf with Vibe, where an agent browses for you on a private desk through OpenVibe.Actor.",
  "runtime": "node 22, express 4, openvibe-shared/shell; no database, no Valkey, no Events; watch parties are in memory and end on restart",
  "port": "5110",
  "domain": "openvibe.surf",
  "contracts": "openvibe-contracts v0.419.0",
  "sdk": "openvibe-sdk v0.161.0",
  "shared": "openvibe-shared v4.241.0",
  "packages": [
    "openvibe-contracts v0.419.0",
    "openvibe-sdk v0.161.0",
    "openvibe-shared v4.241.0"
  ],
  "summary": "openvibe.surf, the Surf room: Network sign-in as OAuth client `surf`; Ride (OpenVibe.Games' surf maps, cached 60 s, embedded); Watch (a lean-back TV over OpenVibe.Live's live streams, clips and AI moments, clips and moments playing in the page over HLS) plus watch together (in-memory SSE parties); Web (Surf with Vibe: one OpenVibe.Actor task made with the person's own Network token). No database.",
  "works": [
    "Sign-in with OpenVibe.Network: OAuth 2 authorization code, PKCE S256, state check, server-side exchange, httpOnly surf_at/surf_rt cookies, sanitizeNext (own origins only, no control characters or backslashes)",
    "Watch GET /api/v1/watch/feed?topic=all|live|clips|moments&cursor=: merges OpenVibe.Live's /api/streams, /api/content/feed?type=clips and /api/content/moments?type=clips into one item shape, ranks live by viewers then moments/clips by freshness with no channel twice in a row, caches 30 s, 2 s per source, a failing source left out and named in sources, public max-age=30",
    "Ride GET /api/v1/ride/maps and /api/v1/ride/maps/:id: proxies OpenVibe.Games' /api/surf/maps routes, adds each map's embed_url (https://openvibe.games/surf/embed?map=<id>&embed=1), caches 60 s, Games 404 → empty list/map shell with games: 'not_ready'",
    "Web POST /api/v1/web/tasks: signed in, same-origin, query 3–500 characters, sends the person's surf_at token to OpenVibe.Actor as a Bearer with an Idempotency-Key and the prefixed browsing brief, answers { task_id, page }, and passes Actor's 4xx refusal through in words",
    "POST /web/go: the same task as a plain form for no-JavaScript (this site only, the question never in a URL): 303 to the Actor task page, sign-in redirect for a guest, Actor's refusal in plain words",
    "Designed pages: / (the run motif, three tiles, scenes, questions; its Watch scene is the real Live feed head, fetched server-side and linked to each item), /ride and /ride/:map, /watch (the TV and its guide, HLS in the page), /watch/p/:id (watch together), /web, /developers and a 404; public max-age=60 with Vary: Cookie, signed-in private, no-store",
    "Watch together: POST /watch/party makes an unguessable /watch/p/<id>, signed-in members join by opening it, the host commands { channel_key, position_s, playing, at } from this site, GET /watch/p/:id/events carries SSE to members (drift > 2 s corrected), and anyone can leave; the Map is capped at 200 parties/50 members, an empty party is dropped 30 min after its last member leaves, and a restart ends every party",
    "Crawl artifacts (robots.txt, sitemap.xml with the public pages and Ride maps, llms.txt), /api/health, /api/ready (degraded when Network/Live/Games/Actor do not answer), /release.json, /release-metrics, /shared/*",
    "Helmet with the network's CSP (Games and Live frames, openvibe.media HLS), per-IP 120/min on /api and /auth, content-hashed /css and /js, graceful stop",
    "Deploy files: openvibe-surf.service, nginx vhost for openvibe.surf on 127.0.0.1:5110 with the forms zone, /auth/me on the API zone and /internal + /metrics 404",
    "Tests: feed merge/order/shape/failing source/30 s cache/cursor, ride proxy/cache/not_ready/failure, web 401/403/Actor Bearer + Idempotency-Key + prefixed text/refusal/redirect, SSO (Design's cases), pages/cache headers/CSP, discovery"
  ],
  "notYet": [
    "OpenVibe.Games' surf mode and GET /api/surf/maps: until they ship, Ride answers games: 'not_ready' and the page says the maps are being built",
    "A browser (WHIP) live stream in the TV: it has no DVR playlist yet, so it opens on its channel"
  ],
  "capabilitiesRegistered": false,
  "serviceManifestRegistered": true,
  "deployed": true,
  "placeholderInSites": false,
  "features": [
    "Network sign-in (PKCE)",
    "Watch merged Live feed",
    "Watch together (SSE parties)",
    "Ride Games maps proxy",
    "Surf with Vibe via OpenVibe.Actor",
    "server-rendered pages",
    "crawl artifacts",
    "limits and readiness",
    "deploy files"
  ],
  "updated": "2026-11-13"
}